错误：创建 AWS 自定义资源时拒绝访问答案

【问题标题】：Error : Access denied When creating AWS custom resource错误：创建 AWS 自定义资源时拒绝访问
【发布时间】：2020-10-04 15:20:12
【问题描述】：

我正在尝试创建一个自定义资源，以便使用 cdk 将库存配置添加到存储桶我正在调用 putBucketInventoryConfiguration() - https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/S3.html#putBucketInventoryConfiguration-property 但我被拒绝访问目标存储桶的策略-

        config_inventory_role.add_to_policy(iam.PolicyStatement(
        effect=iam.Effect.ALLOW,
        resources=[f'{config_inventory_bucket.bucket_arn}/*'],
        actions=['s3:PutObject'],
        conditions={"ArnLike": {
            "aws:SourceArn": config_upload_bucket.bucket_arn
        },
            "StringEquals": {
            "aws:SourceAccount": [
                kwargs["env"]["aws"]["account"]
            ],
            "s3:x-amz-acl": "bucket-owner-full-control"
        }
        }
    ))

(iotsysteminventoryc231de866a82512a9a84151e276042845F52818C) Failed to create resource. Access Denied

[2020-06-15T08:23:51.589Z]  new CustomResource (/tmp/jsii-kernel-ymFU82/node_modules/@aws-cdk/core/lib/custom-resource.js:23:25)

[2020-06-15T08:23:51.589Z]  \_ new AwsCustomResource (/tmp/jsii-kernel-ymFU82/node_modules/@aws-cdk/custom-resources/lib/aws-custom-resource/aws-custom-resource.js:130:31)

[2020-06-15T08:23:51.589Z]  \_ /usr/local/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7853:49

[2020-06-15T08:23:51.589Z]  \_ Kernel._wrapSandboxCode (/usr/local/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:8313:20)

[2020-06-15T08:23:51.589Z]  \_ Kernel._create (/usr/local/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7853:26)

[2020-06-15T08:23:51.589Z]  \_ Kernel.create (/usr/local/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7600:21)

[2020-06-15T08:23:51.589Z]  \_ KernelHost.processRequest (/usr/local/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7388:28)

[2020-06-15T08:23:51.589Z]  \_ KernelHost.run (/usr/local/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7328:14)

[2020-06-15T08:23:51.589Z]  \_ Immediate._onImmediate (/usr/local/lib/python3.8/site-packages/jsii/_embedded/jsii/jsii-runtime.js:7331:37)

[2020-06-15T08:23:51.589Z]  \_ processImmediate (internal/timers.js:439:21)

【问题讨论】：

您的 lambda 是否具有有权修改 s3 存储桶的执行角色？您还可以提供完整的错误消息吗？
拥有所有资源访问权限
它是否尝试创建堆栈？也许 CloudFormation 控制台有更多有用的信息？
云层显示同样的错误
你可以试试 actions=['s3:*'] 吗？

标签： python amazon-web-services aws-cdk aws-cloudformation-custom-resource

【解决方案1】：

我遇到了同样的问题，你找到解决办法了吗？

new AwsCustomResource(this, 'ExportTaskDefToS3', {
   onUpdate: {
      service: 'S3',
      action: 'putObject',
      parameters: {
        ...s3params
      },
      physicalResourceId: PhysicalResourceId.of('ExportTaskDefToS3')
   },
   policy: AwsCustomResourcePolicy.fromStatements([
    new PolicyStatement({
      actions: ["s3:*"],
      resources: [`${props.sourceBucketArn}/*`],
    }),
  ])
});

找到了我的问题的解决方案->

我正在创建的自定义资源在帐户 B 中。 S3 存储桶在账户 A 中。我必须更新账户 A 中的 S3 存储桶策略。

{ “版本”：“2012-10-17”， “陈述”： [ { “效果”：“允许”， “主要的”： { "AWS": "arn:aws:iam::AccountB:user/AccountBUserName" }, “行动”： [ "s3:GetObject", "s3:PutObject", “s3:PutObjectAcl” ], “资源”：[ “arn:aws:s3:::AccountABucketName/*” ] } ] }

【讨论】：