AWS Lambda生成S3缩略图报错：HeadObject调用返回403 Forbidden

问题描述 #

测试AWS Lambda函数时遇到权限错误，该函数负责在图片上传至源S3存储桶后生成缩略图并保存到目标S3存储桶。

上下文信息 #

• 已尝试使用Root用户、拥有Admin角色及S3全访问权限的IAM用户运行函数
• 曾将存储桶设置为公开（不符合最佳实践，已恢复私有）

错误详情 #

[ERROR] ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden
Traceback (most recent call last):
File "/var/task/lambda_function.py", line 31, in lambda_handler
s3_client.download_file(bucket, key, download_path)
File "/var/task/boto3/s3/inject.py", line 192, in download_file
return transfer.download_file(
File "/var/task/boto3/s3/transfer.py", line 405, in download_file
future.result()
File "/var/task/s3transfer/futures.py", line 103, in result
return self._coordinator.result()
File "/var/task/s3transfer/futures.py", line 266, in result
raise self._exception
File "/var/task/s3transfer/tasks.py", line 269, in _main
self._submit(transfer_future=transfer_future, **kwargs)
File "/var/task/s3transfer/download.py", line 354, in _submit
response = client.head_object(
File "/var/task/botocore/client.py", line 565, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/var/task/botocore/client.py", line 1021, in _make_api_call
raise error_class(parsed_response, operation_name)

当前使用的IAM策略 #

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "logs:PutLogEvents",
            "logs:CreateLogGroup",
            "logs:CreateLogStream"
        ],
        "Resource": "arn:aws:logs:*:*:*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetObject"
        ],
        "Resource": "arn:aws:s3:::thumb-origin-bucket"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:PutObject"
        ],
        "Resource": "arn:aws:s3:::thumb-destination-bucket"
    }
]
}

问题原因与解决方案 #

问题原因 #

IAM策略中S3资源的权限范围错误。s3:GetObject和s3:PutObject操作需要授权到存储桶内的具体对象，而非仅存储桶本身。当前策略仅指定了存储桶ARN，缺少/*后缀，导致Lambda无法访问桶内的对象。

修正后的IAM策略 #

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "logs:PutLogEvents",
            "logs:CreateLogGroup",
            "logs:CreateLogStream"
        ],
        "Resource": "arn:aws:logs:*:*:*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:GetObject"
        ],
        "Resource": "arn:aws:s3:::thumb-origin-bucket/*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "s3:PutObject"
        ],
        "Resource": "arn:aws:s3:::thumb-destination-bucket/*"
    }
]
}

额外检查项 #

1. 无需将存储桶设为公开，保持私有状态，通过IAM策略授权Lambda访问是合规的最佳实践
2. 确认Lambda执行角色的信任关系配置正确，允许lambda.amazonaws.com扮演该角色
3. 验证源S3桶的事件通知已正确关联到目标Lambda函数

内容的提问来源于stack exchange，提问作者Luis Fernando López Corrales