AWS Lambda执行logs:DescribeLogStreams遇权限拒绝问题求助
我编写了一个Lambda脚本，用于构建自定义指标以通知ECS Fargate Python脚本的错误，核心代码如下：
def get_error_count(): log_streams = logs.describe_log_streams( logGroupName=log_group_name, orderBy='LastEventTime', descending=True, limit=1)['logStreams'] if log_streams: log_stream_name = log_streams[0]['logStreamName'] print(f"Search for log steam {log_stream_name}") response = logs.filter_log_events( logGroupName=log_group_name, logStreamNames=[log_stream_name], filterPattern=filter_pattern, interleaved=False)
执行脚本时出现以下错误：
[ERROR] ClientError: An error occurred (AccessDeniedException) when calling the DescribeLogStreams operation: User: arn:aws:sts::253579060874:assumed-role/cloudwatch_custom_metric-role-2c9dwrgu/cloudwatch_custom_metric is not authorized to perform: logs:DescribeLogStreams on resource: arn:aws:logs:us-west-1:253579060874:log-group:/ecs/github-pr:log-stream: because no identity-based policy allows the logs:DescribeLogStreams action
我已为该资源附加了包含logs:DescribeLogStreams的身份策略，策略内容如下：
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:*", "iam:CreatePolicy", "iam:CreateRole", "iam:AttachRolePolicy", "iam:GetRole", "iam:ListRoles", "events:PutRule", "events:ListRules", "events:DeleteRule", "events:DescribeEventBus", "events:ListEventBuses", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets", "schemas:ListDiscoverers", "cloudformation:DescribeStacks", "s3:ListAllMyBuckets", "ecr:CreateRepository", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:ListImages", "ecr:DescribeImages", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:BatchCheckLayerAvailability", "ecr:InitiateLayerUpload", "ecr:CompleteLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart", "ecr:BatchDeleteImage", "ecr:SetRepositoryPolicy", "ecr:GetRepositoryPolicy", "ecr:DeleteRepository", "cloudwatch:GetMetricData", "cloudwatch:PutMetricData" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:FilterLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetAccountPublicAccessBlock", "s3:GetBucketPublicAccessBlock", "s3:GetBucketPolicyStatus", "s3:GetBucketAcl", "s3:ListAccessPoints" ], "Resource": "*" }, { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::latticework*/*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketVersioning", "s3:CreateBucket", "s3:PutBucketOwnershipControls", "s3:PutBucketPublicAccessBlock", "s3:ListBucketVersions", "s3:DeleteBucket", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::latticework*" }, { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::s3-skilljar-data*/*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketVersioning", "s3:CreateBucket", "s3:PutBucketOwnershipControls", "s3:PutBucketPublicAccessBlock", "s3:ListBucketVersions", "s3:DeleteBucket", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::s3-skilljar-data*" }, { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::s3-finance-data*/*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketVersioning", "s3:CreateBucket", "s3:PutBucketOwnershipControls", "s3:PutBucketPublicAccessBlock", "s3:ListBucketVersions", "s3:DeleteBucket", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::s3-finance-data*" }, { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::s3-aws-cost-data*/*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketVersioning", "s3:CreateBucket", "s3:PutBucketOwnershipControls", "s3:PutBucketPublicAccessBlock", "s3:ListBucketVersions", "s3:DeleteBucket", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::s3-aws-cost-data*" }, { "Effect": "Allow", "Action": "iam:ChangePassword", "Resource": "arn:aws:iam::253579060874:user/${lambda_user}" } ] }
但问题依旧，添加内联策略后仍无效，需协助解决。
解决方案
确认策略关联对象
检查Lambda函数的执行角色是否为cloudwatch_custom_metric-role-2c9dwrgu，确保权限策略是附加到该角色上，而非其他IAM实体（如IAM用户）。可通过IAM控制台进入该角色，查看已附加的策略列表，确认包含logs权限的策略存在。细化日志资源权限
尽管策略中Resource设为*，但部分场景下AWS对ARN匹配要求严格。尝试将logs相关策略的Resource指定为具体日志组ARN：{ "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:FilterLogEvents" ], "Resource": "arn:aws:logs:us-west-1:253579060874:log-group:/ecs/github-pr:*" }明确指定目标日志组及其下属所有日志流，避免潜在的ARN匹配问题。
排查服务控制策略（SCP）
若账号属于AWS组织，需确认是否存在SCP限制了logs:DescribeLogStreams操作。联系组织管理员检查组织层级的SCP规则，确认无相关限制。等待策略生效
IAM策略变更通常几分钟内生效，但偶尔会有延迟。等待5-10分钟后重新测试，或手动触发Lambda函数验证。检查角色信任关系
确保Lambda执行角色的信任策略允许lambda.amazonaws.com扮演该角色，信任策略示例：{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }用IAM Access Analyzer验证权限
使用IAM Access Analyzer的"Check access"功能，输入Lambda角色ARN、logs:DescribeLogStreams动作及目标日志组ARN，排查权限被拒绝的具体原因。
内容的提问来源于stack exchange，提问作者viswanath thatha
