Lambda 无权执行：dynamodb:GetItem

Question

我有一个 IAM 组，它为其用户分配了一些权限。许多权限之一是访问 Lambda 函数。这些 lambda 函数在 DynamoDB 表中添加简单的 cmets。对于尝试在 AWS 控制台中测试 Lambda 的用户，响应如下：

User: arn:aws:sts::11111111111:assumed-role/jd-176-LambdaToDynamoDBCommentTableRole-1QGT8KW7YAUAA/jd-176-LambdaCreationHelperSta-SaveCommentFunction-LQRLLIVVRDS5 is not authorized to perform: dynamodb:GetItem on resource: arn:aws:dynamodb:us-east-1:11111111111:table/aws-serverless-config

这很奇怪，因为看起来我允许dynamodb:GetItem，以及arn:aws:dynamodb:us-east-1:11111111111:table/aws-serverless-config 上的其他人。

LambdaToDynamoDBCommentTableRole：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Action": [
            "dynamodb:DeleteItem",
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:PutItem",
            "dynamodb:Query",
            "dynamodb:Scan",
            "dynamodb:UpdateItem"
        ],
        "Resource": [
            "arn:aws:dynamodb:us-east-1:11111111111:table/jd-176-BlogComment",
            "arn:aws:dynamodb:us-east-1:11111111111:table/jd-176-serverless-config"
        ],
        "Effect": "Allow",
        "Sid": "AllowDynamoDB"
    }
]

}

我真的很感激这里的任何帮助。如果需要更多信息，我很乐意提供。

Answer 1

错误信息是正确的。它表明您正在尝试访问aws-serverless-config 表，但您的LambdaToDynamoDBCommentTableRole 只允许访问：

• jd-176-博客评论
• jd-176-serverless-config

如果要允许访问aws-serverless-config，则必须将其添加到LambdaToDynamoDBCommentTableRole：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Action": [
            "dynamodb:DeleteItem",
            "dynamodb:GetItem",
            "dynamodb:BatchGetItem",
            "dynamodb:PutItem",
            "dynamodb:Query",
            "dynamodb:Scan",
            "dynamodb:UpdateItem"
        ],
        "Resource": [
            "arn:aws:dynamodb:us-east-1:11111111111:table/jd-176-BlogComment",
            "arn:aws:dynamodb:us-east-1:11111111111:table/jd-176-serverless-config",
            "arn:aws:dynamodb:us-east-1:11111111111:table/aws-serverless-config"
        ],
        "Effect": "Allow",
        "Sid": "AllowDynamoDB"
    }
 ]
}