因此,我遵循此link创建了一个lambda函数,该函数由tf中的s3事件触发。当我运行apply时,会不断出现以下错误:
module.elb_logs_to_es.aws_s3_bucket_notification.elb_logs_bucket: 1 error(s) occurred:
aws_s3_bucket_notification.elb_logs_bucket: Error putting S3 notification configuration: AccessDenied: Access Denied
这是我的配置:
resource "aws_lambda_function" "elb_logs_to_es" {
function_name = "send-elb-logs-to-es"
s3_bucket = "xxxxxxxxxxxx"
s3_key = "elb_logs_to_es/elb_to_es.zip"
handler = "elb_to_es.lambda_handler"
role = "${aws_iam_role.elb_logs_role.arn}"
runtime = "python3.6"
}
resource "aws_s3_bucket_notification" "elb_logs_bucket" {
bucket = "xxxxxxxxxxxx"
lambda_function {
lambda_function_arn = "${aws_lambda_function.elb_logs_to_es.arn}"
events = ["s3:ObjectCreated:*"]
}
}
resource "aws_lambda_permission" "elb_bucket_access" {
statement_id = "AllowExecutionFromS3Bucket"
action = "lambda:InvokeFunction"
function_name = "${aws_lambda_function.elb_logs_to_es.arn}"
principal = "s3.amazonaws.com"
source_arn = "arn:aws:s3:::xxxxxxxxxxxx"
}
resource "aws_iam_role" "elb_logs_role" {
name = "elb_logs_sending_role"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Effect": "Allow"
}
]
}
EOF
}
我也尝试过手动更改存储桶策略,以允许在其中放置PutObject角色,但仍然没有。有什么想法吗?