我只是无法弄清楚AWS中的存储桶策略出了什么问题。尝试让Lambda函数访问和读取S3存储桶中的电子邮件。但我不断收到“访问被拒绝”
请注意，我注意到在存储桶中正在创建电子邮件文件。这是我的存储桶策略的最新版本：
{
"Version": "2012-10-17",
"Id": "Lambda access bucket policy",
"Statement": [
{
"Sid": "All on objects in bucket lambda",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::[MY NUMBER]:root"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::[MY BUCKET NAME]/*"
}
]
}
我也尝试过使用“ Principal”：{“ Service”：“ ses.amazonaws.com”}，a
我一直被拒绝访问：
2017-09-17T14:12:14.231Z 10664101-9bb2-11e7-ad43-539f3e1a8626
{
"errorMessage": "Access Denied",
"errorType": "AccessDenied",
"stackTrace": [
"Request.extractError (/var/runtime/node_modules/aws-sdk/lib/services/s3.js:577:35)",
"Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:105:20)",
"Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:77:10)",
"Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:683:14)",
"Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)",
"AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)",
"/var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10",
"Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)",
"Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:685:12)",
"Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:115:18)"
]
}
这是我的Lambda函数：
var AWS = require('aws-sdk');
var s3 = new AWS.S3();
var bucketName = '[MY BUCKET NAME]';
exports.handler = function(event, context, callback) {
console.log('Process email');
var sesNotification = event.Records[0].ses;
if(!sesNotification) {
callback(null, null);
return;
}
console.log("SES Notification:\n", JSON.stringify(sesNotification, null, 2));
// Retrieve the email from your bucket
s3.getObject({
Bucket: bucketName,
Key: sesNotification.mail.messageId
}, function(err, data) {
if (err) {
console.log(err, err.stack);
callback(err);
} else {
console.log("Raw email:\n" + data.Body);
// Custom email processing goes here
callback(null, null);
}
});
};
经过很长时间和许多版本的Bucket Policy之后，我正在考虑尝试其他解决方案并放弃AWS。
有任何想法吗 ？
您需要创建一个IAM角色，并使用S3FullAccess策略或对特定存储段和操作的细粒度权限将其附加到Lambda函数（推荐）。
还要确保将信任关系配置添加到角色中。
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": [
"lambda.amazonaws.com"
]
}
}
]
}
注意：在当前设置中，似乎您已经配置了存储桶策略，该策略向根用户授予读取访问权限。
本文收集自互联网，转载请注明来源。
如有侵权，请联系 [email protected] 删除。
我来说两句