AWS AccessDeniedException elastictranscoder: CreateJob

Question

Я пытаюсь использовать функцию лямбды, чтобы вызвать работу Упругого Транскодера, но я получаю сообщение об ошибке:

AccessDeniedException: User: arn:aws:sts::xxx:assumed-role/xxxx/xxx is not authorized to perform: elastictranscoder:CreateJob on resource: arn:aws:elastictranscoder:xxxxx:pipeline/xxxxx 

Моей IAM пользовательской политики охватывает все требования доступа:

{ 
"Version": "2012-10-17", 
"Statement": [ 
    { 
     "Sid": "Stmt1465486106000", 
     "Effect": "Allow", 
     "Action": [ 
      "logs:CreateLogGroup", 
      "logs:CreateLogStream", 
      "logs:GetLogEvents", 
      "logs:PutLogEvents", 
      "logs:DescribeLogStreams" 
     ], 
     "Resource": [ 
      "arn:aws:logs:*:*:*" 
     ] 
    }, 
    { 
     "Sid": "1", 
     "Effect": "Allow", 
     "Action": [ 
      "s3:Put*", 
      "s3:ListBucket", 
      "s3:*MultipartUpload*", 
      "s3:Get*" 
     ], 
     "Resource": "*" 
    }, 
    { 
     "Sid": "2", 
     "Effect": "Allow", 
     "Action": "sns:Publish", 
     "Resource": "*" 
    }, 
    { 
     "Sid": "3", 
     "Effect": "Deny", 
     "Action": [ 
      "s3:*Delete*", 
      "s3:*Policy*", 
      "sns:*Remove*", 
      "sns:*Delete*", 
      "sns:*Permission*" 
     ], 
     "Resource": "*" 
    } 
] 
} 

Почему я получаю AccessDeniedException и как его исправить?

Answer 1

Изменить политику ниже, а затем попробовать это будет работать

{ 
"Version": "2012-10-17", 
"Statement": [ 
    { 
     "Sid": "Stmt1465486106000", 
     "Effect": "Allow", 
     "Action": [ 

      "logs:CreateLogGroup", 
      "logs:CreateLogStream", 
      "logs:GetLogEvents", 
      "logs:PutLogEvents", 
      "logs:DescribeLogStreams" 
     ], 
     "Resource": [ 
      "arn:aws:logs:*:*:*" 
     ] 
    }, 
    { 
     "Sid": "1", 
     "Effect": "Allow", 
     "Action": [ 
      "elastictranscoder:*", 
      "s3:Put*", 
      "s3:ListBucket", 
      "s3:*MultipartUpload*", 
      "s3:Get*" 
     ], 
     "Resource": "*" 
    }, 
    { 
     "Sid": "2", 
     "Effect": "Allow", 
     "Action": "sns:Publish", 
     "Resource": "*" 
    }, 
    { 
     "Sid": "3", 
     "Effect": "Deny", 
     "Action": [ 
      "s3:*Delete*", 
      "s3:*Policy*", 
      "sns:*Remove*", 
      "sns:*Delete*", 
      "sns:*Permission*" 
     ], 
     "Resource": "*" 
    } 
] 
}