Lambda function 生成预签名 S3 url 的最低策略要求

Question

我在这里要做的是创建一个 lambda function 来为 S3 存储桶中的 object 生成一个预签名的 url。 因此，只要具有对 S3 的完全访问权限，function 的代码就可以正常工作。 但是当我尝试通过仅添加 GetObject 策略来限制它时，链接显示访问被拒绝。

这是我的 Lambda function

import boto3
import logging
import os
from botocore.exceptions import ClientError


def lambda_handler(event, context):
    """ Receives the date of the file as an input, and
    creates a presigned url to download the file
    args:
        - date
    returns:
        - response
    """
    bucket = os.environ["BUCKET_NAME"]
    s3_client = boto3.client('s3')
    try:
        response = s3_client.generate_presigned_url(
            'get_object',
            Params={
                'Bucket': bucket,
                'Key': event['object_name']
            },
            ExpiresIn=3600
            )
        return response
    except ClientError as e:
        logging.error(e)
        raise

这是我的模板文件，用于 SAM 部署

GetReportFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub 'getreport-${AWS::StackName}'
      Environment:
        Variables:
          BUCKET_NAME: !Ref LunchOrderBucket
      Runtime: python3.9
      PackageType: Zip
      CodeUri: src/get_report
      Handler: get_report.lambda_handler
      Role: !GetAtt GetReportFunctionRole.Arn
      # Policies:
      #   - S3FullAccessPolicy:
      #       BucketName: !Ref LunchOrderBucket
  
  GetReportFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: lambda.amazonaws.com
      Policies:
        - PolicyName: GetReportFunctionPolicy
          PolicyDocument: 
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                Resource: !GetAtt LunchOrderBucket.Arn

我想让它以最少的权限工作

Answer 1

您缺少的是存储桶下对象的权限。 您将需要制定策略以使其下的所有对象都具有 /*。

GetReportFunction:
Type: AWS::Serverless::Function
Properties:
  FunctionName: !Sub 'getreport-${AWS::StackName}'
  Environment:
    Variables:
      BUCKET_NAME: !Ref LunchOrderBucket
  Runtime: python3.9
  PackageType: Zip
  CodeUri: src/get_report
  Handler: get_report.lambda_handler
  Role: !GetAtt GetReportFunctionRole.Arn
  # Policies:
  #   - S3FullAccessPolicy:
  #       BucketName: !Ref LunchOrderBucket
  GetReportFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: lambda.amazonaws.com
      Policies:
        - PolicyName: GetReportFunctionPolicy
          PolicyDocument: 
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                Resource:
                  Fn::Join:
                  - ''
                  - - 'arn:aws:s3:::'
                    - Ref: LunchOrderBucket
                    - /*