Lambda调用S3 PutObject遇AccessDenied，权限配置问题求助

问题详情 #

使用AWS Lambda向默认配置的S3桶上传对象时出现权限异常：

• 已为Lambda附加IAM角色策略，允许s3:*操作作用于目标桶
• list_objects_v2等读取类操作可正常执行，但PutObject操作失败，报错：

[ERROR] ClientError: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied

• 关联的IAM策略：

{
    "Statement": [
        {
            "Action": [
                "logs:*"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:logs:*:*:*"
        },
        {
            "Action": [
                "s3:*"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:s3:::my_custom_bucket_name_for_dev"
        }
    ],
    "Version": "2012-10-17"
}

• Lambda核心代码：

logger.info("before boto")
s3_client = boto3.client('s3')

objects = s3_client.list_objects_v2(Bucket='my_custom_bucket_name_for_dev')

logger.info("entering debug list")
for obj in objects.get('Contents',[]):
    logger.info(f"{obj['Key']}")

some_binary_data = b'let me in'
s3 = boto3.resource('s3')
object = s3.Object('my_custom_bucket_name_for_dev', 'whatwithpermission.txt')
object.put(Body=some_binary_data)

问题原因 #

S3的资源权限严格区分桶级别和对象级别：

• 桶ARN arn:aws:s3:::my_custom_bucket_name_for_dev 仅覆盖针对桶本身的操作（如list_objects_v2、CreateBucket等）
• PutObject、GetObject等针对桶内对象的操作，需要权限作用于对象级别ARN：arn:aws:s3:::my_custom_bucket_name_for_dev/*

当前策略仅授权了桶本身的权限，未覆盖对象操作，因此写入失败。

解决方案 #

修改IAM角色策略，将S3资源部分补充对象级别ARN，修改后的策略如下：

{
    "Statement": [
        {
            "Action": [
                "logs:*"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:logs:*:*:*"
        },
        {
            "Action": [
                "s3:*"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::my_custom_bucket_name_for_dev",
                "arn:aws:s3:::my_custom_bucket_name_for_dev/*"
            ]
        }
    ],
    "Version": "2012-10-17"
}

更新策略后，Lambda即可正常执行PutObject操作。

内容的提问来源于stack exchange，提问作者smaillis