AWS AccessDeniedException elastictranscoder:CreateJob答案

【问题标题】：AWS AccessDeniedException elastictranscoder:CreateJobAWS AccessDeniedException elastictranscoder:CreateJob
【发布时间】：2016-10-10 13:56:12
【问题描述】：

我正在尝试使用 Lambda 函数来触发 Elastic Transcoder 作业，但我不断收到以下错误消息：

AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/xxxx/xxx is not authorized to perform: elastictranscoder:CreateJob on resource: arn:aws:elastictranscoder:xxxxx:pipeline/xxxxx

我的 IAM 用户政策涵盖所有访问要求：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1465486106000",
        "Effect": "Allow",
        "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:GetLogEvents",
            "logs:PutLogEvents",
            "logs:DescribeLogStreams"
        ],
        "Resource": [
            "arn:aws:logs:*:*:*"
        ]
    },
    {
        "Sid": "1",
        "Effect": "Allow",
        "Action": [
            "s3:Put*",
            "s3:ListBucket",
            "s3:*MultipartUpload*",
            "s3:Get*"
        ],
        "Resource": "*"
    },
    {
        "Sid": "2",
        "Effect": "Allow",
        "Action": "sns:Publish",
        "Resource": "*"
    },
    {
        "Sid": "3",
        "Effect": "Deny",
        "Action": [
            "s3:*Delete*",
            "s3:*Policy*",
            "sns:*Remove*",
            "sns:*Delete*",
            "sns:*Permission*"
        ],
        "Resource": "*"
    }
]
}

为什么我会收到AccessDeniedException，我该如何解决？

【问题讨论】：

标签： amazon-web-services amazon-s3 amazon-iam aws-lambda

【解决方案1】：

将您的策略更改为以下，然后尝试它会起作用

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1465486106000",
        "Effect": "Allow",
        "Action": [

            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:GetLogEvents",
            "logs:PutLogEvents",
            "logs:DescribeLogStreams"
        ],
        "Resource": [
            "arn:aws:logs:*:*:*"
        ]
    },
    {
        "Sid": "1",
        "Effect": "Allow",
        "Action": [
            "elastictranscoder:*",
            "s3:Put*",
            "s3:ListBucket",
            "s3:*MultipartUpload*",
            "s3:Get*"
        ],
        "Resource": "*"
    },
    {
        "Sid": "2",
        "Effect": "Allow",
        "Action": "sns:Publish",
        "Resource": "*"
    },
    {
        "Sid": "3",
        "Effect": "Deny",
        "Action": [
            "s3:*Delete*",
            "s3:*Policy*",
            "sns:*Remove*",
            "sns:*Delete*",
            "sns:*Permission*"
        ],
        "Resource": "*"
    }
]
}

【讨论】：

我怀疑 elastictranscoder 行需要位于适用于任何资源的部分中，而不是适用于 arn:aws:logs。
仍然收到与发布的政策相同的错误.. 立即尝试建议
它在 Sid: 1 语句中起作用！如果添加了另一个答案或更新了这个答案，我会接受它

【解决方案2】：

您不需要通过编辑来更改 json。首先检测你要编辑哪个角色？

1-) Click Permisson http://prntscr.com/j1giww 
2-) see the role name http://prntscr.com/j1gj6s 
3-) go to IAM Roles 
4-) select the roles that you see at step 2
5-) edit policy and add Transcoder Full Access ( Or selected access )

【讨论】：

这对我有帮助:)