调用 DescribeVpcEndpoints 操作时发生错误（UnauthorizedOperation）：您无权执行此操作

Question

我在执行我的 lambda 时遇到此错误

调用 DescribeVpcEndpoints 操作时发生错误 (UnauthorizedOperation)：您无权执行此操作。

我的保单详情：

Version": "2012-10-17",
              "Statement": [
                {
                  "Sid": "IngestionClusterNodes",
                  "Effect": "Allow",
                  "Action": [
                    "s3:*",
                    "glue:*",
                    "kms:*",
                    "sns:*",
                    "cloudformation:DeleteStack",
                    "cloudformation:DescribeStackResource",
                    "cloudformation:DescribeStackResources",
                    "cloudformation:DescribeStacks",
                    "cloudformation:ListStackResources",
                    "cloudwatch:*",
                    "elasticmapreduce:*",
                    "secretsmanager:GetSecretValue",
                    "secretsmanager:CreateSecret",
                    "secretsmanager:PutResourcePolicy",
                    "secretsmanager:UpdateSecret",
                    "iam:GetGroup",
                    "ec2:*",
                    "events:*",
                    "logs:*",
                    "ses:*",
                    "sns:*",
                    "sns:Publish"
                  ],
                  "Resource": [
                    "arn:aws:iam::*",
                    "arn:aws:ses:*",
                    "arn:aws:sqs:*",
                    "arn:aws:s3:::*",
                    "arn:aws:logs:*",
                    "arn:aws:sns:*",
                    "arn:aws:cloudformation:*",
                    "arn:aws:cloudwatch:*",
                    "arn:aws:secretsmanager:*",
                    "arn:aws:ec2:*",
                    "arn:aws:events:*:*:*",
                    "arn:aws:logs:*:*:*",
                    "arn:aws:autoscaling:*"
                  ]
                }

我已将上述政策附加到 Lambda 执行角色。

Answer 1

我建议您只需将声明修改为；

            {
              "Sid": "IngestionClusterNodes",
              "Effect": "Allow",
              "Action": [
                "s3:*",
                "glue:*",
                "kms:*",
                "sns:*",
                "cloudformation:DeleteStack",
                "cloudformation:DescribeStackResource",
                "cloudformation:DescribeStackResources",
                "cloudformation:DescribeStacks",
                "cloudformation:ListStackResources",
                "cloudwatch:*",
                "elasticmapreduce:*",
                "secretsmanager:GetSecretValue",
                "secretsmanager:CreateSecret",
                "secretsmanager:PutResourcePolicy",
                "secretsmanager:UpdateSecret",
                "iam:GetGroup",
                "ec2:*",
                "events:*",
                "logs:*",
                "ses:*",
                "sns:*",
                "sns:Publish"
              ],
              "Resource": ["*"]
            }

请注意，VPCendpoint 没有 Arns。只有 id，vpce-092e602ea1a16886e，所以你的 ec2:* 在资源块中不允许你描述 vpc 端点。