Question

我的认知资源上有一个Lambda触发器，用于预注册触发器。

我正在关注这个例子 https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.html#aws-lambda-triggers-pre-registration-example

我正在收到套接字超时，并且没有找到太多关于此的文档

{
    "err": {
        "code": "UnexpectedLambdaException",
        "name": "UnexpectedLambdaException",
        "message": "arn:aws:lambda:region-arn:function:confirm failed with error Socket timeout while invoking Lambda function."
    }
}

我的资源定义如下：

"ConfirmPermission" : {
    "Type" : "AWS::Lambda::Permission",
    "Properties" : {
        "Action" : "lambda:InvokeFunction",
        "FunctionName" : { "Fn::GetAtt" : [ "confirm", "Arn" ] },
        "Principal" : "cognito-idp.amazonaws.com",
        "SourceArn" : { "Fn::GetAtt" : [ "Auth", "Arn" ] }
        }
},
"confirm" : {
    "Type": "AWS::Serverless::Function",
    "Properties": {
        "Handler": "index.confirm",
        "Runtime": "nodejs8.10",
        "CodeUri": "./src",
        "FunctionName": "confirm",
        "ReservedConcurrentExecutions" : 15,
        "Timeout": 50,
        "Role": "arn:aws:iam::arn:role/lambda-vpc-role"
    }
},
"AuthApp" : {
    "Type" : "AWS::Cognito::UserPoolClient",
    "Properties" : {
        "UserPoolId" : {"Ref" : "Auth"}
    }
},
"Auth" : {
    "Type" : "AWS::Cognito::UserPool",
    "Properties": {
        "LambdaConfig" : {
            "PreSignUp" :  { "Fn::GetAtt" : [ "confirm", "Arn" ] }
        },
        "Schema" : [
            {
                "AttributeDataType": "String",
                "Name": "email",
                "Mutable": true,
                "Required": true
            },
            {
                "AttributeDataType": "String",
                "Name": "family_name",
                "Mutable": true,
                "Required": true
            },
            {
                "AttributeDataType": "String",
                "Name": "given_name",
                "Mutable": true,
                "Required": true
            }
        ],
        "UsernameAttributes": ["email"]
    }
}

Lambda函数：

index.js

let signIn = require('Auth/Auth.js');
exports.signIn = signIn.signIn;
exports.signUp = signIn.signUp;
exports.confirm = signIn.confirm;

注册/确认

exports.signUp = async (event, context) => {
    var body = JSON.parse(event.body);
    var emailAttribute = {
        Name : 'email',
        Value: body.email
    };
    var firstNameAttribute = {
        Name: 'given_name',
        Value: body.firstName
    };
    var lastNameAttribute = {
        Name: 'family_name',
        Value: body.lastName
    };

    var attributeList = [emailAttribute, firstNameAttribute, lastNameAttribute];
    try {
        var cognitoUser = await cognitoSignUp(body, attributeList);
        return {
            statusCode : 200,
            body : JSON.stringify({res : cognitoUser})
        };
    } catch(e) {
        return {
            statusCode : 500,
            body : JSON.stringify({err : e})
        };
    }
}

exports.confirm = (event, context, callback) => {
    event.response.autoConfirmUser = true;
    callback(null, event);
    return;
}

var cognitoSignUp = (body, attributeList) => new Promise((acc, rej) => {
    userPool.signUp(body.email, body.password, attributeList, null, function(err, res) {
        if (err) {
            console.log('ERROR');
            console.log(err);
            rej(err);
        } else {
            console.log('SUCCSSS');
            acc(res);
        }
    });
});

是什么原因引起的？

Answer 1

您可以将功能超时延长到15分钟900秒，如下所示...

"confirm" : {
    "Type": "AWS::Serverless::Function",
    "Properties": {
        "Handler": "index.confirm",
        "Runtime": "nodejs8.10",
        "CodeUri": "./src",
        "FunctionName": "confirm",
        "ReservedConcurrentExecutions" : 15,
        "Timeout": 900,
        "Role": "arn:aws:iam::arn:role/lambda-vpc-role"
    }
},

除非您要编码运行某些长时间分析的内容，否则可能甚至不需要50秒，更不用说15分钟了。您应该检查日志中是否有错误，并确保正在致电...

callback(null, event);

从Lambda返回响应。

Answer 2

事实证明，这是因为确认功能对aws资源具有IAM角色，从而阻止了网络请求。我不需要此功能上的IAM角色。删除后，它可以正常工作。如果您确实需要资源访问权限，则必须使用nat网关

在此处查看更多信息：

AWS Lambda can't call Cognito Identity - IAM Role

https://gist.github.com/reggi/dc5f2620b7b4f515e68e46255ac042a7

Cognito Lambda触发套接字超时

2 个答案: