AWS Lambda
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 AWS 服务入门

故障排除 AWS Lambda 身份和访问

使用以下信息可帮助您诊断和修复在使用 Lambda 和 IAM 时可能遇到的常见问题。

我无权在 Lambda 中执行操作

如果 AWS 管理控制台 告诉您,您无权执行某个操作,则必须联系您的管理员寻求帮助。您的管理员是指为您提供用户名和密码的那个人。

mateojackson IAM 用户尝试使用控制台查看有关函数的详细信息,但不具有 lambda:GetFunction 权限时,会发生以下示例错误。

User: arn:aws-cn:iam::123456789012:user/mateojackson is not authorized to perform: lambda:GetFunction on resource: my-function

在这种情况下,Mateo 请求他的管理员更新其策略,以允许他使用 lambda:GetFunction 操作访问 my-function 资源。

我无权执行 iam:PassRole

If you receive an error that you're not authorized to perform the iam:PassRole action, then you must contact your administrator for assistance. Your administrator is the person that provided you with your user name and password. Ask that person to update your policies to allow you to pass a role to Lambda.

Some AWS services allow you to pass an existing role to that service, instead of creating a new service role or service-linked role. To do this, you must have permissions to pass the role to the service.

The following example error occurs when an IAM user named marymajor tries to use the console to perform an action in Lambda. However, the action requires the service to have permissions granted by a service role. Mary does not have permissions to pass the role to the service.

User: arn:aws-cn:iam::123456789012:user/marymajor is not authorized to perform: iam:PassRole

In this case, Mary asks her administrator to update her policies to allow her to perform the iam:PassRole action.


After you create your IAM user access keys, you can view your access key ID at any time. However, you can't view your secret access key again. If you lose your secret key, you must create a new access key pair.

Access keys consist of two parts: an access key ID (for example, AKIAIOSFODNN7EXAMPLE) and a secret access key (for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY). Like a user name and password, you must use both the access key ID and secret access key together to authenticate your requests. Manage your access keys as securely as you do your user name and password.


Do not provide your access keys to a third party, even to help find your canonical user ID. By doing this, you might give someone permanent access to your account.

When you create an access key pair, you are prompted to save the access key ID and secret access key in a secure location. The secret access key is available only at the time you create it. If you lose your secret access key, you must add new access keys to your IAM user. You can have a maximum of two access keys. If you already have two, you must delete one key pair before creating a new one. To view instructions, see Managing Access Keys in the IAM 用户指南.

我是管理员并希望允许其他人访问 Lambda

To allow others to access Lambda, you must create an IAM entity (user or role) for the person or application that needs access. They will use the credentials for that entity to access AWS. You must then attach a policy to the entity that grants them the correct permissions in Lambda.

To get started right away, see Creating Your First IAM Delegated User and Group in the IAM 用户指南.

我想要允许我的 AWS 账户之外的用户访问我的 Lambda 资源

You can create a role that users in other accounts or people outside of your organization can use to access your resources. You can specify who is trusted to assume the role. For services that support resource-based policies or access control lists (ACLs), you can use those policies to grant people access to your resources.

To learn more, consult the following: