Question

我有一个允许或读取对kinesis流（AWSLambdaKinesisExecutionRole）的访问权限的托管策略，我正在尝试添加其他权限，以允许对PutRecord和PutRecords的写访问权限到了kinesis流。

我的serverless.yml目前看起来像 -

resources:
  Resources:
    kinesisFullAccessRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: kinesis-full-access-role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole
        Policies:
          - PolicyName: kinesis-write-access
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - kinesis:PutRecord
                    - kinesis:PutRecords
                  Resource:
                    - "arn:<some_arn>:stream/inbound-message-stream-dev"

我仍然收到is not authorized to perform: kinesis:PutRecord on resource错误。我做错了什么？

Answer 1

如果您的无服务器自己创建了IAM角色，那么您应该将var waitForElement = new WebDriverWait(_driver, TimeSpan.FromSeconds(5)); waitForElement.Until(driver =>_driver.ExecuteJavaScript<string>("return document.readyState").ToString() == "complete");显示为here

但是可以更容易在aws控制台中创建IAM角色并自行管理，并像here

一样使用它

向无服务器yaml添加其他单独的IAM策略以扩展托管策略

1 个答案: