为什么我的lambda函数被拒绝访问S3桶？

Question

1. Lambda执行角色具有s3访问51个函数的权限，包括ListBuckets和所有其他读取操作。
2. 我的S3桶有允许从lambda角色访问的策略。(而且它在同一个帐户里，所以我不认为这是必需的)。
3. 我甚至为了好玩才把水桶公开了。

这是lambda的代码。我不知道为什么bucket.objects.all()不能访问s3。

导入json导入boto3 s3 =boto3 3.(‘s3’)

def lambda_handler(事件，上下文)：打印(事件)

message = 'Hello {}!'.format(event['Records'][0]['s3']['bucket']['name'])  
print(message)
bucket = s3.Bucket('my-bucketname-demo')
# this works
print(bucket.creation_date)

# this fails on access denied
# Iterates through all the objects, doing the pagination for you. Each obj
# is an ObjectSummary, so it doesn't contain the body. You'll need to call
# get to get the whole body.
for obj in bucket.objects.all():
    key = obj.key
    body = obj.get()['Body'].read()
    print(key)
    print(body)
    
return {
    'statusCode': 200,
    'body': json.dumps('Hello from Lambda!')
}

下面是错误: ERROR ClientError:一个错误发生(AccessDenied)时调用ListObjects操作:访问被拒绝

Lambda执行角色策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetLifecycleConfiguration",
                "s3:GetBucketTagging",
                "s3:GetInventoryConfiguration",
                "s3:GetObjectVersionTagging",
                "s3:ListBucketVersions",
                "s3:GetBucketLogging",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetStorageLensConfigurationTagging",
                "s3:GetObjectVersionTorrent",
                "s3:GetObjectAcl",
                "s3:GetEncryptionConfiguration",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetIntelligentTieringConfiguration",
                "s3:GetBucketRequestPayment",
                "s3:GetAccessPointPolicyStatus",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectTagging",
                "s3:GetMetricsConfiguration",
                "s3:GetBucketOwnershipControls",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketPolicyStatus",
                "s3:ListBucketMultipartUploads",
                "s3:GetObjectRetention",
                "s3:GetBucketWebsite",
                "s3:GetJobTagging",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:GetObjectLegalHold",
                "s3:GetBucketNotification",
                "s3:GetReplicationConfiguration",
                "s3:ListMultipartUploadParts",
                "s3:GetObject",
                "s3:GetStorageLensConfiguration",
                "s3:GetObjectTorrent",
                "s3:DescribeJob",
                "s3:GetBucketCORS",
                "s3:GetAnalyticsConfiguration",
                "s3:GetObjectVersionForReplication",
                "s3:GetBucketLocation",
                "s3:GetAccessPointPolicy",
                "s3:GetObjectVersion",
                "s3:GetStorageLensDashboard"
            ],
            "Resource": "arn:aws:s3:::my-bucket-demo/*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListStorageLensConfigurations",
                "s3:GetAccessPoint",
                "s3:GetAccountPublicAccessBlock",
                "s3:ListAllMyBuckets",
                "s3:ListAccessPoints",
                "s3:ListJobs",
                "s3:ListObjects"
            ],
            "Resource": "*"
        }
    ]
}

