AWS Lambda访问S3时出现Access Denied权限错误排查求助

本地运行可正常读写S3，但将相同逻辑部署为AWS Lambda后，调用时持续返回Access Denied错误。预期实现从S3读取文件、修改后写入其他位置的功能，本地使用管理员权限IAM角色可正常运行，Lambda使用独立执行角色。

相关配置 #

Lambda执行角色内联S3策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::MY_BUCKET/*"
        }
    ]
}

S3桶策略配置 #

{
    "Version": "2012-10-17",
    "Id": "PolicyNumber",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::ACCOUNT_ID:role/web_functions"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::MY_BUCKET/*"
        }
    ]
}

额外环境信息 #

• 运行时：Go 1.x
• 架构：x86_64
• Lambda未配置VPC
• Lambda执行角色包含日志默认策略与X-Ray监控策略
• S3桶未公开访问
• 临时将S3桶策略权限设为s3:*以排查问题

代码片段 #

func getS3Client(region string) *s3.Client {
    //region is a string (not aws.String()): "us-east-2"
    client := s3.New(s3.Options{
        Region: region,
    })
    return client
}

func getFile(bucket string, filename string) {
        client := getS3Client(region)
        object, err := client.GetObject(context.TODO(), &s3.GetObjectInput{
            Bucket: aws.String(bucket),
            Key:    aws.String(filename),
        })
        if err != nil {
            return nil, errors.New(fmt.Sprintf("Error reading s3 object: %v (bucket=%s, filename=%s)\n", err, bucket, filename))
    }   
}

错误日志 #

Golang报错信息 #

{"errorMessage":"Error reading s3 object: operation error S3: GetObject, https response error StatusCode: 403, RequestID: QEWV1F12YHCT862X, HostID: knxgns9O+oCTJ9G2p+hXNEyZJqjeTup/25Ab6Ih6jOrN/FAZvH7gjxKb0JEp3rGQMVyzqdgu30s=, api error AccessDenied: Access Denied (bucket=MY_BUCKET, filename=DCIM/061121/DSC01033.JPG)\n","errorType":"errorString"}

AWS控制台Lambda测试日志 #

START RequestId: 33fe5480-bbfc-42e6-bce8-e5d3589d1187 Version: $LATEST
bucket: MY_BUCKET, filename: DCIM/061121/DSC01423.JPG, region: us-east-2
Error reading s3 object: operation error S3: GetObject, https response error StatusCode: 403, RequestID: KDCZ6XBVSNHX6HE1, HostID: FG1nTNI9MAwh2HhwBfRCE0Xj355RefzsSy1ludhM52rls6yzu+/ElgCeB27Q4i6enjPlX8HaGQ8=, api error AccessDenied: Access Denied (bucket=MY_BUCKET, filename=DCIM/061121/DSC01423.JPG)
: errorString
null
END RequestId: 33fe5480-bbfc-42e6-bce8-e5d3589d1187
REPORT RequestId: 33fe5480-bbfc-42e6-bce8-e5d3589d1187  Duration: 132.27 ms Billed Duration: 133 ms Memory Size: 512 MB Max Memory Used: 39 MB  Init Duration: 98.39 ms 

排查建议 #

1. 检查Lambda执行角色的信任关系
   确认Lambda服务被允许扮演该角色，信任关系文档应包含：

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": "lambda.amazonaws.com"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }
   

2. 验证资源ARN的正确性

   • 确认Lambda策略中的MY_BUCKET和ACCOUNT_ID与实际一致，无拼写错误
   • S3桶策略的Principal ARN需完全匹配Lambda执行角色的ARN，可从IAM控制台复制角色ARN核对

3. 检查S3桶所有权控制
   若桶开启"Bucket owner enforced"，需确认目标对象由桶所有者拥有；读操作错误需重点确认对象是否存在，且Lambda角色有读取权限

4. 排查S3对象ACL限制
   即使桶策略允许，对象ACL可能限制访问。可临时修改目标对象ACL为bucket-owner-full-control测试，或检查对象权限设置

5. 验证Lambda区域配置
   确认S3桶所在区域与代码中指定的us-east-2一致，跨区域访问可能因权限配置导致错误

6. 使用IAM Access Analyzer检查权限
   在IAM控制台用Access Analyzer分析Lambda执行角色权限，确认是否存在组织SCP策略等隐式拒绝情况

7. 检查S3客户端凭证来源
   确保代码未硬编码其他凭证，Lambda应自动使用执行角色的临时凭证。可添加日志打印凭证来源，确认是否使用预期角色

内容的提问来源于stack exchange，提问作者Faeem Ali