在无服务器堆栈上插入 Aws Timestream 时访问被拒绝错误答案

【问题标题】：Access Denied Error while inserting into Aws Timestream on Serverless Stack在无服务器堆栈上插入 Aws Timestream 时访问被拒绝错误
【发布时间】：2022-02-16 17:23:01
【问题描述】：

我正在尝试在我的 aws 时间流表中插入一条记录。它的获取导致访问被拒绝错误。

这里是 serverless.yml 的权限

    - Effect: Allow
      Action:
        - timestream:*
      Resource:
        - arn:aws:timestream:${self:provider.region}:*:database/*
        - arn:aws:timestream:${self:provider.region}:*:database/*/*/*

lambda 的 Iam 角色详细信息。

{
            "Action": [
                "timestream:*"
            ],
            "Resource": [
                "arn:aws:timestream:us-east-1:*:database/*",
                "arn:aws:timestream:us-east-1:*:database/*/*/*"
            ],
            "Effect": "Allow"
        },

记录样本

{
    "DatabaseName": "developmentreportsdb",
    "TableName": "developmenteventstable",
    "Records": [
        {
            "Dimensions": [
                {
                    "Name": "accountId",
                    "Value": "6921e43e-266c-4adf-8a69-d90bd8743d1b"
                },
                {
                    "Name": "userId",
                    "Value": "6921e43e-266c-4adf-8a69-d90bd8743d1b"
                }
            ],
            "MeasureName": "ACCOUNT.NEW",
            "MeasureValue": "6921e43e-266c-4adf-8a69-d90bd8743d1b",
            "MeasureValueType": "VARCHAR",
            "Time": "1644234263813",
            "TimeUnit": "MILLISECONDS",
            "Version": 1
        }
    ]
}

错误详情：

Error writing records: AccessDeniedException: User: arn:aws:sts::344128203239:assumed-role/development-us-east-1-lambdaRole/development-worker is not authorized to perform: timestream:DescribeEndpoints because no identity-based policy allows the timestream:DescribeEndpoints action

TIA。这里缺少什么？

【问题讨论】：

它需要一个具有更多访问权限的特殊权限。它看起来很开放。 ``` - 效果：允许操作：- timestream:CreateScheduledQuery - timestream:DescribeEndpoints - timestream:CancelQuery, - timestream:ListDatabases, - timestream:ListScheduledQueries, - timestream:SelectValues, Resource: '*' ```

标签： amazon-web-services amazon-cloudformation serverless amazon-timestream

【解决方案1】：

需要描述端点权限才能解析时间流 SDK 必须连接的端点。读写访问都需要它。

以下示例为仅允许用户进行读取访问的策略

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": "timestream:Select",
        "Resource": "arn:aws:timestream:us-east-1:4xxxxxxxxxxx:database/my_db/table/my_table"
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": [
            "timestream:DescribeEndpoints"
        ],
        "Resource": "*"
    }
]}

这是一个示例，仅对用户进行写访问所需的最低权限

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "timestream:WriteRecords"
        ],
        "Resource": [
            "arn:aws:timestream:us-east-1:4xxxxxxxxxxx:database/my_db/table/my_table"
        ]
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": [
            "timestream:DescribeEndpoints"
        ],
        "Resource": "*"
    }
]}

这是一个用户同时拥有权限（读 + 写）的示例

    {
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "timestream:WriteRecords",
            "timestream:Select"
        ],
        "Resource": [
            "arn:aws:timestream:us-east-1:4xxxxxxxxxxx:database/my_db/table/my_table"
        ]
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": [
            "timestream:DescribeEndpoints"
        ],
        "Resource": "*"
    }
]}

【讨论】：