AWS Lambda S3.getObject 抛出"Access Denied"，但仅在本地运行时

Question

我使用AWS Lambda和serverless框架来构建一个使用S3存储文件的服务
lambda函数("hello"(在部署到云中时工作良好(它有一个http端点，我从浏览器调用它(
相反，当本地调用(serverless invoke local --function hello(时，我得到"；访问被拒绝"；错误：

{
"errorMessage": "error getting object from S3: AccessDenied: Access Denied",
"errorType": "Error",
"stackTrace": [
"Error: error getting object from S3: AccessDenied: Access Denied",
"    at module.exports.hello (/....js:24:9)",
"    at processTicksAndRejections (internal/process/task_queues.js:93:5)"
]
}

这是我的简化功能：

'use strict';
const aws = require("aws-sdk");
const s3 = new aws.S3({ region: "eu-west-1" });
const bucket = "my-bucket-dev";
const key = "ads.json";
module.exports.hello = async (event) => {
let obj = null;
try {
return await s3.getObject({ Bucket: bucket, Key: key }).promise();
} catch(err) {
throw new Error(`error getting object from S3: ${err}`);
}
return {
statusCode: 200,
body: JSON.stringify({
message: `Hello function executed successfully!`,
obj,
input: event,
},
null,
2
),
};
}

这是我的serveless.yml(相关部分(：

service: my-service
frameworkVersion: '2'  
provider:
name: aws
runtime: nodejs12.x
profile: serverless
lambdaHashingVersion: 20201221
apiGateway:
shouldStartNameWithService: true
stage: ${opt:stage, "dev"}
region: eu-west-1
iam:
role:
statements:
- Effect: "Allow"
Action:
- "s3:ListBucket"
Resource: { "Fn::Join": [ "", [ "arn:aws:s3:::", "my-service-dev" ] ] }
- Effect: "Allow"
Action:
- "s3:GetObject"
- "s3:PutObject"
- "s3:DeleteObject"
Resource: { "Fn::Join": [ "", [ "arn:aws:s3:::", "my-service-dev", "/*" ] ] }
functions:
hello:
handler: index.hello
events:
- http:
method: get
path: hello
- s3: my-bucket-dev

我确实在某个地方读到IAM角色声明在本地和云执行中有所不同，但如果正确的话，我有点困惑
有人能澄清吗
我应该如何更正serverless.yml以避免本地调用错误？

Answer 1

引用调用本地的文档：

当您使用无服务器调用本地时，情况会大不相同：角色不可用(该功能在本地机器上执行(，因此除非您直接在代码中(或通过一对关键的环境变量(设置不同的用户，否则AWS SDK将使用在AWS凭据配置文件中指定的默认配置文件。

因此，对于本地调用，可以在~/.aws/credentials中适当配置本地AWS凭据，也可以通过环境变量提供它们。