AWS CloudFormation - 触发Lambda函数的规则事件失败

3
我尝试在CloudFormation中创建一个模板,其中一个Lambda函数由一个CloudWatch事件规则(每10分钟)触发。在CloudWatch图表中,我可以看到调用但也有所有失败的调用。我认为这是规则角色的问题,但我无法弄清楚它。
以下是我在CloudFormation设计器中可以看到的模板:enter image description here
{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Metadata": {
        "AWS::CloudFormation::Designer": {
            "d1498a15-7d12-4ec9-bba6-3ba163574a10": {
                "size": {
                    "width": 60,
                    "height": 60
                },
                "position": {
                    "x": 450,
                    "y": 90
                },
                "z": 1,
                "embeds": []
            },
            "afe4f2cd-0634-4114-8327-1ecf60933475": {
                "size": {
                    "width": 60,
                    "height": 60
                },
                "position": {
                    "x": 310,
                    "y": 90
                },
                "z": 1,
                "embeds": [],
                "isrelatedto": [
                    "d1498a15-7d12-4ec9-bba6-3ba163574a10"
                ]
            },
            "c7843bb1-3134-44e7-9463-f9054118e52b": {
                "size": {
                    "width": 60,
                    "height": 60
                },
                "position": {
                    "x": 150,
                    "y": 90
                },
                "z": 1,
                "embeds": [],
                "isrelatedto": [
                    "afe4f2cd-0634-4114-8327-1ecf60933475",
                    "40b5efaf-5cdd-449e-9155-177461dd4d8e"
                ]
            },
            "ef4c0b58-6bb9-46c2-a4b4-64260aa2b35d": {
                "size": {
                    "width": 60,
                    "height": 60
                },
                "position": {
                    "x": 310,
                    "y": -30
                },
                "z": 1,
                "embeds": []
            },
            "40b5efaf-5cdd-449e-9155-177461dd4d8e": {
                "size": {
                    "width": 60,
                    "height": 60
                },
                "position": {
                    "x": 310,
                    "y": -40
                },
                "z": 0,
                "embeds": [],
                "isrelatedto": [
                    "afe4f2cd-0634-4114-8327-1ecf60933475"
                ]
            }
        }
    },
    "Resources": {
        "IAMR3JNYX": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "lambda.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "ManagedPolicyArns": [
                    "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
                ],
                "Policies": [
                    {
                        "PolicyName": "s3BackupBucket",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:*"
                                    ],
                                    "Resource": {
                                        "Fn::Join": [
                                            "",
                                            [
                                                "*"
                                            ]
                                        ]
                                    }
                                },
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "s3:*"
                                    ],
                                    "Resource": {
                                        "Fn::Join": [
                                            "",
                                            [
                                                "*"
                                            ]
                                        ]
                                    }
                                },
                                {
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Effect": "Allow",
                                    "Resource": "arn:aws:logs:*:*:*"
                                }
                            ]
                        }
                    }
                ]
            },
            "Metadata": {
                "AWS::CloudFormation::Designer": {
                    "id": "d1498a15-7d12-4ec9-bba6-3ba163574a10"
                }
            }
        },
        "ER1SCU1": {
            "Type": "AWS::Events::Rule",
            "Properties": {
                "Description": "launch the lambda function every 10min",
                "Name": "eachDay",
                "ScheduleExpression": "cron(0/10 * ? * * *)",
                "State": "ENABLED",
                "RoleArn": {
                    "Fn::GetAtt": [
                        "IAMR25JO4",
                        "Arn"
                    ]
                },
                "Targets": [
                    {
                        "Arn": {
                            "Fn::GetAtt": [
                                "CreateBackUp",
                                "Arn"
                            ]
                        },
                        "Id": "CreateBackUp"
                    }
                ]
            },
            "Metadata": {
                "AWS::CloudFormation::Designer": {
                    "id": "c7843bb1-3134-44e7-9463-f9054118e52b"
                }
            }
        },
        "CreateBackUp": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Handler": "index.handler",
                "Runtime": "nodejs4.3",
                "Timeout": "76",
                "Role": {
                    "Fn::GetAtt": [
                        "IAMR3JNYX",
                        "Arn"
                    ]
                },
                "Code": {
                    "ZipFile": {
                        "Fn::Join": [
                            "",
                            [
                                "my function ..."
                            ]
                        ]
                    }
                }
            },
            "Metadata": {
                "AWS::CloudFormation::Designer": {
                    "id": "afe4f2cd-0634-4114-8327-1ecf60933475"
                }
            }
        },
        "IAMR25JO4": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "events.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "ManagedPolicyArns": [
                    "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
                ],
                "Policies": [
                    {
                        "PolicyName": "InvokeBackUpLambda",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": [
                                        "lambda:*"
                                    ],
                                    "Resource": {
                                        "Fn::GetAtt": [
                                            "CreateBackUp",
                                            "Arn"
                                        ]
                                    }
                                },
                                {
                                    "Action": [
                                        "logs:CreateLogGroup",
                                        "logs:CreateLogStream",
                                        "logs:PutLogEvents"
                                    ],
                                    "Effect": "Allow",
                                    "Resource": "arn:aws:logs:*:*:*"
                                }
                            ]
                        }
                    }
                ]
            },
            "Metadata": {
                "AWS::CloudFormation::Designer": {
                    "id": "40b5efaf-5cdd-449e-9155-177461dd4d8e"
                }
            }
        }
    }
}

确切的错误信息是什么?调用可能会因为您的节点代码而失败 - 您可以创建一个“hello world”函数并确保它有效,然后将其插入模板中,看看会发生什么。 - Raf
我的函数应该没问题,因为我已经手动创建了与同一函数和规则相关联的事件。我看不到错误消息...当我创建cloudformation堆栈时,我尝试测试函数,它可以工作(从一个存储桶复制一个文件到另一个存储桶)。 - DionysoSong
Lambda 没有错误日志,我刚刚看了一下,这只能是来自触发器、事件或规则吗? - DionysoSong
1个回答

8

时间有点晚了,但基本问题是您缺少 AWS::Lambda:Permission 条目。您需要创建一个允许事件规则调用lambda的条目,如下所示(我更喜欢yaml,但你明白我的意思):

LambdaInvokePermission:
  Type: "AWS::Lambda::Permission"
  Properties:
    FunctionName: !GetAtt
      - CreateBackUp
      - Arn
    Action: 'lambda:InvokeFunction'
    Principal: events.amazonaws.com
    SourceArn: !GetAtt
      - ER1SCU1
      - Arn

1
我对何时使用权限和角色感到困惑。最初,我尝试创建一个带有允许调用我的 Lambda 函数的策略的角色,并将该角色分配给 events.amazonaws.com 主体。但这并没有起作用,而您创建 Lambda 权限的解决方案确实有效。 - superlazy
@superlazy 无法更加混乱了。权限、角色、策略、文档、声明、主体、信任关系......在我看来都不能再糟糕了,如果能简化这种混乱,AWS 将会更容易使用50%,甚至还有一个权限模拟器,它说得出所有的话。 - Francisco Albert

网页内容由stack overflow 提供, 点击上面的
可以查看英文原文,
原文链接