Closed hideokamoto closed 4 years ago
FIY.
The Skill's IAM policy for S3 is this.
AlexaSkillIAMRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action:
- sts:AssumeRole
Path: /
Policies:
- PolicyName: alexaSkillExecutionPolicy
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- logs:*
Resource: arn:aws:logs:*:*:*
- Action:
- s3:PutObject
- s3:GetObject
- s3:DeleteObject
Resource:
- arn:aws:s3:::ANY_BUCKET/*
Effect: Allow
And the example code will work well before creating a new item like this.
'''Failed'''
const data = await handlerInput.attributesManager.getPersistentAttributes()
console.log(data)
'''Works'''
handlerInput.attributesManager.setPersistentAttributes({dummy: true})
await handlerInput.attributesManager.savePersistentAttributes()
const data = await handlerInput.attributesManager.getPersistentAttributes(false)
console.log(data)
Is the IAM policy missing any actions for the s3-persistent-adapter? Or should we create a patch for the issue?
Thanks.
@hideokamoto
Thanks for reporting this issue. I could reproduce this issue.
In summary, our S3 persistent adapter based on aws sdk, and the getAttributes function is based s3Client.getObject() function. For this issue, when there's no object in S3 bucket, getObject function return an error with error code: 'AccessDenied' instead of 'NoSuchKey'.
I will reach out to aws sdk team for the help, and get back to you. Please keep tuned :)
Thanks, Shen
Hi @hideokamoto ,
After doing more research, found the root cause. Here is the statement in aws sdk doc: If the object you request does not exist, the error Amazon S3 returns depends on whether you also have the s3:ListBucket permission.
If you have the s3:ListBucket permission on the bucket, Amazon S3 will return an HTTP status code 404 ("no such key") error.
If you don’t have the s3:ListBucket permission, Amazon S3 will return an HTTP status code 403 ("access denied") error.
Thus, you would need to have ListBucket permission as well.
Thanks, Shen
I'm submitting a...
Example code
Expected Behavior
The
console.log(data)
will showundefined
or{}
ornull
if the persistent attributes do not exist for the user.Current Behavior
handlerInput.attributesManager.getPersistentAttributes()
will throw Exception.Possible Solution
We need to handle the
Access Denied
exception from AWS SDK(S3).Steps to Reproduce (for bugs)
Context
Your Environment
Lambda version using
Nodejs12.x
Node.js and NPM Info