AWS Lambda调用route53resolver关联查询日志配置时遇权限拒绝

通过AWS Lambda使用SDK调用route53resolver:AssociateResolverQueryLogConfig接口时收到权限拒绝错误，已为Lambda角色配置必要权限策略，但错误未明确指出缺失的具体操作权限；生成的X-Ray Trace Id查询后也未找到错误详情。

完整错误信息 #

{
  "errorType": "AccessDeniedException",
  "errorMessage": "[RSLVR-01600] Access denied Trace Id: \"1-63e29115-68ec2cb00f56b7e11f32490c\"",
  "trace": [
    "AccessDeniedException: [RSLVR-01600] Access denied Trace Id: \"1-63e29115-68ec2cb00f56b7e11f32490c\"",
    "    at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:52:27)",
    "    at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)",
    "    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10)",
    "    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/request.js:686:14)",
    "    at Request.transition (/var/runtime/node_modules/aws-sdk/lib/request.js:22:10)",
    "    at AcceptorStateMachine.runTo (/var/runtime/node_modules/aws-sdk/lib/state_machine.js:14:12)",
    "    at /var/runtime/node_modules/aws-sdk/lib/state_machine.js:26:10",
    "    at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:38:9)",
    "    at Request.<anonymous> (/var/runtime/node_modules/aws-sdk/lib/request.js:688:12)",
    "    at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:116:18)"
  ]
}

Lambda代码（Node.js） #

const AWS = require("aws-sdk");

exports.handler = async (event) => {
    
    const route53ResolverClient = new AWS.Route53Resolver();
    
    const createResolverQueryLogConfigParams = {
        DestinationArn: "arn:aws:logs:sa-east-1:############:log-group:querylog:*",
        Name: "test-query-log"
    };
    
    const createResolverQueryLogConfigResponse = await route53ResolverClient.createResolverQueryLogConfig(createResolverQueryLogConfigParams).promise();
    
    const associateResolverQueryLogConfigParams = {
        ResolverQueryLogConfigId: createResolverQueryLogConfigResponse.ResolverQueryLogConfig.Id,
        ResourceId: "vpc-#################"
    };
    
    await route53ResolverClient.associateResolverQueryLogConfig(associateResolverQueryLogConfigParams).promise();
    
};

已配置的角色策略 #

// AWSLambdaBasicExecutionRolePolicy
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:sa-east-1:############:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:sa-east-1:############:log-group:/aws/lambda/*:*"
            ]
        }
    ]
}
// route53resolver
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "route53resolver:CreateResolverQueryLogConfig",
                "route53resolver:AssociateResolverQueryLogConfig"
            ],
            "Resource": "*"
        }
    ]
}
// CloudWatchLogs (required for CreateResolverQueryLogConfig)
// initially it asked only for "logs:CreateLogDelivery" but then it asked permission for "logs:*" explicitly, really weird but I allowed it and it worked...
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:*",
            "Resource": "*"
        }
    ]
}
// IAM (required for CreateResolverQueryLogConfig even though I don't fully understand why)
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "*"
        }
    ]
}

解决方法 #

RSLVR-01600错误通常不是因为缺少AssociateResolverQueryLogConfig权限，而是以下几个容易忽略的原因：

1. 添加VPC描述权限
   Route53 Resolver在关联查询日志配置时，会验证目标VPC的合法性，需要Lambda角色拥有ec2:DescribeVpcs权限。添加以下策略语句到角色中：

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "ec2:DescribeVpcs",
               "Resource": "*"
           }
       ]
   }
   

2. 等待查询日志配置就绪
   调用CreateResolverQueryLogConfig后，配置需要时间进入ACTIVE状态，直接调用Associate会触发不准确的权限错误。添加轮询逻辑等待状态就绪：

   // 创建配置后插入这段轮询逻辑
   let resolverConfigStatus = 'CREATING';
   while (resolverConfigStatus !== 'ACTIVE') {
       const statusResponse = await route53ResolverClient.getResolverQueryLogConfig({
           ResolverQueryLogConfigId: createResolverQueryLogConfigResponse.ResolverQueryLogConfig.Id
       }).promise();
       resolverConfigStatus = statusResponse.ResolverQueryLogConfig.Status;
       if (resolverConfigStatus === 'FAILED') {
           throw new Error('Resolver query log config creation failed');
       }
       await new Promise(resolve => setTimeout(resolve, 1000));
   }
   

3. 验证服务关联角色完整性
   虽然配置了iam:CreateServiceLinkedRole，但Route53 Resolver的服务关联角色需要正确的信任关系和权限。如果角色创建异常，可以手动删除后让Lambda重新创建，确保其拥有logs:PutLogEvents等必要操作权限（已配置logs:*的话此步骤优先级较低）。

内容的提问来源于stack exchange，提问作者Pedro Henrique