Athena 从 lambda 查询权限，将结果存储在 s3 中

如何解决Athena 从 lambda 查询权限，将结果存储在 s3 中

我有一个 lambda 函数在 athena 上运行查询，并将输出位置放入 s3 存储桶。我收到权限错误，不知道为什么。

错误：

AthenaErrorCode: "INSUFFICIENT_PERMISSIONS",Message_: "Unable to verify/create output bucket my-s3-bucket"

拉姆达政策：

Policies:
        - Statement:
            - Effect: Allow
              Action:
                - athena:GetWorkGroup
                - s3:PutObject
                - s3:Getobject
                - athena:StartQueryExecution
                - s3:AbortMultipartUpload
                - lambda:InvokeFunction
                - athena:CancelQueryExecution
                - athena:StopQueryExecution
                - athena:GetQueryExecution
                - athena:GetQueryResults
                - s3:ListMultipartUploadParts
              Resource:
                - !Sub "arn:aws:athena:*:${AWS::AccountId}:workgroup/primary"
                - !Sub "arn:aws:s3:::${my-s3-bucket}/*"
            - Effect: Allow
              Action:
                - athena:ListWorkGroups
              Resource: "*"
            - Effect: Allow
              Action:
                - s3:ListBucket
                - s3:GetBucketLocation
              Resource:
                - !Sub "arn:aws:s3:::${my-s3-bucket}/*"

我的存储桶已经存在并且是在 cf 模板中创建的；这是政策

DevQueryResultsPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref DevQueryResultsBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowSSLRequestsOnly # AWS Foundational Security Best Practices v1.0.0 S3.5
            Effect: Deny
            Principal: '*'
            Action: 's3:*'
            Resource:
              - !GetAtt 'DevQueryResultsBucket.Arn'
              - !Sub '${DevQueryResultsBucket.Arn}/*'
            Condition:
              Bool:
                'aws:SecureTransport': false

最后是 lambda 中的代码：

// athena service
    svc := athena.New(sess,aws.NewConfig().WithRegion("us-east-1"))

    // create query
    var s athena.StartQueryExecutionInput
    fmt.Println(tables[0])
    s.SetQueryString(fmt.Sprintf("select * from %s limit 10",tables[0]))

    // set db for query
    var q athena.QueryExecutionContext
    q.SetDatabase("MYDB")
    s.SetQueryExecutionContext(&q)

    // setup output location to s3
    var r athena.ResultConfiguration
    r.SetoutputLocation("s3://my-s3-bucket")
    s.SetResultConfiguration(&r)

    // execute query
    result,err := svc.StartQueryExecution(&s)
    if err != nil {
        fmt.Println("execution error ----",err)
        return serverError(ctx,errors.New("query Failed to execute"))
    }

解决方法

您在模板中使用的 Lambda 的 IAM 策略缺失s3:ListBucketMultipartUploads。有关 Athena 写入输出存储桶所需的所有必需 IAM 权限，请参阅 this 文档。