使用 AWS GuardDuty 的 AccessDeniedException（调用方无权调用 API）

Question

Aws lambda and CLI both returned "InternalServerErrorException: An error occurred (InternalServerErrorException) when calling the UpdateThreatIntelSet operation: The request is rejected because the caller is not authorized to call this API." IAM policy already been set to allow Admin action and Trusted entities are set to s3, lambda, guardduty, Apigateway. I've been searching for days now on why it keeps giving me that rejection where I already explicitly allow everything. Any advise or help is greatly appreciated. Below is the code snippet and the rejection from lambda

from __future__ import print_function
import boto3

detector_id = 'abcdefghijklmnop12345'
threatIntelSetIds = 'abcdefghijklmnop12345'
mal_ip = '10.0.0.0'

# Update threatIntelsetId based on the malicious_ip addresses.
def update_threatList(threatIntelSetIds, mal_ip):
client = boto3.client('guardduty')
response = client.update_threat_intel_set(
    Activate=True,
    DetectorId=detector_id,
    ThreatIntelSetId=threatIntelSetIds
)

def lambda_handler(event, context):
    update_threatList(threatIntelSetIds, mal_ip)

here is the rejection IAM policy Trusted entities

Answer 1

As noted in comments, the likely cause of this confusing error message - which I have reproduced using both Terraform and CloudFormation resources to manage GuardDuty - is that the S3 location does not exist.

Also, note that the full path in the S3 bucket needs to exist, and CloudFormation, in particular, will not create an empty file there, if the file does not already exists.

This generally means some other process than CloudFormation needs to create the file.