使用 Lambda 和 S3 將數據插入存儲桶時出現 AWS ClientError

Question

我正在嘗試使用 lambda 將 json blob 放入 S3 存儲桶中，並且在查看 cloudwatch 日志時出現以下錯誤

[ERROR] ClientError: An error occurred (AccessDenied) when calling the PutObject operation: Access Denied
Traceback (most recent call last):
  File "/var/task/main.py", line 147, in lambda_handler
    save_articles_and_comments(sub, submissions)
  File "/var/task/main.py", line 125, in save_articles_and_comments
    object.put(Body=json.dumps(articles))
  File "/var/task/boto3/resources/factory.py", line 520, in do_action
    response = action(self, *args, **kwargs)
  File "/var/task/boto3/resources/action.py", line 83, in __call__
    response = getattr(parent.meta.client, operation_name)(*args, **params)
  File "/var/task/botocore/client.py", line 316, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/var/task/botocore/client.py", line 635, in _make_api_call
    raise error_class(parsed_response, operation_name)

所有阻止公共訪問設置都設置為“關閉”，並且代碼中的存儲桶名稱與 S3 中的相同。 這是將 json blob 放入我的 S3 存儲桶和 lambda 處理程序的可尊重文件夾中的代碼

def save_articles_and_comments(sub, submissions):
    """
    """
    s3 = boto3.resource('s3')
    now = dt.datetime.utcnow()
    formatted_date = now.strftime("%Y-%m-%d-%H-%M-%S")

    articles, comments = data_for_subreddit(submissions)
    print("Number of articles, comments {}, {}".format(len(articles), len(comments)))
    articles_name = 'articles/' + formatted_date + '_' + sub + '_articles.json'
    comments_name = 'comments/' + formatted_date + '_' + sub + '_comments.json'
    object = s3.Object('diegos-reddit-bucket', articles_name)
    object.put(Body=json.dumps(articles))
    print("Finished writing articles to {}".format(articles_name))

    object = s3.Object('diegos-reddit-bucket', comments_name)
    object.put(Body=json.dumps(comments))
    print("Finished writing comments to {}".format(comments_name))


def lambda_handler(x, y):
    """
    """
    import time
    import random
    idx = random.randint(0, len(SUBREDDITS)-1)
    start = time.time()
    assert PRAW_KEY is not None
    sub = SUBREDDITS[idx]
    red = reddit_instance()
    subreddit = red.subreddit(sub)

    print("Pulling posts from {}, {}.".format(sub, "hot"))
    submissions = subreddit.hot()
    save_articles_and_comments(sub, submissions)
    print("="*50)

    print("Pulling posts from {}, {}.".format(sub, "new"))
    submissions = subreddit.new()
    save_articles_and_comments(sub, submissions)
    print("="*50)

    print("Pulling posts from {}, {}.".format(sub, "top"))
    submissions = subreddit.top()
    save_articles_and_comments(sub, submissions)
    print("="*50)

    print("Pulling posts from {}, {}.".format(sub, "rising"))
    submissions = subreddit.rising()
    save_articles_and_comments(sub, submissions)
    end = time.time()
    print("Elapsed time {}".format(end - start))

我看不出代碼中有什么問題讓我得到所說的錯誤。 用 main 替換我的 lambda_handler function 以在本地進行測試。 與 main 它一起工作，並寫入 S3 存儲桶及其受尊重的文件夾。 當我嘗試通過 AWS Lambda 運行時，在 function 完成從第一個 subreddit 中拉出帖子並嘗試將 json blob 放入存儲桶中的文件夾后，我得到了錯誤提示。 這就是我的 output 的樣子

Pulling posts from StockMarket, hot.
Number of articles, comments 101, 909
Finished writing articles to articles/2020-06-03-02-48-44_StockMarket_articles.json
Finished writing comments to comments/2020-06-03-02-48-44_StockMarket_comments.json
==================================================
Pulling posts from StockMarket, new.
Number of articles, comments 101, 778
Finished writing articles to articles/2020-06-03-02-49-10_StockMarket_articles.json
Finished writing comments to comments/2020-06-03-02-49-10_StockMarket_comments.json
==================================================
Pulling posts from StockMarket, top.
Number of articles, comments 101, 5116
Finished writing articles to articles/2020-06-03-02-49-36_StockMarket_articles.json
Finished writing comments to comments/2020-06-03-02-49-36_StockMarket_comments.json
==================================================
Pulling posts from StockMarket, rising.
Number of articles, comments 24, 170
Finished writing articles to articles/2020-06-03-02-52-10_StockMarket_articles.json
Finished writing comments to comments/2020-06-03-02-52-10_StockMarket_comments.json
Elapsed time 215.6588649749756

我的代碼是否有問題，或者這是否是 AWS 方面的問題？

Answer 1

出現此問題是因為您無權將對象寫入存儲桶：

PutObject操作：拒絕訪問

要糾正這個問題，必須查看lambda 執行角色：它是否具有寫入 S3 的權限？ 還可以檢查存儲桶策略。

與 main 它一起工作，並寫入 S3 存儲桶及其受尊重的文件夾。 當我嘗試通過 AWS Lambda 運行時，我收到錯誤消息

當您在本地進行測試時，您的代碼使用您自己的權限（您的 IAM 用戶）寫入 S3。 因此它起作用了。 當您在 lambda 上執行代碼時，您的 function 不會使用您的權限。 相反，它使用lambda 執行角色中定義的權限。