Question

我使用cloudformation堆栈成功创建了lambda函数和S3存储桶。然后，我对堆栈进行了更新，以向S3存储桶添加触发器以调用lambda函数。

运行更新时，出现以下错误：

?ajax_filter=true&sort-by=recent&property_type=for-sale

这是我用来将触发器添加到S3存储桶的更新JSON：

Unable to validate the following destination configurations (Service: Amazon S3; Status Code: 400; Error Code: InvalidArgument; Request ID: XXXXX; S3 Extended Request ID: XXXXX

然后我添加了一个IAM角色，以授予对S3存储桶的访问权以调用lambda函数：

   "MyBucket": {
        "Type": "AWS::S3::Bucket",
        "Properties": {
            "BucketName":  "my-bucket",
            "NotificationConfiguration": {
                "LambdaConfigurations": [
                    {
                        "Event": "s3:ObjectCreated:*",
                        "Function": "arn:aws:lambda:ap-southeast-2:my-lambda-arn"
                    }
                ]
            }

出现错误提示：

"ResourceAccess": {
    "Type": "AWS::IAM::Role",
    "Properties": {
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": [
                            "lambda.amazonaws.com"
                        ]
                    },
                    "Action": [
                        "sts:AssumeRole"
                    ]
                }
            ]
        },
        "Path": "/",
        "Policies": [
            {
                "PolicyName": "giveaccesstodeltas3",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "s3.amazonaws.com"
                            },
                            "Action": "lambda:InvokeFunction",
                            "Resource": "arn:aws:lambda:ap-southeast-2:my-lambda-arn",
                            "Condition": {
                                "StringEquals": {
                                    "AWS:SourceAccount": "123456"
                                },
                                "ArnLike": {
                                    "AWS:SourceArn": "arn:aws:s3:::my-bucket"
                                }
                            }
                        }
                    ]
                }
            }
       ]
    }

Answer 1

为了添加此触发器，必须授予S3存储桶权限以调用lambda函数。此外，您的lambda必须有权调用它影响的任何服务。我的猜测是您缺少要提供的第一个权限： 允许您的S3存储桶调用lambda函数。

您可以创建类似于以下内容的策略来为您的S3存储桶赋予适当的权限：

{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "<optional>",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "<ArnToYourFunction>",
      "Condition": {
        "StringEquals": {
          "AWS:SourceAccount": "<YourAccountId>"
        },
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:s3:::<YourBucketName>"
        }
      }
    }
  ]
}

有关更多信息，请参见this AWS documentation。

错误更新堆栈以添加S3触发器

1 个答案: