Lambda在同一S3存储桶复制数据时出现权限拒绝问题

问题原因 #

你的S3桶策略中，Restrict Bucket Access这条拒绝语句限制了仅指定ARN的实体可以访问存储桶及对象。如果Lambda的执行角色ARN不在该列表中，就会触发权限拒绝。

另外，还要确保Lambda复制操作满足以下两个条件（否则也会被拒绝）：

• 上传对象时启用了服务器端加密（对应DenyUnEncryptedObjectUploads规则）
• 请求使用SSL连接（对应EnforceSSL规则）

解决方案 #

1. 获取Lambda执行角色ARN #

登录AWS IAM控制台，找到Lambda使用的执行角色，复制其完整ARN（格式类似arn:aws:iam::551470947100:role/your-lambda-execution-role）。

2. 修改桶策略 #

将Lambda执行角色ARN添加到Restrict Bucket Access语句的aws:PrincipalArn允许列表中。修改后的策略如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectTagging",
                "s3:PutObject",
                "s3:PutObjectTagging"
            ],
            "Resource": "arn:aws:s3:::vgi-esf-eng-us-east-1-narwhal-bfb-automated-input/*"
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::vgi-esf-eng-us-east-1-narwhal-bfb-automated-input"
        },
        {
            "Sid": "DenyUnEncryptedObjectUploads",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::vgi-esf-eng-us-east-1-narwhal-bfb-automated-input/*",
            "Condition": {
                "Null": {
                    "s3:x-amz-server-side-encryption": "true"
                }
            }
        },
        {
            "Sid": "EnforceSSL",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::vgi-esf-eng-us-east-1-narwhal-bfb-automated-input/*",
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        },
        {
            "Sid": "Restrict Bucket Access",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::vgi-esf-eng-us-east-1-narwhal-bfb-automated-input",
                "arn:aws:s3:::vgi-esf-eng-us-east-1-narwhal-bfb-automated-input/*"
            ],
            "Condition": {
                "StringNotLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::551470947100:role/CloudBotRole",
                        "arn:aws:iam::551470947100:role/globalaccess/*",
                        "arn:aws:iam::551470947100:user/globalaccess/*",
                        "arn:aws:iam::551470947100:role/Bamboo-Role-Remote-*",
                        "arn:aws:iam::551470947100:role/FB0-narwhalbfbautomatedmrprivate-ENG-east-1",
                        "arn:aws:iam::551470947100:role/你的Lambda执行角色ARN"
                    ]
                }
            }
        }
    ]
}

3. 验证Lambda权限 #

同时确保Lambda执行角色的IAM权限策略中包含以下权限（如果没有需添加）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:GetObjectTagging",
                "s3:PutObjectTagging"
            ],
            "Resource": "arn:aws:s3:::vgi-esf-eng-us-east-1-narwhal-bfb-automated-input/*"
        }
    ]
}

注意事项 #

• 如果Lambda是通过其他方式（比如跨账户）调用，需确保对应的ARN也被添加到允许列表
• 测试前确认复制操作确实使用了SSL连接并启用了服务器端加密，否则仍会触发拒绝规则

内容的提问来源于stack exchange，提问作者Navdeep Kaushal