amazon-web-services - 使用 AWS Lambda 仅使用角色访问 S3

Question

我有一个用 Java I 编写的 Lambda 函数，我希望它访问 S3 (putObject)。

我不想在 Lambda 函数中使用或存储凭证来访问 S3。相反，我想使用 IAM 角色。

如何在我的 java 代码(将由 Lambda 运行)中编写不需要任何凭证并假设 Lambda 具有适当角色的 AWS S3 客户端？

Answer 1

您不需要在 lambda 函数中存储凭据。所有函数都以角色运行 - 您在创建函数时设置的角色。由于 lambda 函数具有角色，因此您可以根据需要添加或删除该角色的权限，而无需更改函数本身

Manage Permissions: Using an IAM Role (Execution Role)

Each Lambda function has an IAM role (execution role) associated with it. You specify the IAM role when you create your Lambda function. Permissions you grant to this role determine what AWS Lambda can do when it assumes the role. There are two types of permissions that you grant to the IAM role:

If your Lambda function code accesses other AWS resources, such as to read an object from an S3 bucket or write logs to CloudWatch Logs, you need to grant permissions for relevant Amazon S3 and CloudWatch actions to the role. If the event source is stream-based (Amazon Kinesis Streams and DynamoDB streams), AWS Lambda polls these streams on your behalf. AWS Lambda needs permissions to poll the stream and read new records on the stream so you need to grant the relevant permissions to this role.

http://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html