amazon-web-services - 从 KMS 加密 SNS 中的 lambda 函数发布

Question

我正在尝试从 Python 3.8 Lambda 函数发布到 KMS 加密的 SNS 主题。
我的 lambda 代码是:

import os
import boto3

sns = boto3.client('sns')


def handler(event, context):
    message = 'Hello world'

    response = sns.publish(
        TopicArn='<My topic ARN>',
        Message=message,
    )

如果 SNS 未加密，则代码可以完美运行...

...但是当我通过以下选项加密 SNS 主题时:



执行 lambda 时出现以下错误:

{ "errorMessage": "An error occurred (KMSNotFound) when calling the Publish operation: Invalid keyId aws/sns (Service: AWSKMS; Status Code: 400; Error Code: NotFoundException; Request ID: d81234100-9cb4-4af2-0032-c4a568a955f4)", "errorType": "KMSNotFoundException", "stackTrace": [ " File \"/var/task/lambda.py\", line 10, in handler\n boto3.client('sns').publish(\n", " File \"/var/runtime/botocore/client.py\", line 316, in _api_call\n return self._make_api_call(operation_name, kwargs)\n", " File \"/var/runtime/botocore/client.py\", line 626, in _make_api_call\n raise error_class(parsed_response, operation_name)\n" ] }

我的代码中缺少什么？

Answer 1

AWS 支持友好地指出我在 lambda 执行角色中缺少 KMS 权限。

Lambda 函数执行角色必须具备以下条件才能在 SNS 加密主题中发布:

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": [
      "kms:GenerateDataKey",
      "kms:Decrypt"
    ],
    "Resource": "<the-key-with-which-the-topic-is-encrypted>"
  }
}