无法为AWS中的Lambda函数设置S3触发器

Question

我在网上到处找解决办法。根据本教程，我一直在尝试设置一个AWS Lambda函数，以便在每次将文件上传到特定的S3 bucket时向SNS发送一条消息。此时，我已经设置了函数，并且可以成功地调用它。但是，当我尝试将函数连接到S3时，我得到一个错误，说明调用PutBucketNotification操作时发生错误（InvalidArgument）：无法验证以下目标配置。根据本文，我应该能够添加一个允许S3调用Lambda函数的权限，如下所示：

aws lambda add-permission \
    --function-name my-file-upload \
    --principal s3.amazonaws.com \
    --statement-id AcceptFromImport \
    --action "lambda:InvokeFunction" \
    --source-arn arn:aws:s3:::file-import \
    --source-account my_account_id

我这样做了，并注意到与Lambda函数关联的策略更新了，并且看起来是正确的。但是，错误仍然存在。我看过一个类似的问题，这里，但没有一个解决方案起作用。

执行角色arn:arn:aws:iam::my_account_id:Role/lambda-upload-stream

执行角色（lambda-upload-stream）信任关系：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

执行角色策略（my-file-upload）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AccessObject",
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::file-import/*"
        },
        {
            "Sid": "SendUpdate",
            "Effect": "Allow",
            "Action": "sns:Publish",
            "Resource": "arn:aws:sns:ap-northeast-1:my_account_id:comm-in"
        }
    ]
}

Lambda函数arn:arn:aws:Lambda:ap-northeast-1:my_account_id:function:my-file-upload

Lambda函数角色文档

{
  "roleName": "lambda-upload-stream",
  "policies": [
    {
      "name": "my-file-upload",
      "id": "AWS_ACCESS_KEY_ID",
      "type": "managed",
      "arn": "arn:aws:iam::my_account_id:policy/my-file-upload",
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "AccessObject",
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::file-import/*"
          },
          {
            "Sid": "SendUpdate",
            "Effect": "Allow",
            "Action": "sns:Publish",
            "Resource": "arn:aws:sns:ap-northeast-1:my_account_id:comm-in"
          }
        ]
      }
    }
  ],
  "resources": {
    "s3": {
      "service": {
        "name": "Amazon S3",
        "icon": "data:image/svg+xml;base64,very_long_base64_string1"
      },
      "statements": [
        {
          "resource": "arn:aws:s3:::file-import/*",
          "service": "s3",
          "effect": "Allow",
          "action": "s3:GetObject",
          "source": {
            "index": "AccessObject",
            "policyName": "my-file-upload",
            "policyType": "managed"
          }
        }
      ]
    },
    "sns": {
      "service": {
        "name": "Amazon SNS",
        "icon": "data:image/svg+xml;base64,very_long_base64_string2"
      },
      "statements": [
        {
          "resource": "arn:aws:sns:ap-northeast-1:my_account_id:comm-in",
          "service": "sns",
          "effect": "Allow",
          "action": "sns:Publish",
          "source": {
            "index": "SendUpdate",
            "policyName": "my-file-upload",
            "policyType": "managed"
          }
        }
      ]
    }
  },
  "trustedEntities": [
    "lambda.amazonaws.com"
  ]
}

Lambda函数资源策略：

{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:ap-northeast-1:my_account_id:function:my-file-upload",
      "Condition": {
        "StringEquals": {
          "AWS:SourceAccount": "my_account_id"
        },
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:s3:::file-import"
        }
      }
    }
  ]
}

我的问题是：我在这里做错了什么，我该如何修复它？

Answer 1

我弄明白问题出在哪里了。我最初的命令是：

aws s3api put-bucket-notification --bucket azure-erp-import \
    --notification-configuration "CloudFunctionConfiguration={Id=file-uploaded,Events=[],Event=s3:ObjectCreated:*,CloudFunction=arn:aws:lambda:ap-northeast-1:my_account_id:function:my-file-upload,InvocationRole=arn:aws:iam::my_account_id:role/lambda-upload-stream}"

此操作失败，因为arn:aws:iam::my_account_id:role/lambda-upload-stream角色没有权限对lambda函数调用lambda:invokefunction。删除此值修复了错误。

Answer 2

您需要创建的东西称为“基于资源的策略”，它应该由AWS lambda add-permission创建。

基于资源的策略授予S3调用lambda的权限。这是lambda本身的一个属性，不是lambda的IAM角色的一部分（lambda的IAM角色控制lambda可以做什么，基于资源的策略控制谁可以对lambda做什么。您可以在aws控制台的UI中查看此资源，方法是转到lambda，单击“权限”并向下滚动到“基于资源的策略”。您要注意的关键字是lambda:invokeFunction，它允许其他东西调用您的lambda，包括其他aws帐户和您帐户上的其他aws服务（如s3)。

话虽如此，您运行的命令应该已经创建了此策略。运行该命令时，是否确保将my_account_id替换为实际帐户id？

此外，请确保将--source-arn ARN:aws:s3:::file-import替换为存储桶的实际ARN（我假设您必须创建一个具有不同名称的存储桶，因为s3存储桶必须具有全局唯一的名称，并且file-import几乎肯定已经使用了）