AWS Glue错误-调用HeadObject操作时发生错误（403）：禁止

Question

我有一个简单的Glue pythonshell作业，出于测试目的，我只添加了print（“ Hello World”）。

我已为其提供了必需的AWSGlueServiceRole。当我尝试运行作业时，它将引发以下错误：

Traceback (most recent call last):
  File "/tmp/runscript.py", line 114, in <module>
    temp_file_path = download_user_script(args.scriptLocation)
  File "/tmp/runscript.py", line 91, in download_user_script
    download_from_s3(args.scriptLocation, temp_file_path)
  File "/tmp/runscript.py", line 81, in download_from_s3
    s3.download_file(bucket_name, s3_key, new_file_path)
  File "/usr/local/lib/python3.6/site-packages/boto3/s3/inject.py", line 172, in download_file
    extra_args=ExtraArgs, callback=Callback)
  File "/usr/local/lib/python3.6/site-packages/boto3/s3/transfer.py", line 307, in download_file
    future.result()
  File "/usr/local/lib/python3.6/site-packages/s3transfer/futures.py", line 106, in result
    return self._coordinator.result()
  File "/usr/local/lib/python3.6/site-packages/s3transfer/futures.py", line 265, in result
    raise self._exception
  File "/usr/local/lib/python3.6/site-packages/s3transfer/tasks.py", line 255, in _main
    self._submit(transfer_future=transfer_future, **kwargs)
  File "/usr/local/lib/python3.6/site-packages/s3transfer/download.py", line 345, in _submit
    **transfer_future.meta.call_args.extra_args
  File "/usr/local/lib/python3.6/site-packages/botocore/client.py", line 357, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/lib/python3.6/site-packages/botocore/client.py", line 661, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden

当我将S3完全访问策略添加到角色时，作业将成功运行。我无法调试出什么问题

Answer 1

在Glue中，您需要将S3策略附加到用于运行作业的Amazon Glue角色。定义作业时，请选择角色。在此示例中，它是AWSGlueServiceRole-S3IAMRole。在您分配它之前，它没有S3访问权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        }
    ]
}