amazon-web-services - SQS 的 AWS put-bucket-notification-configuration 抛出 "Unable to validate the following destination configurations"

Question

我想将 s3:CreateObject:* 事件发送到 SQS 队列。但是设置通知配置会导致 A client error (InvalidArgument) occurred when calling the PutBucketNotificationConfiguration operation: Unable to validate the following destination configurations
这是我创建存储桶的方式:

aws s3api create-bucket --profile default --bucket my-bucket --create-bucket-configuration LocationConstraint=eu-west-1

这就是我创建 SQS 队列的方式

aws sqs create-queue --profile default --queue-name my-queue --attributes file://attributes.json

使用 attributes.json 文件

{
  "DelaySeconds":"0",
  "MessageRetentionPeriod":"3600",
  "Policy":"{\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":[\"sqs:SendMessage\",\"sqs:ReceiveMessage\"],\"Condition\":{\"ArnLike\": {\"aws:SourceArn\": \"arn:aws:s3:*:*:my-bucket\"}}}]}"
}

最后尝试设置抛出我上面列出的错误消息的通知:

aws s3api put-bucket-notification-configuration --profile default --bucket my-bucket --notification-configuration file://notification.json`

使用 notification.json 文件

{
  "TopicConfigurations": [
  ],
  "QueueConfigurations": [
    {
      "QueueArn": "arn:aws:sqs:eu-west-1:123456789012:my-queue",
      "Events": [
        "s3:ObjectCreated:*"
      ],
      "Filter": {
        "Key": {
          "FilterRules": [
            {
              "Name": "prefix",
              "Value": "my-filter"
            }
          ]
        }
      }
    }
  ],
  "LambdaFunctionConfigurations": [
  ]
}

我真的不知道错误可能在哪里。
谢谢你的帮助!

Answer 1

看起来您的 SQS 策略不起作用。尝试将 Id 添加到您的策略中，并将 Resource 添加到您的声明中。像这样的东西:
{
"DelaySeconds":"0",
"MessageRetentionPeriod":"3600",
"Policy":"{\"Id\":\"someid\",\"Statement\":[{\"Effect\":\"Allow\",\"Resource\": \"arn:aws:sqs:eu-west-1:123456789012:my-queue\",\"Principal\":\"*\",\"Action\":[\"sqs:SendMessage\",\"sqs:ReceiveMessage\"],\"Condition\":{\"ArnLike\": {\"aws:SourceArn\": \"arn:aws:s3:*:*:my-bucket\"}}}]}"
}
以下是更多信息:

http://docs.aws.amazon.com/AmazonS3/latest/dev/ways-to-add-notification-config-to-bucket.html#step1-create-sqs-queue-for-notification

此外，从命令行调用 API 时，您可以使用 --debug 参数。您会看到完整的错误消息:
aws --debug s3api ...