[Python / Lambda] boto3 sqs client raise botocore.exception.ClientError(Access Denied)

0

[ENV] Trigger Lambda -> ap-northeast-2 SQS queue -> ap-northeast-1 Crawler EC2 -> ap-northeast-1

[Pipeline] Trigger Lambda -> send_message -> SQS queue -> Crawler EC2

[Permission] Trigger Lambda -> queue.grant_send_messages(trigger_lambda) Crawler EC2 -> queue.grant_consume_messages(crawler_cluster_worker)

[Owner] ALL -> root account

[Python Code in Trigger Lambda] sqs_client.send_message( QueueUrl=CRAWLER_SQS_MESSAGE_QUEUE_URL, MessageBody=json.dumps(sqs_message) )

[Trigger Lambda's Error Detail] [ERROR] ClientError: An error occurred (AccessDenied) when calling the SendMessage operation: Access to the resource https://sqs.ap-northeast-1.amazonaws.com/ is denied. Traceback (most recent call last): File "/var/task/main.py", line 136, in lambda_handler raise e File "/var/task/main.py", line 116, in lambda_handler sqs_client.send_message( File "/var/task/botocore/client.py", line 530, in _api_call return self._make_api_call(operation_name, kwargs) File "/var/task/botocore/client.py", line 960, in _make_api_call raise error_class(parsed_response, operation_name)

[Question] The trigger lambda failed an sending sqs message always succeeded. There are no issues with permissions and regions. It is judged to be a temporary error. Can you tell me what could be the reason for the temporary error?

已提問 1 年前檢視次數 861 次
1 個回答
1
已接受的答案

If you're seeing this error all the time then the Lambda function doesn't have permission to send to that SQS queue. Check the IAM permissions and the role assigned to the Lambda function.

If you're seeing this error intermittently then there is something wrong - please contact our support team so that they can investigate. Here on re:Post we don't have access to your details, your account and the services that you're using. This is a forum for general advice; the support team are there to help with troubleshooting these types of issues.

profile pictureAWS
專家
已回答 1 年前
  • Thank you for answer. We will contact the aws support team.

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南