通过CloudFormation从S3部署Lambda遇授权头格式错误求助

问题描述 #

将Lambda函数代码包（.zip）上传至us-east-1区域的S3存储桶（已设置公开访问），在us-east-1区域通过CloudFormation模板创建Lambda函数时，触发s3:getObject错误，错误提示如下：

Resource handler returned message: "Error occurred while GetObject. S3 Error Code: AuthorizationHeaderMalformed. S3 Error Message: The authorization header is malformed; the region 'us-east-1' is wrong; expecting 'eu-west-1'

使用的YAML模板：

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  MediaSuiteRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: "MyCustomRole"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: mediaconvert.amazonaws.com
            Action: sts:AssumeRole
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
          - Effect: Allow
            Principal:
              Service: translate.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        # AmazonAPIGatewayInvokeFullAccess
        - arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess
        # AmazonS3FullAccess
        - arn:aws:iam::aws:policy/AmazonS3FullAccess
        # AmazonTranscribeFullAccess
        - arn:aws:iam::aws:policy/AmazonTranscribeFullAccess
        # AWSElementalMediaConvertFullAccess
        - arn:aws:iam::aws:policy/AWSElementalMediaConvertFullAccess
        # AWSLambdaBasicExecutionRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
        # AWSLambdaRole
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
        # TranslateFullAccess
        - arn:aws:iam::aws:policy/TranslateFullAccess

      Policies:
        - PolicyName: CustomPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "iam:PassRole"
                Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/MediaSuiteRole"

  MyCustomLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Role: !GetAtt MediaSuiteRole.Arn
      Code:
        S3Bucket: lambda-functions-storage
        S3Key: myfirstlambdafunction.zip
      Handler: myfirstlambdafunction.app.lambda_handler
      Runtime: python3.12
      Architectures:
        - x86_64
      Environment:
        Variables:
          CustomVar1: "52CD6067149FAA49B1698C1025ACC26B"
          CustomVar2: "52CD6067149FAA49B1698C1025ACC26C"

解决方案 #

问题根源 #

你认为S3桶在us-east-1区域，但实际该桶位于eu-west-1区域。CloudFormation部署时使用当前区域（us-east-1）生成签名请求，与S3桶实际区域不匹配，导致授权头格式错误。

具体解决步骤 #

1. 确认桶的实际区域：登录AWS控制台，进入S3服务，找到lambda-functions-storage桶，查看桶属性中的区域信息。
2. 匹配部署区域或迁移桶：
   • 如果桶确实在eu-west-1，切换到eu-west-1区域部署CloudFormation栈；
   • 或者将代码包重新上传到us-east-1区域的S3桶中，保持部署区域与桶区域一致。
3. 跨区域引用配置（可选）：若需要在us-east-1部署Lambda，同时使用eu-west-1的S3桶，可在Lambda的Code配置中显式指定桶所在区域：

   Code:
     S3Bucket: lambda-functions-storage
     S3Key: myfirstlambdafunction.zip
     S3Region: eu-west-1  # 添加此行指定桶的实际区域
   

额外建议 #

• 避免给IAM角色过度授权，AmazonS3FullAccess权限范围过大，建议替换为仅允许访问目标S3桶的自定义策略。
• 公开访问S3桶存在安全风险，建议取消公开设置，通过IAM权限控制访问。

内容的提问来源于stack exchange，提问作者Md. Zayed Hassan