我有一个具有完全访问SQS的角色的lambda，但我仍然不能向SQS发送消息

Question

请帮忙，我被AWS打败了。。。

我有一个具有以下权限的lambda。

sqs基于资源的策略和服务角色都没有任何Deny语句。lambda应该向另一个SQS队列发送一条消息，但它不能，相反，我只是得到了这个错误

{
    "code": "AccessDenied",
    "time": "2021-06-03T20:50:09.722Z",
    "requestId": "62e15127-9f9b-527f-b1a8-0814dd5a5c9a",
    "statusCode": 403,
    "retryable": false,
    "retryDelay": 47.17774745450638,
    "level": "error",
    "message": "Access to the resource https://sqs.eu-west-1.amazonaws.com/ is denied.",
    "timestamp": "2021-06-03T20:50:09.723Z"
}

应执行此操作的lambda代码（此代码通常位于多个文件上）

import { SQSEvent } from 'aws-lambda';
import { isLeft } from 'fp-ts/lib/Either';
import { first } from 'lodash';
import reporter from 'io-ts-reporters';
import ExitWithSuccess from 'Entities/ExitWithSuccess';
import { error } from '@mvf/logger';
import { SQS } from 'aws-sdk';
import Event from './Event';

const sqsClient = new SQS({
  region: 'eu-west-1',
});

const delayed = {
  client: sqsClient,
  url: 'https://sqs.eu-west-1.amazonaws.com/<account>/event_dispatcher_delayed_messages',
};

type ISqsClient = typeof delayed;
interface SqsOperations {
  sendMessage(body: Record<string, unknown>): Promise<unknown>;
}

const sqs = {
  instance: ({ client, url }: ISqsClient): SqsOperations => ({
    sendMessage: (body: Record<string, unknown>) =>
      client
        .sendMessage({ QueueUrl: url, MessageBody: JSON.stringify(body) })
        .promise(),
  }),
  delayed,
};

const lambda = async (event: SQSEvent): Promise<void> => {
  const record = first(event.Records);
  if (!record) {
    throw new ExitWithSuccess(error, 'lambda was invoked without any records');
  }

  const maybeEvent = Event.decode(JSON.parse(record.body));
  if (isLeft(maybeEvent)) {
    throw new ExitWithSuccess(error, 'invalid record body', {
      typeErrors: reporter.report(maybeEvent),
    });
  }

  await sqs.instance(delayed).sendMessage(maybeEvent.right);
};

export default lambda;

我已经花了3天时间，有人遇到过类似的问题吗？怎么可能完全可以访问资源，但仍然无法与之交互？

任何关于这里发生的事情的提示、建议或想法都将不胜感激。

Answer 1

SQS队列是否有明确拒绝访问的基于资源的策略？

SQS队列是否在Lambda函数所在的同一个帐户中？否则，您也需要允许跨帐户访问。

https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-basic-examples-of-sqs-policies.html