为什么我无法从 Lambda 函数访问我的 S3 存储桶？答案

【问题标题】：Why can't I access my S3 bucket from a Lambda function?为什么我无法从 Lambda 函数访问我的 S3 存储桶？
【发布时间】：2018-05-03 21:56:22
【问题描述】：

我有一个 lambda 函数。

代码如下：

// ...
var s3 = new AWS.S3();
// ...
var param = { 
    Bucket: /* ... */, 
    Key: /* ... */, 
    Body: /* ... */,
};
// ...
s3.upload(param, function(err, data) {
    if (err) {
        // From CloudWatch, this branch is entered.
        console.log(err, err.stack);
    } else {
        // ...
    }

    // From CloudWatch, this is executed.
    // ...
});
// ...

CloudWatch 是这样说的：

2018-05-03T04:26:44.093Z    2f132f9c-4e8a-11e8-899d-1903b51869d3    { AccessDenied: Access Denied
at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/services/s3.js:577:35)
at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:105:20)
at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:683:14)
at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)
at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)
at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10
at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)
at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:685:12)
at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:115:18)
message: 'Access Denied',
code: 'AccessDenied',
region: null,
time: 2018-05-03T04:26:44.093Z,
requestId: '1E0B4264477F7E24',
extendedRequestId: 'npqxl9WWgNP+4kYl+Vqyo4paP4h1bCUhM3hmWEdJ5LWvCTxn6vNNyeA6WBaBHIfbG+vfEtDARkc=',
cfId: undefined,
statusCode: 403,
retryable: false,
retryDelay: 87.11716082726679 } 'AccessDenied: Access Denied\n at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/services/s3.js:577:35)\n at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:105:20)\n at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77:10)\n at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:683:14)\n at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)\n at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)\n at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10\n at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)\n at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:685:12)\n at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:115:18)'

我的 lambda 函数与自定义角色相关联。该角色附加了 AWSLambdaFullAccess 策略，其中包括完整的 S3 访问权限。为什么我无法访问 S3 存储桶？

【问题讨论】：

标签： amazon-web-services amazon-s3 aws-lambda

【解决方案1】：

在问这个问题时，我注意到我提供的存储桶名称是错误的。（存储桶属于另一个 AWS 账户，这就是 AWSLambdaFullAccess 不足的原因。）这就是问题所在。

【讨论】：

权限，每次:)。