AWS Lambda S3.getObject抛出“拒绝访问”,但仅在本地运行时抛出

我正在使用 AWS Lambda 和 serverless 用于构建使用 S3
lambda函数(“ hello )在部署到云时工作得非常好(它有一个http端点,我从浏览器调用它)。
serverless invoke local --function hello )我收到“拒绝访问”错误:

{
    "errorMessage": "error getting object from S3: AccessDenied: Access Denied",
    "errorType": "Error",
    "stackTrace": [
        "Error: error getting object from S3: AccessDenied: Access Denied",
        "    at module.exports.hello (/....js:24:9)",
        "    at processTicksAndRejections (internal/process/task_queues.js:93:5)"
    ]
}

这是我的简化功能:

'use strict';

const aws = require("aws-sdk");
const s3 = new aws.S3({ region: "eu-west-1" });
const bucket = "my-bucket-dev";
const key = "ads.json";

module.exports.hello = async (event) => {
  let obj = null;
  try {
    return await s3.getObject({ Bucket: bucket, Key: key }).promise();
  } catch(err) {
    throw new Error(`error getting object from S3: ${err}`);
  }
  return {
    statusCode: 200,
    body: JSON.stringify({
        message: `Hello function executed successfully!`,
        obj,
        input: event,
      },
      null,
      2
    ),
  };
}

这是我的无服务.yml(相关部分):

service: my-service
frameworkVersion: '2'  
provider:
  name: aws
  runtime: nodejs12.x
  profile: serverless
  lambdaHashingVersion: 20201221
  apiGateway:
    shouldStartNameWithService: true
  stage: ${opt:stage, "dev"}
  region: eu-west-1
  iam:
    role:
      statements:
        - Effect: "Allow"
          Action:
            - "s3:ListBucket"
          Resource: { "Fn::Join": [ "", [ "arn:aws:s3:::", "my-service-dev" ] ] }
        - Effect: "Allow"
          Action:
            - "s3:GetObject"
            - "s3:PutObject"
            - "s3:DeleteObject"
          Resource: { "Fn::Join": [ "", [ "arn:aws:s3:::", "my-service-dev", "/*" ] ] }
functions:
  hello:
    handler: index.hello
    events:
      - http:
          method: get
          path: hello
      - s3: my-bucket-dev

我确实在某个地方读到过,对于本地和云执行,IAM角色声明是不同的,但是如果它是正确的,我有点困惑。。。

serverless.yml