AWS Lambda返回尝试从S3存储桶获取对象时被拒绝的权限

Question

我确实创建了一个lambda函数，当文件在S3存储桶中上传时，它应该将数据上传到DynamoDB。但是，当文件在存储桶中上传时，我在CloudWatch中得到一个“GetObject操作：权限拒绝”。lambda函数附加了一个IAM角色，并带有这些策略：Amazon onlambdaFullAccess、Amazon onS3FullAccess、Amazon onCloudWatchLogsFullAccess、Amazon onDynamoDBFullAccess。它lambda.amazonaws.com受信任的实体。存储桶没有附加任何策略。

 import boto3
 import json
 import urllib

 dynamodb = boto3.resource('dynamodb')
 table = dynamodb.Table('wireshark')
 s3 = boto3.client('s3')
 tests3 = boto3.resource(u's3')

 def lambda_handler(event, context):

     source_bucket = event['Records'][0]['s3']['bucket']['name']
     key = urllib.parse.quote_plus(event['Records'][0]['s3']['object']['key'])
    copy_source = {'Bucket':source_bucket , 'Key':key}
    print(event)
    print("Log stream name : ", context.log_stream_name)
    print("Log group name : ", context.log_group_name)
    print("Request Id:", context.aws_request_id)
    print("Mem. limit(MB): ", context.memory_limit_in_mb)

    #just print function
    print("Log stream name : ", context.log_stream_name)
    print("Log group name : ", context.log_group_name)
    print("Request Id:", context.aws_request_id)
    print("Mem. limit(MB): ", context.memory_limit_in_mb)

    try:
        print("Using waiter to waiting for object to persist thru s3 service")
        waiter = s3.get_waiter('object_exists')
        waiter.wait(Bucket=source_bucket, Key=key)
        print("Accessing the receied file and reading the same")
        bucket = tests3.Bucket(u'awslambdas3test2')
        obj = bucket.Object(key=key)
        response = obj.get()
        print("response from file object")
        print(response)

在Cloudwatch中：调用GetObject操作时发生错误（AccessDenied）：拒绝访问。我已经通过了aws的“政策模拟器”。这个IAM角色应该能够从任何S3 bucket获取对象。谢谢你的帮助。

代码主要来自GitHub。

Answer 1

下面是一个AWS Lambda函数，它将打印文件的内容：

import boto3
import os

def lambda_handler(event, context):

    s3_client = boto3.client('s3')

    # For each record

    for record in event['Records']:

        # Get Bucket and Key
        bucket = record['s3']['bucket']['name']
        key    = record['s3']['object']['key']

        # Print the bucket & key to the logs
        print(bucket, key)

        # Download object
        local_filename = '/tmp/' + key
        s3_client.download_file(bucket, key, local_filename)

        # Print contents to log (just to demonstrate concept)
        for line in open(local_filename):
            print(line)

        # Delete file when done, to clear space for future execution
        os.remove(local_filename)

在存储桶上创建一个Amazon S3事件来触发此Lambda函数，它将文件名和文件内容打印到CloudWatch日志。这应该是一个很好的测试，可以确定该程序是使用您的代码还是具有权限。