為什么在使用 dynamodb 和 s3 存儲桶創建 lambda 函數時出現 IamRoleLambdaExecution 錯誤？

Question

我在我的 lambda 函數中使用 dynamodb 和 s3 對象。 我在嘗試部署 lambda 函數時遇到 IamRoleLambdaExecution 錯誤。

完整的錯誤說

Actions/Conditions must be prefaced by a vendor, e.g., iam, sdb, ec2, etc. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: e1083796-7b8d-45d2-a9ac-8a9f01f78a6a; Proxy: null)

這是我的 serverless.yaml

service: serverless-gpt-app

frameworkVersion: "3"

provider:
  name: aws
  stage: prod
  region: eu-central-1
  runtime: nodejs14.x
  memorySize: 256

  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - dynamodb:DescribeTable
            - dynamodb:Query
            - dynamodb:Scan
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
            - dynamodb:DeleteItem
            - s3*
          Resource:
            - arn:aws:s3:::user-text-bucket/*
            - arn:aws:dynamodb:eu-central-1:183747912409:table/user-text


functions:
  hello:
    handler: app.server
    events: # events trigger lambda functions
      - http: # this is an API Gateway HTTP event trigger
          path: /
          method: ANY
          cors: true
      - http: # all routes get proxied to the Express router
          path: /{proxy+}
          method: ANY
          cors: true

Answer 1

它應該像下面的s3:*和針對不同資源的單獨語句：

iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - dynamodb:DescribeTable
            - dynamodb:Query
            - dynamodb:Scan
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
            - dynamodb:DeleteItem
          Resource:
            - arn:aws:dynamodb:eu-central-1:183747912409:table/user-text
        - Effect: Allow
          Action:
            - s3:*
          Resource:
            - arn:aws:s3:::user-text-bucket/*
 

格式可能需要調整，因為它是從我的手機中寫入的。