Serverless部署S3静态资源时遇桶策略创建403权限错误

我正在扩展一个由多个AWS Lambda组成的现有工具，包含SFTP处理、RDS Postgres更新组件及小型UI模块。现在要给UI页面添加共享JS文件，选择将静态资源托管在S3桶中，通过Serverless部署完成上传。以下是我的serverless.yml配置：

service: myproject
frameworkVersion: "3"

provider:
  name: aws
  runtime: nodejs18.x
  region: eu-north-1
  iam:
    role:
      statements:
        - Effect: "Allow"
          Action:
            - "s3:*"
          Resource:
            - "arn:aws:s3:::myproject-input"
            - "arn:aws:s3:::myproject-input/*"
            - "arn:aws:s3:::myproject-static-assets"
            - "arn:aws:s3:::myproject-static-assets/*"
        - Effect: "Allow"
          Action:
            - "s3:CreateBucket"
            - "s3:PutBucketPolicy"
            - "s3:GetBucketPolicy"
            - "s3:DeleteBucketPolicy"
          Resource:
            - "arn:aws:s3:::myproject-input"
            - "arn:aws:s3:::myproject-static-assets"

package:
  individually: true

plugins:
  - serverless-s3-sync

custom:
  s3Sync:
    noSync: false
    buckets:
      - bucketName: myproject-static-assets
        bucketPrefix: public/
        localDir: public
        deleteRemoved: true

resources:
  Resources:
    AssetsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketName: myproject-static-assets
    AssetsPolicy:
      Type: AWS::S3::BucketPolicy
      Properties:
        Bucket: myproject-static-assets
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal: "*"
              Action:
                - "s3:GetObject"
              Resource:
                - "arn:aws:s3:::myproject-static-assets/*"

S3桶已成功创建，但创建AssetsPolicy时出现以下Serverless错误：

CREATE_FAILED: AssetsPolicy (AWS::S3::BucketPolicy)
Resource handler returned message: "Access Denied (Service: S3, Status Code: 403, Request ID: 4M61DWVFAM566RS8, Extended Request ID: xxxxxx/xxxxxxxxxxxxxxxxxxxxx+bcRMWf9x9iUg=)" (RequestToken: xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx, HandlerErrorCode: AccessDenied)

请问该问题是serverless.yml配置有误，还是存在更高层级的权限问题？

这个403错误通常由两类原因导致：部署所用IAM实体的权限不足，或是配置本身存在逻辑问题，以下是具体排查和修复步骤：

1. 检查部署用的IAM用户/角色权限 #

你当前在provider.iam.role.statements里配置的是Lambda执行角色的权限，但Serverless框架部署时使用的是本地AWS凭证对应的IAM用户/角色，这个实体需要具备创建BucketPolicy的权限：

• 确保该IAM实体拥有s3:PutBucketPolicy、s3:GetBucketPolicy权限，资源范围包含arn:aws:s3:::myproject-static-assets
• 如果你的AWS账号有组织级SCP、账号级IAM策略等强限制，要确认这些策略没有禁止部署实体操作目标桶的权限

2. 修正serverless.yml的冗余权限配置 #

你的配置里重复声明了S3权限，可能引发冲突，可简化为：

provider:
  iam:
    role:
      statements:
        - Effect: "Allow"
          Action:
            - "s3:*"
          Resource:
            - "arn:aws:s3:::myproject-input"
            - "arn:aws:s3:::myproject-input/*"
            - "arn:aws:s3:::myproject-static-assets"
            - "arn:aws:s3:::myproject-static-assets/*"

3. 检查目标桶是否已有残留策略 #

如果之前手动给myproject-static-assets桶添加过策略，且该策略限制了修改权限，会导致Serverless无法更新策略：

• 登录AWS控制台，进入该S3桶的「权限」-「桶策略」页面，删除现有策略后重新部署

4. 确认BucketPolicy的资源格式正确 #

当前配置里的资源arn:aws:s3:::myproject-static-assets/*格式正确，但需注意：

• 若桶名包含特殊字符，要确认ARN格式无误
• 策略里的Principal: "*"会允许公开访问，若场景不需要，可替换为特定IAM实体或CloudFront OAI

内容的提问来源于stack exchange，提问作者Dycey