ListObjectV2 在 AWS Lambda 中获取访问被拒绝错误

Question

我不确定我的权限是否正确，但我试图listObjectsV2在我的 lambda 函数中使用，但我得到access denied error. 我正在使用无服务器。

这是我的 iAMRoleStatement

 iamRoleStatements:
    - Effect: "Allow"
      Action:
        - s3:GetObject
        - s3:ListBucket
      Resource: 
        - "arn:aws:s3:::${self:custom.bucket1}/*"
        - "arn:aws:s3:::${self:custom.bucket2}/*"

它给了我这样的回应：

{
    "errorMessage": "Access Denied",
    "errorType": "AccessDenied",
    "stackTrace": [
        "Request.extractError (/var/runtime/node_modules/aws-sdk/lib/services/s3.js:577:35)",
        "Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:105:20)",
        "Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77:10)",
        "Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:683:14)",
        "Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)",
        "AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)",
        "/var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10",
        "Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)",
        "Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:685:12)",
        "Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:115:18)"
    ]
}

这是功能

const AWS = require('aws-sdk')
const apiVersion = '2006-03-01'

module.exports.index = async (event, context) => {
  const s3 = new AWS.S3({ apiVersion })
  const { path: { bucket_name } } = event
  const params = {
    Bucket: 'ml-chips-result'
  }

  return new Promise((resolve, reject) => {
    s3.listObjectsV2(params, (err, data) => {
      if (err) reject(err)
      else resolve(data)
    })
  })
  .then(data => {
    return {
      data,
      event
    }
  })
}

根据我在文档中找到的示例，正​​确的权限是 ListBuckets。但它似乎不起作用。

Answer 1

尝试添加ListBuckets访问存储桶根目录的权限：

  Resource: 
    - "arn:aws:s3:::${self:custom.bucket1}"
    - "arn:aws:s3:::${self:custom.bucket1}/*"
    - "arn:aws:s3:::${self:custom.bucket2}"
    - "arn:aws:s3:::${self:custom.bucket2}/*"