无服务器Lambda SQS访问被拒绝错误

Question

我有一个通过serverless-framework运行的节点应用程序。

应用程序将消息写入SQS，代码为

const AWS = require('aws-sdk');
const config = require('../../configs/constants').config;

const sqs = new AWS.SQS({apiVersion: '2012-11-05'});

module.exports.sendMessage = (service, message) => {
    const params = {
        MessageBody: JSON.stringify(message),
        QueueUrl: config.SQS_QUEUE_URL_ANALYTICS
    };

    return new Promise((resolve, reject) => {
        sqs.sendMessage(params, (err, data) => {
            if (err) {
                console.error('Error creating SQS Message: ', err);
                reject(err);
            } else {
                console.log('SQS Message created successfully: ', data);
                resolve(data);
            }
        });
    });
};

授予用户的权限为

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sqs:ListQueues",
                "sqs:*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "sqs:*",
            "Resource": "arn:aws:sqs:ap-south-1:881210447458:Staging-Analytics-Log-Data-Process"
        }
    ]
}

当执行lambda函数时，它会给出一个错误

ERROR Error creating SQS Message: { AccessDenied: Access to the resource https://sqs.ap-south-1.amazonaws.com/ is denied.

要运行SQS，还需要哪些其他凭据？

Answer 1

要将消息从AWS Lambda发送到SQS，您需要附加到Lambda的IM角色才能将消息发送到SQS。因为在AWS中，您需要权限才能访问其他服务资源：

1. 创建具有SQS权限或所需访问权限的IM角色
2. Assign Created IM Role with Lambda function at start
3. See Permission assigned permission for your lambda at permission tab

​

​

Answer 2

不确定通配符是否缺少您的权限，但从您发布的代码中，您应该只需要发送邮件的权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sqs:SendMessage"
            ],
            "Resource": "arn:aws:sqs:ap-south-1:881210447458:Staging-Analytics-Log-Data-Process"
        }
    ]
}

Answer 3

将此权限插入到serverless.yml中的 provider: 选项卡下：

iamRoleStatements:
- Effect: Allow
  Action:
    - sqs:SendMessage
  Resource: <your swq ARN that starts with (arn:aws:sqs:)>