使用Terraform创建S3 Bucket与Lambda权限后遇访问拒绝问题排查

以下是可能的遗漏点及对应解决方法：

1. IAM策略资源范围不完整 #

Lambda的IAM策略中，S3的List*操作需要指定桶级ARN（arn:aws:s3:::your-bucket-name），而Get*/Put*操作需要指定对象级ARN（arn:aws:s3:::your-bucket-name/*）。很多新手会只配置对象级资源，导致List类操作权限不足。

修正后的Terraform策略示例：

resource "aws_iam_policy" "lambda_s3_policy" {
  name        = "lambda-s3-access"
  description = "Allow Lambda access to target S3 bucket"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["s3:List*"]
        Resource = "arn:aws:s3:::your-bucket-name" # 桶级资源用于List操作
      },
      {
        Effect   = "Allow"
        Action   = ["s3:Get*", "s3:Put*"]
        Resource = "arn:aws:s3:::your-bucket-name/*" # 对象级资源用于Get/Put
      },
      {
        Effect   = "Allow"
        Action   = ["ses:SendEmail"]
        Resource = "*"
      }
    ]
  })
}

2. S3 Bucket Policy存在拒绝规则或未显式允许访问 #

如果你的私有桶配置了Bucket Policy，默认会覆盖IAM权限——必须显式添加允许Lambda执行角色访问的规则，否则会被默认拒绝。

添加Bucket Policy示例：

resource "aws_s3_bucket_policy" "private_bucket" {
  bucket = aws_s3_bucket.your_bucket.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = {
          AWS = aws_iam_role.lambda_exec_role.arn
        }
        Action   = ["s3:List*", "s3:Get*", "s3:Put*"]
        Resource = [
          "arn:aws:s3:::your-bucket-name",
          "arn:aws:s3:::your-bucket-name/*"
        ]
      }
    ]
  })
}

3. Lambda执行角色信任关系错误 #

确认Lambda执行角色的信任策略允许lambda.amazonaws.com扮演该角色，否则角色无法被Lambda正常使用，权限会失效。

信任策略示例：

resource "aws_iam_role" "lambda_exec_role" {
  name = "lambda-exec-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

4. KMS加密桶缺少对应权限 #

如果你的桶使用了KMS加密（而非SSE-S3），Lambda需要额外的KMS权限才能访问加密对象，需在IAM策略中添加：

{
  Effect   = "Allow"
  Action   = ["kms:Decrypt", "kms:GenerateDataKey"]
  Resource = "arn:aws:kms:your-region:your-account-id:key/your-kms-key-id"
}

内容的提问来源于stack exchange，提问作者Nakeuh