CDK构建Lambda时创建带公共URL的资源遇403权限问题

你当前的代码仅关闭了S3 Bucket的公共访问阻止，但未给Asset上传的对象配置公开读取权限，这是导致403错误的核心原因。CDK的Asset默认会将文件以私有权限上传到S3，仅关闭Bucket的公共访问限制不足以让外部访问对象。

修复方案 #

方案一：添加Bucket Policy允许公开读取Asset对象 #

通过Bucket Policy明确授权所有用户读取该Asset对应的S3对象：

export class MyServiceStack extends Stack {
  constructor(app: Construct, id: string, props: MyServiceStackProps) {
    super(app, id, props)

    const imageAsset = new Asset(this, 'logo', {
      path: join(__dirname, './assets/logo.png')
    })

    // 关闭Bucket的公共访问阻止
    imageAsset.bucket.grantPublicAccess();

    // 添加Bucket Policy，允许所有人读取该Asset对象
    imageAsset.bucket.addToResourcePolicy(new PolicyStatement({
      actions: ['s3:GetObject'],
      resources: [imageAsset.s3ObjectArn],
      principals: [new AnyPrincipal()],
    }));

    const customizeVerificationMessage = new NodejsFunction(
      this,
      'customizeVerificationMessage',
      {
        //...other config
        environment: {
          LOGO_URL: imageAsset.httpUrl
        }
      }
    )

    // ...other code

    const userPool = new UserPool(this, 'userpool', {
      //...other config
      lambdaTriggers: {
        //...other triggers
        customMessage: customizeVerificationMessage
      },
    })

  }
}

方案二：直接设置Asset对象的ACL为公开读取 #

在Asset初始化时，指定对象的访问控制列表（ACL）为public-read，同时确保Bucket允许公共访问：

export class MyServiceStack extends Stack {
  constructor(app: Construct, id: string, props: MyServiceStackProps) {
    super(app, id, props)

    const imageAsset = new Asset(this, 'logo', {
      path: join(__dirname, './assets/logo.png'),
      // 设置对象ACL为公开读取
      s3ObjectAcl: aws_s3.BucketAccessControl.PUBLIC_READ,
    })

    // 关闭Bucket的公共访问阻止
    imageAsset.bucket.grantPublicAccess();

    const customizeVerificationMessage = new NodejsFunction(
      this,
      'customizeVerificationMessage',
      {
        //...other config
        environment: {
          LOGO_URL: imageAsset.httpUrl
        }
      }
    )

    // ...other code

    const userPool = new UserPool(this, 'userpool', {
      //...other config
      lambdaTriggers: {
        //...other triggers
        customMessage: customizeVerificationMessage
      },
    })

  }
}

关键说明 #

• grantPublicAccess()仅负责关闭Bucket级别的"Block Public Access"设置，不会自动修改对象权限。
• 两种方案任选其一即可，方案二更直接针对单个Asset对象，方案一通过Policy管理权限更灵活（比如可批量授权）。

内容的提问来源于stack exchange，提问作者MNPP