小编Gra*_*r98的帖子

我有一个 s3 存储桶作为 cloudfront 的起源。该存储桶已阻止所有公共访问。我创建了一个 lambda 函数来下载、处理和上传 s3 对象。我为 lambda 创建了一个角色并添加了一个非公共政策，根据亚马逊资源公共的含义..这是政策

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3LambdaAccessObject",
            "Effect": "Allow",
            "Action": "s3:*Object",
            "Resource": "arn:aws:s3:::XXXXXXXXXXXXX-dev-videos-origin/*",
            "Condition": {
                "ArnEquals": {
                    "aws:SourceArn": "arn:aws:lambda:us-east-1:XXXXXXXXXXXXX:function:YYYYYYYYYYYY_conversor"
                }
            }
        },
        {
            "Sid": "S3LambdaListBucket",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::XXXXXXXXXXXXX-dev-videos-origin",
            "Condition": {
                "ArnEquals": {
                    "aws:SourceArn": "arn:aws:lambda:us-east-1:XXXXXXXXXXXXX:function:YYYYYYYYYYY_conversor"
                }
            }
        }

但是，当我尝试通过 sdk 下载文件并将其上传到 s3 时，我得到了访问被拒绝的代码。我什至已将 lamnda 添加到 s3 策略中，但仍然没有结果：

{
    "Version": "2012-10-17",
    "Id": "aws_iam_policy_document_origin",
    "Statement": [
        {
            "Sid": "S3GetObjectForCloudFront",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity …