boto3 s3 复制对象错误

Question

我正在尝试使用 lambda & boto3 将文件从 1 个存储桶复制到同一存储桶中的另一个前缀，但是我不断收到错误消息：

调用 CopyObject 操作时发生错误 (AccessDenied)。

或者

调用 HeadObject 操作时发生错误（403）：Forbidden

取决于我使用的复制方法。

为 lambda function 分配了一个角色，我认为它赋予了它所需的所有权限：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Action": [
            "s3:HeadObject",
            "s3:ListObjects"
        ],
        "Resource": [
            "arn:aws:s3:::bucket-name",
            "arn:aws:s3:::bucket-name/*"
        ],
        "Effect": "Allow"
    },
    {
        "Action": [
            "s3:GetObject",
            "s3:PutObject",
            "s3:DeleteObject"
        ],
        "Resource": [
            "arn:aws:s3:::bucket-name/folderA/folderB/*",
            "arn:aws:s3:::bucket-name/folderC/folderD/*",
            "arn:aws:s3:::bucket-name/folderE/folderF/*"
        ],
        "Effect": "Allow"
    }
]
}

lambda function 是：

#connect to s3
s3 = boto3.resource('s3')

dirs = {
    "folderA/folderB": "folderC/folderD"        
}    

key = urllib.parse.unquote_plus(event['Records'][0]['s3']['object']['key'], encoding='utf-8')
etag = urllib.parse.unquote_plus(event['Records'][0]['s3']['object']['eTag'], encoding='utf-8')    
bucket = event['Records'][0]['s3']['bucket']['name']

filePathName = key.split("/")
sourceDir = filePathName[0] + "/" + filePathName[1]
fileName = filePathName[2]

sourceKey = sourceDir + "/" + fileName
source = {'Bucket': bucket, 'Key': sourceKey}
destination = dirs[sourceDir] + "/" + fileName

##########
# This option comes up with the An error occurred (AccessDenied) when calling the CopyObject operation. Error
###########
s3.Object(bucket, destination).copy_from(CopySource=source)

###########
## This option comes up with the An error occurred (403) when calling the HeadObject operation: Forbidden error
###########
s3.meta.client.copy(source, bucket, destination)

编辑：忘了提，如果我将角色更改为

{
"Version": "2012-10-17",
"Statement": [
    {
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::bucket-name",
            "arn:aws:s3:::bucket-name/*"
        ],
        "Effect": "Allow"
    }

Answer 1

我遇到了类似的问题。 解决办法： source在CopySource=source必须是从桶根到实际的文件，而不是斗名和密钥的字典的完整路径。 所以我认为您的代码可能必须是：

s3.Object(bucket, destination).copy_from(CopySource=bucket + sourceDir)

Answer 2

这个问题很老，但也许对某人会有帮助：

copy_source = {
    'Bucket': 'my_perfect_bucket',
    'Key': 'media/old_path/glory.jpg'
}

s3.Object('my_perfect_bucket','media/new_path/glory.jpg').copy_from(CopySource=copy_source)