1

我正在开发一个带有AWS Lambda, API Gateway,的 REST API RDS (MySQL)。我正在使用该aws-sam工具来构建、配置我的工作并将其发布到云端。

template.yaml请检查我现在使用的以下文件。

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  aaaa-restapi

  Sample SAM Template for aaaa-restapi

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 100

Resources:
  GetAllAccountTypesLambda:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aaaa-restapi
      Handler: com.aaaa.dao.accountingtype.GetAllAccountTypesLambda::getAllAccountTypes
      Runtime: java11
      MemorySize: 1024
      Environment: # More info about Env Vars: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#environment-object
        Variables:
          PARAM1: VALUE
      Events:
        HelloWorld:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /accounttype
            Method: get

然而，为了让我的 lambda 函数能够找到数据库，我必须从 AWS Web 控制台启用一些策略。我点击了这个链接 - https://ao.ms/the-provided-execution-role-does-not-have-permissions-to-call-createnetworkinterface-on-ec2/

以下是我在 AWS Web 控制台中为我的 Lambda 函数创建的策略。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeNetworkInterfaces",
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface",
        "ec2:DescribeInstances",
        "ec2:AttachNetworkInterface"
      ],
      "Resource": "*"
    }
  ]
}

但是，从功能到功能，我无法在 Web 控制台中执行此操作。我需要在yaml文件中完成这项工作。

使用yaml上面提供的文件，我如何将这些权限赋予我的 Lambda 函数？

- - - - - - 更新 - - - - - - - -

根据 Gaurauv 的评论，我对文件进行了以下更改yaml。

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  aaaa-restapi

  Sample SAM Template for aaaa-restapi

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 100

Resources:
  GetAllAccountTypesLambda:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aaaa-restapi
      Handler: com.aaaa.dao.accountingtype.GetAllAccountTypesLambda::getAllAccountTypes
      Runtime: java11
      MemorySize: 1024
      Environment: # More info about Env Vars: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#environment-object
        Variables:
          PARAM1: VALUE
      Events:
        HelloWorld:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /accounttype
            Method: get
      Role: !GetAtt LambdaRole.Arn
  
  LambdaRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      Policies:
        - PolicyName: 'ec2-access-policy'
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeNetworkInterfaces
                  - ec2:CreateNetworkInterface
                  - ec2:DeleteNetworkInterface
                  - ec2:DescribeInstances
                  - ec2:AttachNetworkInterface
                Resource: '*'

但是它未能部署，产生了以下错误。

CREATE_FAILED                           AWS::IAM::Role                          LambdaRole                              Property AssumeRolePolicyDocument
                                                                                                                        cannot be empty.
4

2 回答 2

2

根据IAM::Role Resource，创建角色时需要 AssumeRolePolicyDocument。此属性管理与此角色关联的信任策略。信任策略定义了哪些实体可以担任该角色。您只能将一个信任策略与角色相关联。

请为您的用例查找更新的角色资源

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  LambdaRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ec2:DescribeNetworkInterfaces
                  - ec2:CreateNetworkInterface
                  - ec2:DeleteNetworkInterface
                  - ec2:DescribeInstances
                  - ec2:AttachNetworkInterface
                Resource: '*'
于 2021-07-16T15:52:32.820 回答
0

您可以使用内联策略将角色附加到 lambda 函数。像这样的东西

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  aaaa-restapi

  Sample SAM Template for aaaa-restapi

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 100

Resources:
  GetAllAccountTypesLambda:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aaaa-restapi
      Handler: com.aaaa.dao.accountingtype.GetAllAccountTypesLambda::getAllAccountTypes
      Runtime: java11
      MemorySize: 1024
      Environment: # More info about Env Vars: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#environment-object
        Variables:
          PARAM1: VALUE
      Events:
        HelloWorld:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /accounttype
            Method: get
      Role: !GetAtt LambdaRole.Arn



  LambdaRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
      Policies:
        - PolicyName: 's3-access-policy'
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetBucketLocation
                  - s3:GetBucketCORS
                  - s3:GetObjectVersionForReplication
                  - s3:GetObject
                  - s3:GetBucketTagging
                  - s3:GetObjectVersion
                  - s3:GetObjectTagging
                  - s3:ListMultipartUploadParts
                  - s3:ListBucket
                  - s3:ListBucketMultipartUploads
                  - s3:PutObject
                  - s3:PutObjectTagging
                  - s3:DeleteObject
                Resource: '*'
于 2021-07-16T13:44:51.657 回答