Answer 1

当前的资源arn:aws:s3:::my-bucket-demo/*只表示my-bucket-demo中的对象。随后，任何与桶(例如ListBucket)相关的操作都不适用。您应该向您的策略中添加桶资源arn:aws:s3：：my--demo`：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetLifecycleConfiguration",
                "s3:GetBucketTagging",
                "s3:GetInventoryConfiguration",
                "s3:GetObjectVersionTagging",
                "s3:ListBucketVersions",
                "s3:GetBucketLogging",
                "s3:ListBucket",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetStorageLensConfigurationTagging",
                "s3:GetObjectVersionTorrent",
                "s3:GetObjectAcl",
                "s3:GetEncryptionConfiguration",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetIntelligentTieringConfiguration",
                "s3:GetBucketRequestPayment",
                "s3:GetAccessPointPolicyStatus",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectTagging",
                "s3:GetMetricsConfiguration",
                "s3:GetBucketOwnershipControls",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketPolicyStatus",
                "s3:ListBucketMultipartUploads",
                "s3:GetObjectRetention",
                "s3:GetBucketWebsite",
                "s3:GetJobTagging",
                "s3:GetBucketVersioning",
                "s3:GetBucketAcl",
                "s3:GetObjectLegalHold",
                "s3:GetBucketNotification",
                "s3:GetReplicationConfiguration",
                "s3:ListMultipartUploadParts",
                "s3:GetObject",
                "s3:GetStorageLensConfiguration",
                "s3:GetObjectTorrent",
                "s3:DescribeJob",
                "s3:GetBucketCORS",
                "s3:GetAnalyticsConfiguration",
                "s3:GetObjectVersionForReplication",
                "s3:GetBucketLocation",
                "s3:GetAccessPointPolicy",
                "s3:GetObjectVersion",
                "s3:GetStorageLensDashboard"
            ],
            "Resource": ["arn:aws:s3:::my-bucket-demo",
                         "arn:aws:s3:::my-bucket-demo/*"]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:ListStorageLensConfigurations",
                "s3:GetAccessPoint",
                "s3:GetAccountPublicAccessBlock",
                "s3:ListAllMyBuckets",
                "s3:ListAccessPoints",
                "s3:ListJobs",
                "s3:ListObjects"
            ],
            "Resource": "*"
        }
    ]
}

Answer 2

简短回答

确保您正在使用的角色具有下一个策略，并将该角色附加到您正在使用的lambda：

{
  "Version": "version_id",
  "Statement": [
    {
        "Sid": "some_id",
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::bucketname",
            "arn:aws:s3:::bucketname/*"
        ]
    }
  ] 
}

最佳实践的只使用您应该使用的权限

长答案

创建一个IAM策略来定义Lambda函数的权限。所需的权限包括：

• 从源S3桶中获取对象。
• 将调整大小的对象放入目标S3桶中。
• 与CloudWatch日志相关的权限。

创建IAM策略

在IAM控制台中打开政策页面。

选择创建策略

在JSON选项卡下，复制以下策略。确保源和目标桶名与您创建的存储桶匹配。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::bucketname/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::bucketname/*"
        },
        {
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket"
          ],
          "Resource": [
              "arn:aws:s3:::bucketname"
          ]
      }
    ]
}

• 选择“审阅策略”，指定策略名称并创建策略。

创建执行角色

创建授予函数访问AWS资源权限的执行角色。

• 在IAM控制台中打开角色页面。
• 选择Create角色。

使用以下属性创建一个角色。

可信实体- AWS Lambda。

权限-选择先前创建的策略。

角色名称-lambda-s3-角色。

AWSLambdaS3Policy策略具有函数在S3中管理对象所需的权限，如果您还没有将该角色附加到lambda中。您可以将其附加到lambda配置中。

Answer 3

我需要在没有AWS的情况下访问这个对象，而我也面临着同样的问题。

我通过使用静态IP创建lambda函数来解决这个问题，并允许S3桶上的IP地址到S3。

1. 创建一个新的VPC来运行您的代码--或者使用现有的VPC --如果您已经拥有带有私有/公共子网的VPC和具有弹性IP地址的NAT网关，您可以转到步骤6。
2. 创建一个新的互联网网关，以便从您的VPC内部与Internet进行通信。
3. 创建一个公共子网，并向路由表中添加一个新路由，从0.0.0.0/0路由到您的Internet网关。
4. 为静态IP创建一个新的弹性IP地址。创建一个新的NAT网关，并将其分配给您刚才使用的公共子网和弹性IP地址。
5. 创建一个私有子网，并向路由表中添加一个新路由，从0.0.0.0/0路由到NAT网关。
6. 创建一个安全组，并根据您的需求设置入站和出站规则(理想情况下没有入站通信量，并允许所有出站流量)。
7. 将VPC、子网、安全组附加到lambda函数。
8. 创建或更新S3桶策略以包含静态IP地址。

{
    "Version": "2012-10-17",
    "Id": "Policy1234567890",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::<s3-bucket-name>/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                        "<IP-Address>"
                    ]
                }
            }
        }
    ]
}

您应该能够使用GET方法从lambda访问对象。