amazon-web-services - 如何授予 Athena 对 Lambda 函数的查询权限？

Question

我有一个查询 Amazon Athena 数据库的 AWS Lambda 函数。但是在执行 Lambda 函数时出现权限错误:

An error occurred (AccessDeniedException) when calling the GetQueryExecution operation: User: arn:aws:sts::773592622512:assumed-role/lambda_access-role/reddit_monitor is not authorized to perform: athena:GetQueryExecution on resource: arn:aws:athena:ap-southeast-2:773592622512:workgroup/primary: ClientError

我为 Lambda 函数创建了这个策略:

  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "athena:StartQueryExecution"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": [
        "s3:*"
      ],
      "Effect": "Allow",
      "Resource": [
            "arn:aws:s3:::${var.athena-bucket}",
            "arn:aws:s3:::${var.athena-bucket}/*"
        ]
    } 
  ]
}

请问为什么还是没有权限查询Athena？我在这里错过了什么吗？

Answer 1

您授予了 athena:StartQueryExecution 而不是 athena:GetQueryExecution。