AWS Glue 错误 - 调用 HeadObject 操作时发生错误 (403)：禁止答案

【问题标题】：AWS Glue Error - An error occurred (403) when calling the HeadObject operation: ForbiddenAWS Glue 错误 - 调用 HeadObject 操作时发生错误 (403)：禁止
【发布时间】：2020-08-17 15:53:36
【问题描述】：

我有一个简单的 Glue pythonshell 作业，出于测试目的，我只有 print("Hello World") 。

我已为其提供所需的 AWSGlueServiceRole。当我尝试运行作业时，它会引发以下错误：

Traceback (most recent call last):
  File "/tmp/runscript.py", line 114, in <module>
    temp_file_path = download_user_script(args.scriptLocation)
  File "/tmp/runscript.py", line 91, in download_user_script
    download_from_s3(args.scriptLocation, temp_file_path)
  File "/tmp/runscript.py", line 81, in download_from_s3
    s3.download_file(bucket_name, s3_key, new_file_path)
  File "/usr/local/lib/python3.6/site-packages/boto3/s3/inject.py", line 172, in download_file
    extra_args=ExtraArgs, callback=Callback)
  File "/usr/local/lib/python3.6/site-packages/boto3/s3/transfer.py", line 307, in download_file
    future.result()
  File "/usr/local/lib/python3.6/site-packages/s3transfer/futures.py", line 106, in result
    return self._coordinator.result()
  File "/usr/local/lib/python3.6/site-packages/s3transfer/futures.py", line 265, in result
    raise self._exception
  File "/usr/local/lib/python3.6/site-packages/s3transfer/tasks.py", line 255, in _main
    self._submit(transfer_future=transfer_future, **kwargs)
  File "/usr/local/lib/python3.6/site-packages/s3transfer/download.py", line 345, in _submit
    **transfer_future.meta.call_args.extra_args
  File "/usr/local/lib/python3.6/site-packages/botocore/client.py", line 357, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/lib/python3.6/site-packages/botocore/client.py", line 661, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (403) when calling the HeadObject operation: Forbidden

当我向角色添加 S3 完全访问策略时，作业会成功运行。我无法调试出了什么问题

【问题讨论】：

我有同样的错误。还没有解决办法。尝试运行简单的 Python 脚本会打印一个数组。我尝试使用具有管理员权限的 root 用户和 IAM 用户。

标签： amazon-web-services amazon-s3 aws-glue

【解决方案1】：

在 Glue 中，您需要将 S3 策略附加到您用于运行作业的 Amazon Glue 角色。定义工作时，您选择角色。在此示例中，它是 AWSGlueServiceRole-S3IAMRole。在您分配之前，它没有 S3 访问权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        }
    ]
}

【讨论】：