S3政策問題時

Question

我米使用AWS LAMBDA上傳文件到S3並且使用命令

s3 = boto3.resource('s3') 
s3.meta.client.upload_file("/tmp/" + fileName, [BUCKET NAME], fileName) 

而且也LAMBDA政策定義爲

{ 
     "Action": [ 
      "s3:PutObject" 
     ], 
     "Resource": "arn:aws:s3:::[BUCKET NAME]", 
     "Effect": "Allow" 
}, 

但是當我運行它發出的功能錯誤

(<class 'boto3.exceptions.S3UploadFailedError'>, 
S3UploadFailedError('Failed to upload /tmp/[FILE NAME] to [BUCKET 
NAME]/[FILE NAME]: An error occurred (AccessDenied) when calling the 
PutObject operation: Access Denied',), <traceback object at 
0x7f61e9d2ec48>) 

Answer 1

你需要讓ListBucket政策，以及以編程方式把對象變成S3。

所以，你的政策是：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Effect": "Allow", 
     "Action": ["s3:ListBucket"], 
     "Resource": ["arn:aws:s3:::BUCKET_NAME"] 
    }, 
    { 
     "Effect": "Allow", 
     "Action": [ 
     "s3:PutObject" 
     ], 
     "Resource": ["arn:aws:s3:::BUCKET_NAME/*"] 
    } 
    ] 
} 

Answer 2

您是否與該lambda.amazonaws.com具有該角色的信任關係？

也在你的政策，應該是像下面，

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Sid": "statement1", 
      "Effect": "Allow", 
      "Action": ["s3:PutObject"], 
      "Resource": "arn:aws:s3:::[BUCKET NAME]/*" 
     } 
    ] 
} 

我看到缺少/ *在桶名稱的末尾。

Refered文檔：http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html

Answer 3

似乎你缺少

「/ *」

在政策資源

。對於對象級操作，資源應該是

「arn：aws：s3 ::: examplebucket/*」。

另請確保沒有存儲桶策略拒絕訪問。

更多信息：

• http://docs.aws.amazon.com/AmazonS3/latest/dev/using-with-s3-actions.html#using-with-s3-actions-related-to-objects

• http://docs.aws.amazon.com/AmazonS3/latest/dev/example-policies-s3.html#iam-policy-ex4