principal states.amazonaws.com 无权担任提供的角色 [英] principal states.amazonaws.com is not authorized to assume the provided role

问题描述

我使用 Terraform 创建了一个 AWS 步进函数.目前，step 函数目前只有 1 个 lambda 函数:

I created an AWS step function using Terraform. For now, the step function has only 1 lambda function for now:

resource "aws_iam_role_policy" "sfn_policy" {
  policy = jsonencode(
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
       "Resource": "*"
    },
    {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunction",
                "lambda:InvokeAsync"
            ],
            "Resource": "*"
    },
    {
            "Effect": "Allow",
             "Action": [ "states:StartExecution" ],
            "Resource": "*"
        }
  ]
}
  )
  role = aws_iam_role.processing_lambda_role.id
}


resource "aws_sfn_state_machine" "sfn_state_machine_zip_files" {
  name     = local.zip_files_step_function_name
  role_arn = aws_iam_role.processing_lambda_role.arn

  definition = <<EOF
{
  "Comment": "Process Incoming Zip Files",
  "StartAt": "ProcessIncomingZipFiles",
  "States": {
    "ProcessIncomingZipFiles": {
      "Type": "Task",
      "Resource": "${aws_lambda_function.process_zip_files_lambda.arn}",
      "ResultPath": "$.Output",
      "End": true
    }
  }
}
EOF
}

这是最初定义角色的方式:

This is how the role is initially defined:

resource "aws_iam_role" "processing_lambda_role" {
  name = local.name
  path = "/service-role/"

  assume_role_policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { Service = "lambda.amazonaws.com" }
        Action    = "sts:AssumeRole"
      }
    ]
  })
}

为什么即使策略已经包含 AssumeRole 策略，我也会收到此错误消息.我还尝试删除 sts:AssumeRole策略之一，但错误仍然存​​在.

Why do I get this error message even though the policies include the AssumeRole policy already. I also tried removing one of the sts:AssumeRolepolicies but the error was still there.

"Neither the global service principal states.amazonaws.com, nor the regional one is authorized to assume the provided role."

AWS 文档参考:https://aws.amazon.com/premiumsupport/knowledge-center/step-functions-iam-role-troubleshooting/

推荐答案

角色 aws_iam_role.processing_lambda_role 只能由 lambda 函数承担.因此，您的 aws_sfn_state_machine.sfn_state_machine_zip_files 不能担任此角色.您必须将角色中的 Principal 更改为:

The role aws_iam_role.processing_lambda_role can be only assumed by a lambda function. So, your aws_sfn_state_machine.sfn_state_machine_zip_files can't assume this role. You have to change the Principal in the role from:

Principal = { Service = "lambda.amazonaws.com" }

进入

Principal = { Service = "states.amazonaws.com" }

您可能还有其他问题，具体取决于您想要做什么.但是您报告的错误是由于我提到的.

You still may have other issues, depending on what you want to do exactly. But your reported error is due to what I mentioned.

这篇关于principal states.amazonaws.com 无权担任提供的角色的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！