AWS Lambda调用EC2 DescribeInstances遇UnauthorizedOperation错误求助

我编写了一个Python脚本，用于获取所有区域的EC2实例，该脚本在本地运行正常。通过Serverless将其部署为Lambda后，在控制台测试时出现如下错误：

ClientError: An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
Traceback (most recent call last):
  File "/var/task/handler.py", line 17, in get_ec2_instances
    for each_ins_in_reg in ec2_re.instances.all():
  File "/var/runtime/boto3/resources/collection.py", line 81, in __iter__
    for page in self.pages():
  File "/var/runtime/boto3/resources/collection.py", line 171, in pages
    for page in pages:
  File "/var/runtime/botocore/paginate.py", line 269, in __iter__
    response = self._make_request(current_kwargs)
  File "/var/runtime/botocore/paginate.py", line 357, in _make_request
    return self._method(**current_kwargs)
  File "/var/runtime/botocore/client.py", line 530, in _api_call
    return self._make_api_call(operation_name, kwargs)

我已为该IAM角色添加ec2DescribeRegionpolicy权限，但问题仍存在。请问如何解决此错误？该角色需要配置哪些IAM策略/权限？

所需IAM权限 #

要实现遍历所有区域并获取EC2实例，Lambda执行角色需要以下两个核心权限：

• ec2:DescribeRegions：用于获取AWS所有可用区域列表
• ec2:DescribeInstances：用于查询指定区域内的EC2实例信息

对应的IAM策略示例如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeRegions",
                "ec2:DescribeInstances"
            ],
            "Resource": "*"
        }
    ]
}

排查与修复步骤 #

1. 核对权限名称与策略内容
   你提到的ec2DescribeRegionpolicy如果是自定义策略，要检查策略内是否确实包含ec2:DescribeInstances权限，很多时候问题出在只加了区域查询权限，遗漏了实例查询权限。
2. 确认策略关联状态
   确保该权限策略已经正确附加到Lambda的执行角色上，避免出现策略创建后未关联的情况。
3. 检查权限边界限制
   如果角色设置了Permissions Boundary，要确认边界策略没有阻止ec2:DescribeRegions和ec2:DescribeInstances这两个动作。
4. 验证信任关系
   检查Lambda执行角色的信任关系是否允许lambda.amazonaws.com服务扮演该角色，信任关系示例如下：

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": "lambda.amazonaws.com"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }
   

内容的提问来源于stack exchange，提问作者codebeginner