amazon-web-services - AWS : AccessDeniedException when calling ssm:GetParameterHistory on SSM Parameter

Question

我正在尝试编写一个 lambda 来监听来自 CloudWatch 的参数存储更改事件，并通过调用 boto3.client('ssm').get_parameter_history(Name=event["name"] 获取参数的历史数据,WithDecryption=True)。此方法失败并显示消息:

botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the GetParameterHistory operation: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access. (Service: AWSKMS; Status Code: 400; Error Code: AccessDeniedException; Request ID: blah-blah-blah)

下面是 lambda 的执行角色:

{
  "roleName": "myapp-paramstore-updates-webhook-role",
  "policies": [
    {
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:eu-west-1:000000000000:*"
          },
          {
            "Effect": "Allow",
            "Action": [
              "logs:CreateLogStream",
              "logs:PutLogEvents"
            ],
            "Resource": [
              "arn:aws:logs:eu-west-1:000000000000:log-group:/aws/lambda/ssm-paramstore-updates-webhook:*"
            ]
          }
        ]
      },
      "name": "LambdaBasicExeRole",
      "type": "inline"
    },
    {
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
              "kms:DescribeKey",
              "ssm:GetParameter"
            ],
            "Resource": [
              "arn:aws:kms:eu-west-1:000000000000:key/*",
              "arn:aws:ssm:eu-west-1:000000000000:parameter/myorg/myteam/slack/webhooks/ssm-paramstore-updates-webhook",
              "arn:aws:ssm:eu-west-1:000000000000:parameter/myorg/myteam/slack/webhooks/system-eventsupdates-webhook"
            ]
          },
          {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "ssm:GetParameterHistory",
            "Resource": "arn:aws:ssm:*:*:parameter/*"
          }
        ]
      },
      "name": "readonly-ssm-paramstore-updates-webhook",
      "type": "inline"
    }
  ],
  "trustedEntities": [
    "lambda.amazonaws.com"
  ]
}

在我使用 ssm:GetParameterHistory 之前，有 ssm:DescribeParameters，但我需要获取一些版本信息，因此进行了更改。一切都在同一个区域，lambda 和参数。

我现在需要什么额外的权限以及什么资源才能解决这个问题？

Answer 1

发现需要访问 key 的lambda角色需要在KMS中添加为 key 用户。基本上，需要向角色(或用户)授予权限，使其使用 key 对 secret 执行加密/解密。

这是从 KMS 控制台完成的，单击客户托管 key 列表中的 key 名称(假设它是您自己创建的 key )，向下滚动到 key 用户并添加需要使用该 key 的角色到允许的用户列表。