如何添加基于身份的策略以授权Cognito-Scentity访问Amazon Lex Bot？我还试图将基于资源的策略添加到Lex Bot

Question

我正在React应用程序中进行聊天机器人。我已经使用了react-lex-plus npm软件包。 在Lexchat组件中，我输入了机器人别名。我创建了一个新的身份池ID。 但是在本地运行它之后，我得到了

   AccessDeniedException: User: arn:aws:sts::myAccountId:assumed-role/Cognito_LiveAssistanceBotIdUnauth_Role/CognitoIdentityCredentials is not authorized to perform: lex:PostText on resource: arn:aws:lex:us-east-1:myAccountIdbot:LiveAssistanceBot:$LATEST because no identity-based policy allows the lex:PostText action

我不知道在哪里更新基于身份的策略。我还试图为Lex Bot设置基于资源的策略。

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "LiveAssitanceBotId",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "cognito-identity.amazonaws.com"
        ]
      },
      "Action": [
        "lex:RecognizeText",
        "lex:StartConversation"
      ],
      "Resource": [
        "arn:aws:lex:us-east-1:myAccountID_:bot-alias/1AUEAAP4MW/9F7RMYLBSU"
      ],
      "Condition": {
        "StringEquals": {
          "AWS:SourceAccount": "myAccountId_"
        },
        "ArnEquals": {
          "AWS:SourceArn": "arn:aws:cognito-identity:us-east-1:myAccountId_:identitypool/us-east-1:d4a81595-0381-4fbb-ab20-9b76e4143ca1"
        }
      }
    }
  ]
}

之后，我在创建策略时会获得内部错误。

Answer 1

您需要将lex：PostText功能添加到策略的Action部分。

以下是我现有的许可政策之一的摘录：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "lex:PostContent",
                "lex:PostText",
                "lex:PutSession",
                "lex:GetSession",
                "lex:DeleteSession",
                "lex:RecognizeText",
                "lex:RecognizeUtterance",
                "lex:StartConversation"
            ],
            "Resource": "*"
        }
    ]
}