AWS Chime会议媒体捕获管道S3存储桶权限问题排查

我在应用中实现带Media Capture Pipeline的AWS Chime会议时，调用startCapture函数创建媒体捕获管道时，持续报错：

Insufficient permission to access S3 bucket: s3-bucket-name

已做过以下排查：

• 添加了允许Chime服务主体访问的S3存储桶策略（代码如下）
• 为IAM用户配置了包含Chime和S3必要权限的策略（代码如下）
• 验证S3存储桶存在且区域正确
• 验证IAM用户权限配置正确

请问我的配置还缺什么？AWS Chime会议正常运行是否需要额外权限或配置？

代码实现 #

import {
  CreateMediaCapturePipelineCommand,
  ChimeSDKMediaPipelinesClient,
} from '@aws-sdk/client-chime-sdk-media-pipelines';
import {
  ChimeSDKMeetingsClient,
  CreateAttendeeCommand,
  CreateAttendeeCommandInput,
  CreateMeetingCommand,
  CreateMeetingCommandInput,
} from '@aws-sdk/client-chime-sdk-meetings';

export const chimeSdkMeetings = new ChimeSDKMeetingsClient({
  credentials: {
    accessKeyId: process.env.AWS_KEY_ID || '',
    secretAccessKey: process.env.AWS_SECRET || '',
  },
  region: 'eu-central-1',
});

export const chimeSDKMediaPipelinesClient = new ChimeSDKMediaPipelinesClient({
  credentials: {
    accessKeyId: process.env.AWS_KEY_ID || '',
    secretAccessKey: process.env.AWS_SECRET || '',
  },
  region: 'eu-central-1',
});

export const startCapture = async (meetingId: string) => {
  return chimeSDKMediaPipelinesClient.send(
    new CreateMediaCapturePipelineCommand({
      ChimeSdkMeetingConfiguration: {
        ArtifactsConfiguration: {
          Audio: { MuxType: 'AudioOnly' },
          Content: { State: 'Disabled' },
          Video: { State: 'Disabled' },
        },
      },
      SinkArn: 'arn:aws:s3:::s3-bucket-name',
      SinkType: 'S3Bucket',
      SourceArn: `arn:aws:chime::${AWS_ACCOUNT_ID}:meeting:${meetingId}`,
      SourceType: 'ChimeSdkMeeting',
    }),
  );
};

S3存储桶策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSChimeMediaCaptureBucketPolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": "mediapipelines.chime.amazonaws.com"
            },
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::s3-bucket-name/*",
                "arn:aws:s3:::s3-bucket-name"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "${AWS_ACCOUNT_ID}"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:chime:*:${AWS_ACCOUNT_ID}:*"
                }
            }
        },
        {
            "Sid": "AWSChimeMediaConcatBucketPolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": "mediapipelines.chime.amazonaws.com"
            },
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::s3-bucket-name/*",
                "arn:aws:s3:::s3-bucket-name"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "${AWS_ACCOUNT_ID}"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:chime:*:${AWS_ACCOUNT_ID}:*"
                }
            }
        }
    ]
}

IAM用户策略 #

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::s3-bucket-name",
                "arn:aws:s3:::s3-bucket-name/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "chime:CreateMediaCapturePipeline",
                "chime:CreateMeeting",
                "chime:CreateAttendee"
            ],
            "Resource": "*"
        }
    ]
}

可能的遗漏点及解决方案 #

1. 替换桶策略中的占位符
   桶策略里的${AWS_ACCOUNT_ID}是占位符，必须替换成你的实际AWS账号ID（纯数字），AWS不会自动解析这个变量，未替换会导致条件判断失效，Chime服务主体无法获得权限。

2. 修正SourceArn的区域字段
   你的SourceArn格式错误，正确的Chime会议ARN需要包含区域信息，应该改为：

   arn:aws:chime:eu-central-1:${AWS_ACCOUNT_ID}:meeting:${meetingId}
   

   缺失区域会导致Chime无法识别会议资源，进而触发权限验证失败。

3. 确认S3桶与会议区域一致
   Chime媒体捕获管道要求S3桶和会议所在区域完全匹配，你当前会议区域是eu-central-1，务必确认S3桶创建在法兰克福区域，跨区域会直接导致权限拒绝。

4. 检查S3桶的公有访问设置
   如果S3桶开启了"阻止所有公有访问"，可能会影响Chime服务的访问。可以暂时关闭该设置测试，或者确保桶策略中明确允许Chime服务主体的访问（信任的服务主体不受公有访问阻止的限制，但策略必须正确）。

5. 补充IAM用户的GetBucketLocation权限
   尝试在IAM用户策略的S3权限列表中添加s3:GetBucketLocation操作，Chime在创建管道时可能需要获取桶的区域信息，缺少该权限也可能触发错误。

6. 验证ACL权限的有效性
   虽然你已经在桶策略中授予了s3:PutObjectAcl权限，但可以确认是否需要允许Chime设置bucket-owner-full-control的ACL，确保该操作能正常执行。

7. 检查凭证有效性
   如果使用临时IAM凭证，确认凭证未过期且包含所有必要权限；如果是长期访问密钥，检查密钥是否被禁用或泄露。

验证步骤 #

• 用AWS CLI测试IAM用户的S3权限：执行aws s3 ls s3://s3-bucket-name --profile <你的IAM用户配置名>，能列出桶内容则说明IAM用户权限正常。
• 查看CloudTrail日志：在CloudTrail中搜索针对该S3桶的AccessDenied事件，日志会显示具体的请求主体、操作和拒绝原因，帮助精准定位问题。

内容的提问来源于stack exchange，提问作者Boubaker Kalfat