调用StartQuery遇AccessDeniedException，AWS Boto3权限配置求助

错误信息 #

There was an error in error_handler: An error occurred (AccessDeniedException) when calling the StartQuery operation: User: arn:aws:sts::#########:assumed-role/cron-runner-production/ is not authorized to perform: logs:StartQuery on resource: arn:aws:logs:##-####-#:#########:log-group:/ecs/production:log-stream: because no identity-based policy allows the logs:StartQuery action

已配置的IAM策略（原错误版本） #

statement {
    effect = "Allow"
    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:StartQuery",
      "logs:GetQueryResults"
    ],
      "Resource": "arn:aws:logs:##-####-#:#########:log-group:/aws/lambda/cron-runner-production:*"
    ]
  }

相关Python代码 #

boto3_client = boto3.client('logs')
query_id = boto3_client.start_query(
    logGroupName=log_group,
    startTime=int((datetime.today() - timedelta(minutes=5)).timestamp()),
    endTime=int(datetime.now().timestamp()),
    queryString=query,
).get('queryId')

AWS控制台警告 #

• The actions in your policy do not support resource-level permissions and require you to choose All resources
• Specify log-group resource ARN for the StartQuery and 1 more action

解决步骤 #

1. 修正资源ARN匹配问题 #

代码中实际访问的是/ecs/production日志组，但原策略仅授权了/aws/lambda/cron-runner-production日志组，这是权限拒绝的核心原因。需要将目标日志组的ARN加入权限资源范围。

2. 拆分权限适配资源级别要求 #

根据AWS权限规则：

• logs:StartQuery支持资源级权限，必须指定目标日志组的ARN；
• logs:GetQueryResults不支持资源级权限，需设置资源为*；
• logs:CreateLogStream和logs:PutLogEvents仅针对Lambda日志组，保留原资源配置即可。

3. 修复策略语法错误 #

原策略存在语法错误（actions数组后多余逗号、Resource字段缩进与括号不匹配），需修正格式。

修正后的IAM策略示例（Terraform格式） #

statement {
  effect = "Allow"
  actions = [
    "logs:CreateLogStream",
    "logs:PutLogEvents"
  ]
  resources = ["arn:aws:logs:##-####-#:#########:log-group:/aws/lambda/cron-runner-production:*"]
}

statement {
  effect = "Allow"
  actions = ["logs:StartQuery"]
  resources = ["arn:aws:logs:##-####-#:#########:log-group:/ecs/production:*"]
}

statement {
  effect = "Allow"
  actions = ["logs:GetQueryResults"]
  resources = ["*"]
}

验证步骤 #

1. 将修正后的策略附加到cron-runner-production角色；
2. 确认代码中log_group变量值为/ecs/production，与策略中的资源ARN一致；
3. 重新测试Boto3调用，确认权限正常。

内容的提问来源于stack exchange，提问作者Stark