Question

我正在尝试为它自动创建lambda函数和cloudwatch规则。但是，似乎cloudwatchevent_rule ansible任务需要一个版本ID才能将自己附加到我的lambda函数。这导致错误：

No target to arn:aws:lambda:us-east-
1:MYACCOUNTID:function:MYFUNCTIONNAME could be found on the rule 
MYFUNCTIONNAME.

如何更改此设置，以便cloudwatch规则始终将自身附加到我的lambda函数的最新版本：

- name: create cloudwatch rule
  cloudwatchevent_rule:
    name: 'name_for_rule'
    region: "{{region}}"
    description: 'trigger on new instance creation'
    state: present
    event_pattern: |-
      {
        "detail-type": [
          "AWS API Call via CloudTrail"
        ],
        "detail": {
          "eventSource": [
            "ec2.amazonaws.com"
          ],
          "eventName": [
            "RunInstances"
          ]
        }
      }
    targets:
      - id: "{{ lambda.configuration.version }}"
        arn: "{{ lambda.configuration.function_arn }}"

Answer 1

我已经使用CloudWatch规则配置了一个Lambda函数来触发它。以下SAM模板还包含我需要的权限，策略和角色。如果不需要，请忽略它们。

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Transform": "AWS::Serverless-2016-10-31",
  "Description": "AWS SAM template configuring lambda functions written in test package.",
  "Resources": {
    "OrchestratorTestLambdaFunction": {
      "DependsOn": [
        "LambdaPolicy"
      ],
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Handler": "com.test.TestClass::orchestrateTestLambda",
        "FunctionName": "OrchestratorTestLambda",
        "Runtime": "java8",
        "MemorySize": 256,
        "Timeout": 60,
        "Code": {
          "S3Bucket": "BATS::SAM::CodeS3Bucket",
          "S3Key": "BATS::SAM::CodeS3Key"
        },
        "Role": {
          "Fn::GetAtt": [
            "LambdaRole",
            "Arn"
          ]
        },
        "Description": "Lambda reads from SQS provided in the cloud watch."
      }
    },
    "LambdaRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": "LambdaRole",
        "AssumeRolePolicyDocument": {
          "Version": "2008-10-17",
          "Statement": [
            {
              "Sid": "",
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        }
      }
    },
    "LambdaPolicy": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyName": "lambda_policy",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "",
              "Effect": "Allow",
              "Action": [
                "sqs:DeleteMessage",
                "sqs:ReceiveMessage"
              ],
              "Resource": [
                {
                  "Fn::Sub": "arn:aws:sqs:eu-west-1:${AWS::AccountId}:TestUpdates"
                }
              ]
            },
            {
              "Sid": "",
              "Action": [
                "lambda:InvokeAsync"
              ],
              "Effect": "Allow",
              "Resource": "*"
            },
            {
              "Sid": "",
              "Effect": "Allow",
              "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
              ],
              "Resource": "arn:aws:logs:*:*:*"
            }
          ]
        },
        "Roles": [
          {
            "Ref": "LambdaRole"
          }
        ]
      }
    },
    "PermissionForEventsToInvokeLambda": {
      "Type": "AWS::Lambda::Permission",
      "Properties": {
        "FunctionName": {
          "Ref": "OrchestratorTestLambdaFunction"
        },
        "Action": "lambda:InvokeFunction",
        "Principal": "events.amazonaws.com",
        "SourceArn": {
          "Fn::GetAtt": [
            "TestRule",
            "Arn"
          ]
        }
      }
    },
    "TestRule": {
      "Type": "AWS::Events::Rule",
      "Properties": {
        "Name": "TestRule",
        "Description": "Rule to Trigger OrchestratorTestLambdaFunction",
        "ScheduleExpression": "rate(1 minute)",
        "State": "ENABLED",
        "Targets": [
          {
            "Arn": {
              "Fn::GetAtt": [
                "OrchestratorTestLambdaFunction",
                "Arn"
              ]
            },
            "Id": "TestRuleV1",
            "Input": {
              "Fn::Sub": "{\"queueUrl\":\"https://sqs.eu-west-1.amazonaws.com/${AWS::AccountId}/TestUpdates\"}"
            }
          }
        ]
      }
    }
  },
  "Outputs": {
    "StackArn": {
      "Value": {
        "Ref": "AWS::StackId"
      },
      "Description": "Use this as the stack_arn in your cloud_formation_deployment_stack override."
    }
  }
}

Answer 2

我注意到从function_arn ansible模块输出注册的lambda不一致。

有时候是

"function_arn": "arn:aws:lambda:zone:account:function:name"

其他时间是：

"function_arn": "arn:aws:lambda:zone:account:function:name:version"

因此，我构造了arn，始终附加了$LATEST版本：

  - cloudwatchevent_rule:
      profile: "{{ aws_profile }}"
      name: StartStop
      schedule_expression: cron(* * * * ? *)
      description: trigger my lambda
      targets:
        - id: StartStop
          arn: "arn:aws:lambda:{{aws_zone}}:{{aws_account_id}}:function:{{lambdadeploy.configuration.function_name}}:$LATEST"

cloudwatchevent_rule默认为lambda函数的最新版本

2 个答案: