列出S3关系时发生错误:Access Denied

Question

我已经创建了s3桶所需访问的lambda函数，我正在尝试创建s3事件触发器，但我正在获得访问拒绝错误。

lambda.tf

resource "aws_lambda_function" "s3-lambdas" {
filename         = "./s3-lambdas.zip"
function_name    = "s3-lambdas"
source_code_hash = filebase64sha256(s3-lambdas)
role             = module.lambda_role.arn
handler          = "s3-lambdas.lambda_handler"
runtime          = "python3.9"
timeout          = 200
description      = "invoke glue job"
depends_on       = [module.lambda_role]
}
resource "aws_lambda_permission" "s3_lambdas_s3_events" {
depends_on    = [aws_lambda_function.s3-lambdas]
statement_id  = "AllowS3Invoke"
action        = "lambda:InvokeFunction"
function_name = aws_lambda_function.s3-lambdas.function_name
principal     = "s3.amazonaws.com"
source_arn    = "arn:aws:s3:::${module.bucket-name.name}"
}
resource "aws_s3_bucket_notification" "bucket_notifications" {
bucket = module.bucket-name.name
lambda_function {
lambda_function_arn = aws_lambda_function.s3-lambdas.arn
events              = ["s3:ObjectCreated:*"]
filter_prefix       = "abc/def/"
}
depends_on = [aws_lambda_permission.s3_lambdas_s3_events]
}

和我的lambda角色，其中包含s3完全访问权限。s3.tf

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::dev-s3-bucket",
"arn:aws:s3:::dev-s3-bucket/*"
]
}
]
}

即使我得到An error occurred while listing S3 relations: Access Denied时，我试图创建s3触发器。

output "bucket_name" {
value = module.bucket-name.name
}
bucket_name = dev-s3-bucket
output "iam_dev_arn" {
value = module.lambda_role.arn
}
iam_dev_arn = arn:aws:iam::0123456789:role/s3-lambda-role
output "div_arn" {
value = aws_lambda_function.s3-lambdas.arn
}
div_arn = arn:aws:lambda:us-east-1:0123456789:function:s3-lambdas

assume_role_policy

{
"Version": "2008-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

我添加了与模块

相关的输出s3-lambdas

from __future__ import print_function
import boto3
import urllib
import os
print ('Loading function')
glue = boto3.client('glue')
def lambda_handler(event, context):
gluejobname = os.environ['glue_job']
try: 
runId = glue.start_job_run(JobName=gluejobname)
status = glue.get_job_run(JobName=gluejobname, RunId=runId['JobRunId'])
print("Job Status : ", status['JobRun']['JobRunState'], "runId",runId)
except Exception as e:
raise e
return {
"statusCode": 200,
"body": os.environ['glue_job'] + " Job started"
}

s3 bucket policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "denyInsecureTransport",
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::dev-s3-bucket/*",
"arn:aws:s3:::dev-s3-bucket"
],
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
}
}
]
}

Answer 1

您可以在S3桶策略中进行以下更改并重试吗?

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::dev-s3-bucket/abc/def/*"   <-- change this
]
}
]
}