AWS Lambda + S3 + SES+ Gmail 转发：'copyObject() 返回错误：'答案

【问题标题】：AWS Lambda + S3 + SES+ Gmail Forwarding : 'copyObject() returned error:'AWS Lambda + S3 + SES+ Gmail 转发：'copyObject() 返回错误：'
【发布时间】：2018-01-26 21:16:33
【问题描述】：

我已完全按照您在https://github.com/arithmetric/aws-lambda-ses-forwarder 上的说明进行操作，但我被卡住了。再多的谷歌搜索或不玩任何选项都没有帮助。客户即将终止合同 - 我们在这个错误上停留了太久。

我已验证我的域。我可以通过我的验证地址从任何地方接收电子邮件到我指定的 S3 存储桶。我还将 '"functionArn":xxx..."' 更改为 '"functionArn": "arn:aws:lambda:us-west-2:MY-ACCOUNT-ID:function:fnForwardEmailToGmail"'。

但是收到的电子邮件永远不会转发，当我使用“SES 电子邮件接收”测试功能时，我收到以下错误。

START RequestId: 7f2cd5ed-83ea-11e7-913f-55748388c69f Version: $LATEST
2017-08-18T07:54:44.467Z    7f2cd5ed-83ea-11e7-913f-55748388c69f    { level: 'info',
  message: 'Fetching email at s3://MY-S3-BUCKET/MY-PREFIX/o3vrnil0e2ic28fgfdstrm7dfhrc2v0clambda4nbp0g1' }
2017-08-18T07:54:46.068Z    7f2cd5ed-83ea-11e7-913f-55748388c69f    { level: 'error',
  message: 'copyObject() returned error:',
  error: 
   { [AccessDenied: Access Denied]
     message: 'Access Denied',
     code: 'AccessDenied',
     region: null,
     time: Fri Aug 18 2017 07:54:46 GMT+0000 (UTC),
     requestId: 'A6285517D1AF2B9D',
     extendedRequestId: 'dfH3csS5kHLsYN4ZgIWVliYmuVb1OgCVl6KdUSdZdqwX2T+JdkfZwIyPa5KEgYFiJfZmrwXjXDI=',
     cfId: undefined,
     statusCode: 403,
     retryable: false,
     retryDelay: 32.49475641641766 },
  stack: 'AccessDenied: Access Denied
    at Request.extractError (/var/task/node_modules/aws-sdk/lib/services/s3.js:473:35)
    at Request.callListeners (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:105:20)
    at Request.emit (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
    at Request.emit (/var/task/node_modules/aws-sdk/lib/request.js:615:14)
    at Request.transition (/var/task/node_modules/aws-sdk/lib/request.js:22:10)
    at AcceptorStateMachine.runTo (/var/task/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /var/task/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request.<anonymous> (/var/task/node_modules/aws-sdk/lib/request.js:38:9)
    at Request.<anonymous> (/var/task/node_modules/aws-sdk/lib/request.js:617:12)
    at Request.callListeners (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:115:18)' }
2017-08-18T07:54:46.127Z    7f2cd5ed-83ea-11e7-913f-55748388c69f    {"errorMessage":"Error: Could not make readable copy of email."}
END RequestId: 7f2cd5ed-83ea-11e7-913f-55748388c69f
REPORT RequestId: 7f2cd5ed-83ea-11e7-913f-55748388c69f  Duration: 1993.85 ms    Billed Duration: 2000 ms    Memory Size: 128 MB Max Memory Used: 32 MB

LAMBDA 角色功能政策

{
    "Version": "2016-03-04",
    "Statement": [
       {
          "Effect": "Allow",
          "Action": [
             "logs:CreateLogGroup",
             "logs:CreateLogStream",
             "logs:PutLogEvents"
          ],
          "Resource": "arn:aws:logs:*:*:*"
       },
       {
          "Effect": "Allow",
          "Action": "ses:SendRawEmail",
          "Resource": "*"
       },
       {
          "Effect": "Allow",
          "Action": [
             "s3:GetObject",
             "s3:PutObject"
          ],
          "Resource": "arn:aws:s3:::MY-S3-BUCKET/*"
       }
    ]
}

我已向我的 LAMBDA ROLE 添加了两个托管角色“AmazonS3FullAccess”和“AmazonSESFullAccess”。

S3 存储桶策略

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "GiveSESPermissionToWriteEmail",
         "Effect": "Allow",
         "Principal": {
            "Service": "ses.amazonaws.com"
         },
         "Action": "s3:PutObject",
         "Resource": "arn:aws:s3:::MY-S3-BUCKET/*",
         "Condition": {
            "StringEquals": {
               "aws:Referer": "MY-ACCOUNT-ID"
            }
         }
      }
   ]
}

我哪里错了？请帮忙！

【问题讨论】：

标签： amazon-web-services amazon-s3 aws-lambda

【解决方案1】：

copyObject() 调用似乎是在 S3 中复制文件。您应该为您的角色添加 S3 权限。

【讨论】：

【解决方案2】：

我遇到了同样的问题。在查看此处的 GitHub 设置说明 https://github.com/arithmetric/aws-lambda-ses-forwarder#set-up 后，我注意到我的 S3 IAM 策略没有任何权限集。

S3 服务应具有“受限：读、写”访问级别。

您需要修改策略并确保末尾有“/*”。请参见下面的示例：

"Resource": "arn:aws:s3:::S3-BUCKET-NAME/*"

【讨论】：