使用 AWS lambda 触发异步 amazon Comprehend 作业时，我的 iam 角色出现问题

Question

我目前正在使用 AWS lambda 来触发异步 Amazon Comprehend 作业。 我正在使用的数据存储在 S3 存储桶的输入文件夹中，我正在尝试 output 将同一存储桶中的文件 output 文件夹中的文件。 我为这项工作担任的角色是“ComprehendFullAccess”和“AWSLambdaExecute”，这是以下代码。

import boto3

def lambda_handler(event, context):
    s3 = boto3.client("s3")
    bucket = "bucketName"
    key = "input/inputTextFile.txt"
    text = s3.get_object(Bucket = bucket, Key = key)
    review = str(text['Body'].read())
    client = boto3.client('comprehend')
    response = client.start_sentiment_detection_job(
        InputDataConfig={
            'S3Uri': 's3://bucketName/input/inputTextFile.txt',
            'InputFormat': 'ONE_DOC_PER_LINE',
            'DocumentReaderConfig': {
                'DocumentReadAction': 'TEXTRACT_ANALYZE_DOCUMENT',
                'DocumentReadMode': 'SERVICE_DEFAULT',
                'FeatureTypes': [
                    'FORMS'
                ]
            }
        },
        OutputDataConfig={
            'S3Uri': 's3://bucketName/output/'
        },
        DataAccessRoleArn='arn:aws:iam::randomNumbers:role/testrole',
        JobName='nameOfMyJob',
        LanguageCode='en'
    )
    print(response)
    return "response"

它不断产生此错误：

{
  "errorMessage": "An error occurred (AccessDeniedException) when calling the StartSentimentDetectionJob operation: User: arn:aws:sts::randomNumbers:assumed-role/testrole/testfunc is not authorized to perform: iam:PassRole on resource: arn:aws:iam::randomNumbers:role/testrole because no identity-based policy allows the iam:PassRole action",
  "errorType": "ClientError",
  "requestId": "d3a54dbd-a011-42f0-bc74-440ce9cbaa8d",
  "stackTrace": [
    "  File \"/var/task/lambda_function.py\", line 10, in lambda_handler\n    response = client.start_sentiment_detection_job(\n",
    "  File \"/var/runtime/botocore/client.py\", line 391, in _api_call\n    return self._make_api_call(operation_name, kwargs)\n",
    "  File \"/var/runtime/botocore/client.py\", line 719, in _make_api_call\n    raise error_class(parsed_response, operation_name)\n"
  ]
}

我不确定我的代码是否有错误，或者是否是角色/权限问题。 对于这个角色，这是我作为我的信任实体所拥有的：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "lambda.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

这是代码还是权限问题？ 这是我用于响应行的API：https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/comprehend.html#Comprehend.Client.start_sentiment_detection_job提前感谢您的帮助！

Answer 1

简而言之，您的用户arn:aws:sts::randomNumbers:assumed-role/testrole/testfunc需要附加此策略。

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "iam:PassRole"
        ],
        "Resource": "arn:aws:iam::randomNumbers:role/testrole"
    }]
}

有关为什么需要iam:PassRole的更多信息，请参阅此文档。 https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html