CloudFormation配置Lambda访问指定S3 Bucket权限异常问题咨询

问题出在S3权限的资源ARN格式上：

• s3:GetObject是对象级操作，对应的资源必须是桶内对象的ARN，格式为arn:aws:s3:::bucket-name/*
• 你写的arn:aws:s3:::bucket-test-impl是桶本身的ARN，仅适用于桶级操作（比如s3:ListBucket），对GetObject不生效
• 通配符arn:aws:s3:::bucket-test-*能生效，是因为它会匹配到桶内的对象路径（比如arn:aws:s3:::bucket-test-impl/xxx.txt）

修正后的IAM策略资源配置如下：

LambdaSSMPermissions:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: allowSsmS3
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssm:PutParameters
                  - ssm:PutParameter
                  - s3:GetObject
                Resource:
                  - arn:aws:s3:::bucket-test-impl/*  # 修正为对象级ARN
                  - !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/abcd/*/*'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

如果需要同时允许桶级操作（比如列桶内容），可以单独加一条针对桶ARN的Statement，例如：

- Effect: Allow
  Action:
    - s3:ListBucket
  Resource:
    - arn:aws:s3:::bucket-test-impl

内容的提问来源于stack exchange，提问作者user19882964