Python AWS安全中心BatchImportFindings API:AccessDeniedException，即使用户具有适当的策略和角色

我想通过一个外部Python脚本将安全性发现吸收到AWS安全中心。为此，我使用以下API：

我编写了一个简单的python脚本，用于将批量导入结果导入AWS security hub，如下所示：

import boto3

client = boto3.client('securityhub', 
                        region_name='us-east-2',
                        aws_access_key_id='API_KEY',
                        aws_secret_access_key='API_SECRET')
response = client.batch_import_findings(finding_obj)

但这是以下错误：

Traceback (most recent call last):
  File "aws_hub.py", line 504, in <module>
    'Status': 'NEW',
  File "C:\Users\Aspire5\AppData\Local\Programs\Python\Python36-32\lib\site-packages\botocore\client.py", line 316, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "C:\Users\Aspire5\AppData\Local\Programs\Python\Python36-32\lib\site-packages\botocore\client.py", line 635, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the BatchImportFindings operation: User: arn:aws:iam::355025806062:user/Kaushal is not authorized to perform: securityhub:BatchImportFindings

我还尝试用AWS提供的模拟器模拟相同的策略，根据这一点，我的用户可以访问此操作，但通过API调用失败。以下是模拟器的屏幕截图：

Kaushal28

您的发现对象可能有错误的产品。\n

ProductARN的设置应如下所示：

productArn = "arn:aws:securityhub:"+ AWS_REGION +":" + ACCOUNT_ID +":product/" + ACCOUNT_ID +"/default"

productArn = "arn:aws:securityhub:"+ AWS_REGION +":" + ACCOUNT_ID +":product/" + ACCOUNT_ID +"/default"