AWS AccessDeniedException elastictranscoder：CreateJob

Question

我正在嘗試使用Lambda函數來觸發Elastic Transcoder作業，但我一直收到以下錯誤消息：

AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/xxxx/xxx is not authorized to perform: elastictranscoder:CreateJob on resource: arn:aws:elastictranscoder:xxxxx:pipeline/xxxxx

我的IAM用戶策略涵蓋了所有訪問要求：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1465486106000",
        "Effect": "Allow",
        "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:GetLogEvents",
            "logs:PutLogEvents",
            "logs:DescribeLogStreams"
        ],
        "Resource": [
            "arn:aws:logs:*:*:*"
        ]
    },
    {
        "Sid": "1",
        "Effect": "Allow",
        "Action": [
            "s3:Put*",
            "s3:ListBucket",
            "s3:*MultipartUpload*",
            "s3:Get*"
        ],
        "Resource": "*"
    },
    {
        "Sid": "2",
        "Effect": "Allow",
        "Action": "sns:Publish",
        "Resource": "*"
    },
    {
        "Sid": "3",
        "Effect": "Deny",
        "Action": [
            "s3:*Delete*",
            "s3:*Policy*",
            "sns:*Remove*",
            "sns:*Delete*",
            "sns:*Permission*"
        ],
        "Resource": "*"
    }
]
}

為什么會出現AccessDeniedException ，該如何解決？

Answer 1

將您的政策更改為以下內容，然后嘗試即可

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "Stmt1465486106000",
        "Effect": "Allow",
        "Action": [

            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:GetLogEvents",
            "logs:PutLogEvents",
            "logs:DescribeLogStreams"
        ],
        "Resource": [
            "arn:aws:logs:*:*:*"
        ]
    },
    {
        "Sid": "1",
        "Effect": "Allow",
        "Action": [
            "elastictranscoder:*",
            "s3:Put*",
            "s3:ListBucket",
            "s3:*MultipartUpload*",
            "s3:Get*"
        ],
        "Resource": "*"
    },
    {
        "Sid": "2",
        "Effect": "Allow",
        "Action": "sns:Publish",
        "Resource": "*"
    },
    {
        "Sid": "3",
        "Effect": "Deny",
        "Action": [
            "s3:*Delete*",
            "s3:*Policy*",
            "sns:*Remove*",
            "sns:*Delete*",
            "sns:*Permission*"
        ],
        "Resource": "*"
    }
]
}

Answer 2

您不需要通過編輯更改json。 首先，確定您要編輯哪個角色？

1-) Click Permisson http://prntscr.com/j1giww 
2-) see the role name http://prntscr.com/j1gj6s 
3-) go to IAM Roles 
4-) select the roles that you see at step 2
5-) edit policy and add Transcoder Full Access ( Or selected access )