对于一个学习项目,我设置了一个Lambda授权器,它在DynamoDB表$DYNAMODB_TABLE_PROJECTS中进行查找,以确定对另一个表$ DYNAMODB_TABLE_TASKS的访问权限。它返回一个策略,该策略不像预期的那样工作。
权限错误如下所示:
An error occurred (AccessDeniedException) when calling the Query operation:
User: arn:aws:sts::984689749767:assumed-role/task-estimator-backend-dev-eu-central-1-lambdaRole/task-estimator-backend-dev-taskGetAll
is not authorized to perform: dynamodb:Query on resource:
arn:aws:dynamodb:eu-central-1:984689749767:table/task-estimator-backend-dev-tasks
because no identity-based policy allows the dynamodb:Query action
到目前为止我尝试过的
确保策略是有效的(通过策略Simulator)
授权程序lambda和我想授予权限的lambda之间发生的事情对我来说有点黑。从我所研究的例子来看,我不清楚我遗漏了什么信息。
我的配置如下:
Serverless.yml
provider:
name: aws
stage: ${opt:stage, 'dev'}
region: 'eu-central-1'
runtime: python3.9
memorySize: 128
environment:
DYNAMODB_TABLE_TASKS: ${self:service}-${self:provider.stage}-tasks
DYNAMODB_TABLE_PROJECTS: ${self:service}-${self:provider.stage}-projects
httpApi:
authorizers:
customAuthorizer:
type: request
functionName: authorizerFunc
api.yml
taskGetAll:
handler: functions/tasks.get_tasks
events:
- httpApi:
method: get
path: /tasks/get
authorizer:
name: customAuthorizer
# Authorization
authorizerFunc:
handler: functions/auth.get_permissions
role: authRole
authRole分配给授权程序lambda,它允许在$DYNAMODB_TABLE_PROJECTS中进行初始表查找:
authRole:
Type: AWS::IAM::Role
Properties:
RoleName: authRole
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: myPolicyName
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- dynamodb:GetItem
- dynamodb:Query
Resource:
- Fn::GetAtt:
- DynamoTableProjects
- Arn
- Effect: "Allow"
Action:
- logs:CreateLogGroup
- logs:CreateLogStream
- logs:PutLogEvents
Resource: "*"
策略文档,它由lambda授权程序生成,该授权程序应该授予从$DYNAMODB_TABLE_TASKS读取数据的访问权限:
"principalId":"59e30e90",
"policyDocument":{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":[
"dynamodb:GetItem",
"dynamodb:Query"
],
"Resource":[
"arn:aws:dynamodb:*:*:table/task-estimator-backend-dev-tasks",
"arn:aws:dynamodb:*:*:table/task-estimator-backend-dev-tasks/index/*"
]
},
{
"Effect":"Allow",
"Action":[
"execute-api:Invoke",
"execute-api:ManageConnections"
],
"Resource":"arn:aws:execute-api:*:*:*"
},
{
"Effect":"Allow",
"Action":[
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource":"*"
}
]
}
我很感激我得到的任何帮助,任何能让我重回正轨的问题。
发布于 2022-08-24 05:39:36
解决方案:
如果我理解正确,则返回的策略仅适用于
"Resource":“arn:aws:execute:*”
也就是说,它决定可以调用哪个端点URL,但不会更改API网关后面的lambda的权限。
我将API更改为例如{ authUrl }/{projecId}/items/get,并在策略文档中考虑这些路径参数,以便只允许基于提供的authUrl调用特定的projectIds (例如:链接共享,其中URL与项目相关联,并且存在管理/贡献者/查看器URL)。
https://stackoverflow.com/questions/73432238
复制相似问题