从Lambda访问DynamoDB抛出SdkClientException：为何需指定访问密钥？

我尝试使用Java V2 SDK的增强客户端（Enhanced Client）从Lambda向DynamoDB表中添加记录，代码如下：

DYNAMO_DB = DynamoDbClient.builder()
                .region(REGION)
                .build();
ENHANCED_DYNAMODB_CLIENT = DynamoDbEnhancedClient.builder().dynamoDbClient(DYNAMO_DB)
                .build();
DYNAMODB_TABLE = ENHANCED_DYNAMODB_CLIENT.table("sometable", TableSchema.fromBean(CompareYourselfModel.class));

 PutItemEnhancedResponse<CompareYourselfModel> response = DYNAMODB_TABLE.putItemWithResponse(PutItemEnhancedRequest.builder(CompareYourselfModel.class)
            .item(new CompareYourselfModel(userRecord.userid(), userRecord.age(), userRecord.height(), userRecord.income()))
            .returnConsumedCapacity(ReturnConsumedCapacity.TOTAL)
            .build());

我已为Lambda角色分配了AmazonDynamoDBFullAccess、AWSLambdaDynamoDBExecutionRole和AWSLambdaInvocation-DynamoDB权限策略，但执行DYNAMODB_TABLE.putItemWithResponse(...)代码时抛出异常，异常栈信息如下：

software.amazon.awssdk.core.exception.SdkClientException: Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId).

software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build
software.amazon.awssdk.auth.credentials.internal.SystemSettingsCredentialsProvider.resolveCredentials
software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1
software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess
software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute
software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute
software.amazon.awssdk.services.dynamodb.DefaultDynamoDbClient.putItem software.amazon.awssdk.enhanced.dynamodb.internal.operations.CommonOperation.execute
software.amazon.awssdk.enhanced.dynamodb.internal.operations.TableOperation.executeOnPrimaryIndex
software.amazon.awssdk.enhanced.dynamodb.internal.client.DefaultDynamoDbTable.putItemWithResponse

为何在Lambda中执行代码时需要指定访问密钥？我哪里操作错误了？

问题原因与解决方案 #

核心原因 #

Lambda运行环境中，AWS SDK V2默认的凭证提供者链未能正确加载Lambda执行角色的临时凭证，通常是代码配置缺失或依赖不全导致无法自动获取IAM角色凭证。

修复步骤 #

• 补充依赖：确保项目中包含AWS SDK V2的凭证处理依赖，比如software.amazon.awssdk:auth模块，它包含Lambda环境下的凭证获取逻辑，避免因依赖缺失导致无法识别Lambda的凭证来源。
• 显式配置凭证提供者：构建DynamoDbClient时，显式指定使用DefaultCredentialsProvider，它会自动遍历凭证链，优先获取Lambda执行角色的临时凭证，无需手动设置AK/SK。修改代码如下：

  DYNAMO_DB = DynamoDbClient.builder()
          .region(REGION)
          .credentialsProvider(DefaultCredentialsProvider.create())
          .build();
  

• 检查角色信任关系：确认Lambda执行角色的信任策略允许Lambda服务扮演该角色，否则即使权限策略正确，也无法获取凭证。信任策略示例：

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "lambda.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  

• 清理冗余权限：AmazonDynamoDBFullAccess已包含DynamoDB的所有操作权限，无需重复添加AWSLambdaDynamoDBExecutionRole和AWSLambdaInvocation-DynamoDB，冗余权限不影响凭证获取，但可简化配置。

内容的提问来源于stack exchange，提问作者user1184100