故障排除 AWS Lambda 身份和访问
使用以下信息可帮助您诊断和修复在使用 Lambda 和 IAM 时可能遇到的常见问题。
主题
我无权在 Lambda 中执行操作
如果 AWS 管理控制台 告诉您，您无权执行某个操作，则必须联系您的管理员寻求帮助。您的管理员是指为您提供用户名和密码的那个人。
当 mateojackson IAM 用户尝试使用控制台查看有关函数的详细信息，但不具有 lambda:GetFunction 权限时，会发生以下示例错误。
User: arn:aws-cn:iam::123456789012:user/mateojackson is not authorized to perform: lambda:GetFunction on resource: my-function
在这种情况下，Mateo 请求他的管理员更新其策略，以允许他使用 lambda:GetFunction 操作访问 my-funciton 资源。
我无权执行 iam:PassRole
If you receive an error that you're not authorized to perform the iam:PassRole action, then you must contact your administrator for
assistance. Your administrator is the person that provided you with your user name
and password. Ask that person to update your policies to allow
you to pass a role to Lambda.
Some AWS services allow you to pass an existing role to that service, instead of creating a new service role or service-linked role. To do this, you must have permissions to pass the role to the service.
The following example error occurs when an IAM user named marymajor tries to use the console to perform an action in
Lambda. However, the action requires the service to have permissions granted by a
service role. Mary does not have permissions to pass the
role to the service.
User: arn:aws-cn:iam::123456789012:user/marymajoris not authorized to perform: iam:PassRole
In this case, Mary asks her administrator to update her policies to allow her to perform
the iam:PassRole action.
我想要查看我的访问密钥
After you create your IAM user access keys, you can view your access key ID at any time. However, you can't view your secret access key again. If you lose your secret key, you must create a new access key pair.
Access keys consist of two parts: an access key ID (for example, AKIAIOSFODNN7EXAMPLE) and a secret access key (for example,
wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY). Like a user name and password, you must use both the access key ID and secret access
key
together to authenticate your requests. Manage your access keys as securely as you
do your user name and password.
重要
Do not provide your access keys to a third party, even to help find your canonical user ID. By doing this, you might give someone permanent access to your account.
When you create an access key pair, you are prompted to save the access key ID and secret access key in a secure location. The secret access key is available only at the time you create it. If you lose your secret access key, you must add new access keys to your IAM user. You can have a maximum of two access keys. If you already have two, you must delete one key pair before creating a new one. To view instructions, see Managing Access Keys in the IAM 用户指南.
我是管理员并希望允许其他人访问 Lambda
To allow others to access Lambda, you must create an IAM entity (user or role) for the person or application that needs access. They will use the credentials for that entity to access AWS. You must then attach a policy to the entity that grants them the correct permissions in Lambda.
To get started right away, see Creating Your First IAM Delegated User and Group in the IAM 用户指南.
我想要允许我的 AWS 账户之外的用户访问我的 Lambda 资源
You can create a role that users in other accounts or people outside of your organization can use to access your resources. You can specify who is trusted to assume the role. For services that support resource-based policies or access control lists (ACLs), you can use those policies to grant people access to your resources.
To learn more, consult the following:
-
To learn whether Lambda supports these features, see AWS Lambda 如何与 IAM 协同工作.
-
To learn how to provide access to your resources across AWS accounts that you own, see Providing Access to an IAM User in Another AWS Account That You Own in the IAM 用户指南.
-
To learn how to provide access to your resources to third-party AWS accounts, see Providing Access to AWS Accounts Owned by Third Parties in the IAM 用户指南.
-
To learn how to provide access through identity federation, see Providing Access to Externally Authenticated Users (Identity Federation) in the IAM 用户指南.
-
To learn the difference between using roles and resource-based policies for cross-account access, see How IAM Roles Differ from Resource-based Policies in the IAM 用户指南.