部署AWS数据湖时CopyLambdaDeployment创建失败的解决求助

我通过AWS Infrastructure & Automation提供的CloudFormation数据湖基础模板（cfn-ps-datalake-foundation）部署数据湖时，创建Data-lake-foundation-DataLakeFoundationStack-IS67G4LRJQIU-ElasticsearchStack-YY9NNQARTKAR栈失败，核心问题是**[CopyLambdaDeployment]**资源创建失败。CloudWatch日志明确显示调用s3:CopyObject操作时触发AccessDenied权限错误。

我已尝试为相关角色添加以下IAM权限策略，但问题仍未解决，寻求可行的解决方案：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListBucket",
                "s3:CreateBucket",
                "s3:PutBucketPolicy",
                "s3:DeleteBucket",
                "s3:PutBucketNotification",
                "s3:PutBucketAcl",
                "s3:GetObjectTagging",
                "s3:PutObjectTagging",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::datalake-submissions/*",
                "arn:aws:s3:::datalake-curated-datasets/*",
                "arn:aws:s3:::datalake-published-data/*",
                "arn:aws:s3:::regional-lambda-bucket/*",
                "arn:aws:s3:::datalake-athena-query-results/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kinesis:*",
                "kinesisanalytics:*",
                "lambda:*",
                "glue:*",
                "kinesis:CreateStream",
                "kinesis:DescribeStream",
                "kinesis:PutRecord",
                "kinesis:PutRecords",
                "lambda:CreateFunction",
                "lambda:UpdateFunctionCode",
                "lambda:UpdateFunctionConfiguration",
                "lambda:GetFunction",
                "lambda:DeleteFunction",
                "lambda:ListFunctions",
                "athena:*",
                "redshift:*",
                "quicksight:*",
                "sns:*",
                "sagemaker:*",
                "ec2:Describe*",
                "firehose:DescribeDeliveryStream",
                "firehose:ListDeliveryStreams",
                "firehose:PutRecord",
                "firehose:PutRecordBatch",
                "ec2:CreateLaunchTemplate",
                "ec2:DescribeLaunchTemplates",
                "ec2:RunInstances",
                "ec2:DescribeInstances",
                "ec2:CreateTags",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "ssm:GetParameters",
                "ssm:GetParameter",
                "ssm:DescribeParameters",
                "ec2:DeleteTags",
                "iam:CreateRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:PassRole",
                "iam:DeleteRole",
                "ec2:CreateNetworkInterface",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "ec2:AttachNetworkInterface",
                "ec2:DetachNetworkInterface",
                "elasticloadbalancing:*",
                "logs:*",
                "cloudformation:*",
                "cloudwatch:*",
                "es:*"
            ],
            "Resource": "*"
        }
    ]
}

相关截图说明：

• 栈创建失败的错误详情截图
• CloudWatch中记录的s3:CopyObject AccessDenied错误日志截图

内容的提问来源于stack exchange，提问作者Nikhil Chittimalla