如何在SAM模板中创建IAM角色,就像我在SAM包中一样。 我尝试了如下:
"lambdaFunctionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"lambda.amazonaws.com",
"apigateway.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
}
]
},
"ManagedPolicyArns": [
{
"Ref": "lambdaBasePolicy"
}
],
"Policies": [
{
"PolicyName": "root",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:*"
},
{
"Effect": "Allow",
"Action": [
"s3:*",
"dynamodb:*",
"iam:ListRoles",
"ses:*",
"events:*"
],
"Resource": "*"
}
]
}
}
]
}
}
它抛出了一个错误:com.amazonaws.serverlessappsrepo.template.InvalidTemplateException:名称为[lambdaFunctionRole]的资源无效。 AWS :: Serverless :: Role不是受支持的无服务器应用程序存储库类型。
答案 0 :(得分:1)
发布到无服务器应用仓库时,您需要注意在SAM模板中仅使用supported resources。
对于您而言,您可以跳过将lambdaFunctionRole
创建为独立资源,而直接在函数资源定义中内联创建。</ p>
"lambdaFunction": {
"Type": "AWS::Serverless::Function",
"Policies": [
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:*"
},
{
"Effect": "Allow",
"Action": [
"s3:*",
"dynamodb:*",
"iam:ListRoles",
"ses:*",
"events:*"
],
"Resource": "*"
}
]
}
]
}
请注意,我仅复制了角色中“策略”的PolicyDocument
部分。请参阅SAM spec中的“策略”部分。