AWS boto3用户：arn:AWS:iam:：xxxx:root无权对资源执行：lambda:AddLayerVersionPermission

Question

import json
import boto3
client = boto3.client('lambda')
response = client.add_layer_version_permission(
    LayerName='arn:aws:lambda:us-east-1:xxxx:layer:AWSLambda-Python38-SciPy1x',
    VersionNumber=29,
    StatementId='xaccount',
    Action='lambda:GetLayerVersion',
    Principal='*',
)
print(response)

setp1）设置aws凭据

步骤2）创建新的IAM管理员用户，并将策略分配给该用户管理员访问、AWSLambda_完全访问、AWSLambdaExecute

第3步）运行python脚本后，我发现一个错误

botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the AddLayerVersionPermission operation: User: arn:aws:iam::xxxx:root is not authorized to perform: lambda:AddLayerVersionPermission on resource: arn:aws:lambda:us-east-1:xxxx:layer:AWSLambda-Python38-SciPy1x:29

Answer 1

您尝试修改的图层：

arn:aws:lambda:us-east-1:xxxx:layer:AWSLambda-Python38-SciPy1

是AWS managed public layer。它不属于您，因此您无法修改其权限，并解释了拒绝您这样做的原因