0

我正在尝试使用以下 template.yml 添加 dynamodb 流

MyFunc:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./myfunc
      Handler: main
      Runtime: go1.x
      Events:
        MyStream:
          Type: DynamoDB
          Properties:
            Stream: !GetAtt MyTable.StreamArn
            BatchSize: 1
            StartingPosition: LATEST
      Role:
        Fn::ImportValue:
          !Join ['-', [!Ref 'ProjectId', !Ref 'AWS::Region', 'LambdaTrustRole']]

但是，我在部署阶段收到以下错误：

Please ensure the role can perform the GetRecords, GetShardIterator, DescribeStream, and ListStreams Actions on your stream in IAM.

尝试 1

因此，我尝试通过将以下策略添加到我的 IAM CodeStarWorker-myproject-CloudFormation 来解决问题：

"dynamodb:GetRecords",
"dynamodb:GetShardIterator",
"dynamodb:DescribeStream",
"dynamodb:ListStreams",

那没有用，仍然给我同样的错误

尝试 2

尝试在 template.yml 中使用策略而不是角色

MyFunc:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./myfunc
      Handler: main
      Runtime: go1.x
      Events:
        MyStream:
          Type: DynamoDB
          Properties:
            Stream: !GetAtt MyTable.StreamArn
            BatchSize: 1
            StartingPosition: LATEST
      Policies: 
        - IAMFullAccess
        - AWSLambdaFullAccess

但它给了我以下错误

API: iam:CreateRole User: arn:aws:sts::xxx:assumed-role/CodeStarWorker-xxx-CloudFormation/AWSCloudFormation is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::xxx:role/awscodestar-xxx-lambda-MyFuncRole-1BO7G545IR5IC

尝试 3

在 template.yml 中指定角色

LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow #allow lambda to assume this role
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: LambdaRolePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow # allow to write logs to cloudwatch
              Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
              Resource: arn:aws:logs:*:*:*
            - Effect: Allow # allow lambda to read from the event stream
              Action:
              - dynamodb:DescribeStream
              - dynamodb:GetRecords
              - dynamodb:GetShardIterator
              - dynamodb:ListStreams
              Resource: "*"

并将其分配给 MyFunc

Role:
  Fn::GetAtt: [ LambdaRole , Arn ]

但是，它也给了我同样的错误，表明我无权执行iam:CreateRole

有什么帮助吗？

4

1 回答 1

0

iam:CreateRole - 您需要此操作来创建角色。您用于运行 Cloudformation 模板的用户需要包含“CreateRole”操作。

于 2018-02-15T08:22:33.507 回答