我有一段lambda
代码可以访问S3
。
之前,这个lambda
程序运行良好。但最近我更改了S3
的KMS密钥或某些其他安全组设置(lambda
源代码没有更改)。
出现了错误。
我猜测这个lambda
和S3
不在VPC上,因此安全组并不相关。
那么,与KMS密钥有关吗?
S3
被加密为bf3cf318-1376-44de-a014-XXXXXXXXX
,因此我必须给这个lambda
授予kms访问权限?但是如何操作?
或者,我完全错了吗?
[ERROR] ClientError: An error occurred (AccessDenied) when calling the GetObject operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.
Traceback (most recent call last):
File "/var/task/app.py", line 48, in handler
raise e
File "/var/task/app.py", line 45, in handler
obj = s3_client.get_object(Bucket=bucket_name, Key=obj_key)
File "/var/runtime/botocore/client.py", line 391, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/var/runtime/botocore/client.py", line 719, in _make_api_call
raise error_class(parsed_response, operation_name)
[ERROR] ClientError: An error occurred (AccessDenied) when calling the GetObject operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. Traceback (most recent call last): File "/var/task/app.py", line 48, in handler raise e File "/var/task/app.py", line 45, in handler obj = s3_client.get_object(Bucket=bucket_name, Key=obj_key) File "/var/runtime/botocore/client.py", line 391, in _api_call return self._make_api_call(operation_name, kwargs) File "/var/runtime/botocore/client.py", line 719, in _make_api_call raise error_class(parsed_response, operation_name)
源代码出现错误的地方在这里。
try:
logger.info(f"Try to get the object from bucket [{bucket_name}], key [{obj_key}]")
obj = s3_client.get_object(Bucket=bucket_name, Key=obj_key)
except Exception as e:
logger.exception(e)
raise e
添加此策略 Lambda 角色
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "kms:Decrypt",
"Resource": "arn:aws:kms:*:678100228133:key/*"
}
]
}
消息已更改
[ERROR] ClientError: An error occurred (AccessDenied) when calling the PutObject operation: User: arn:aws:sts::678100228133:assumed-role/cm-dev-resource-ResizerLambdaServiceRoleAE27CE82-1WN6YXPJAJDCX/cm-dev-lambda-resizer is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:ap-northeast-1:678100228133:key/e08d0542-a4ba-42e7-9725-106a48fd24c2 because no identity-based policy allows the kms:GenerateDataKey action
Traceback (most recent call last):
File "/var/task/app.py", line 82, in handler
s3_client.put_object(Bucket=out_bk_name, Key=key, Body=data, ContentType=content_type)
File "/var/runtime/botocore/client.py", line 391, in _api_call
return self._make_api_call(operation_name, kwargs)
File "/var/runtime/botocore/client.py", line 719, in _make_api_call
raise error_class(parsed_response, operation_name)
[ERROR] ClientError: An error occurred (AccessDenied) when calling the PutObject operation: User: arn:aws:sts::678100228133:assumed-role/cm-dev-resource-ResizerLambdaServiceRoleAE27CE82-1WN6YXPJAJDCX/cm-dev-lambda-resizer is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:ap-northeast-1:678100228133:key/e08d0542-a4ba-42e7-9725-106a48fd24c2 because no identity-based policy allows the kms:GenerateDataKey action Traceback (most recent call last): File "/var/task/app.py", line 82, in handler s3_client.put_object(Bucket=out_bk_name, Key=key, Body=data, ContentType=content_type) File "/var/runtime/botocore/client.py", line 391, in _api_call return self._make_api_call(operation_name, kwargs) File "/var/runtime/botocore/client.py", line 719, in _make_api_call raise error_class(parsed_response, operation_name)