使用AWS基础HTTP-Rest模板部署Serverless时遇权限错误求助

问题描述 #

使用AWS CLI通过Serverless Framework部署Node.js HTTP API应用，执行serverless deploy命令时出现以下问题：

• 部署前弹出警告：Not authorized to perform: lambda:GetFunction for at least one of the lambda functions. Deployment will not be skipped even if service files did not change.
• 随后CloudFormation栈部署失败，报错显示创建ApiLambdaFunction（AWS::Lambda::Function）时返回AccessDeniedException（状态码403）

已创建拥有AdministratorAccess权限及自定义lambda:GetFunction权限的用户，并配置了CLI编程访问密钥，但问题仍未解决。

完整错误日志 #

Deploying aws-node-http-api-project to stage dev (us-east-1)
Warning: Not authorized to perform: lambda:GetFunction for at least one of the lambda functions. Deployment will not be skipped even if service files did not change.

× Stack aws-node-http-api-project-dev failed to deploy (80s)
Environment: win32, node 18.16.0, framework 3.30.1, plugin 6.2.3, SDK 4.3.2
Credentials: Local, "default" profile
Docs:        docs.serverless.com
Support:     forum.serverless.com
Bugs:        github.com/serverless/serverless/issues

Error:
CREATE_FAILED: ApiLambdaFunction (AWS::Lambda::Function)
Resource handler returned message: "Service returned error code AccessDeniedException (Service: Lambda, Status Code: 403, Request ID: cd3c14a3-fe9d-415e-9f7a-ddb068b98381)" (RequestToken: e76b2b77-7da2-1229-6e7d-b24073a52979, HandlerErrorCode: GeneralServiceException)

已配置的权限策略 #

AdministratorAccess策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}

自定义LambdaGetFunction策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": "lambda:GetFunction",
            "Resource": "*"
        }
    ]
}

排查建议 #

• 验证CLI配置的正确性：执行aws configure list命令，确认当前生效的访问密钥、区域等信息与目标IAM用户一致
• 等待IAM权限生效：AWS IAM权限变更可能存在数分钟延迟，等待后重新执行serverless deploy
• 检查IAM权限边界：确认该用户是否设置了权限边界（Permission Boundary），边界策略可能会限制用户的实际权限
• 检查组织SCP限制：如果AWS账号属于AWS Organizations，确认是否存在服务控制策略（SCP）限制Lambda相关操作
• 重新生成访问密钥：删除现有访问密钥，在IAM控制台重新生成新的Access Key和Secret Key，再通过aws configure重新配置
• 查看CloudFormation事件详情：登录AWS控制台打开对应的CloudFormation栈，查看事件列表中的详细错误信息，定位具体被拒绝的操作

内容的提问来源于stack exchange，提问作者Victor Bologna