来自serverless.yml中的引用函数 [英] Reference function from within serverless.yml

问题描述

我有几个运行的AWS lambda，由 Serverless Framework 支持.我需要一个lambda(称为lambdaOne)，它将使用AWS的javascript sdk调用第二个lambda(称为lambdaTwo).问题是，当我尝试执行此操作时，我得到了AccessDenied异常:

I have several AWS lambdas running, supported by the Serverless Framework. I need one lambda (called lambdaOne) which will call a second lambda (called lambdaTwo) using AWS' javascript sdk. The issue is that I am getting an AccessDenied Exception when I attempt this:

UnhandledPromiseRejectionWarning:未处理的承诺拒绝(拒绝ID:1): AccessDeniedException:用户:arn:aws:sts :: 12345678909876:assumed-role/test-dev-us-west-2-lambdaRole/test-dev-lambdaOne无权执行:lambda:调用资源上的函数:arn:aws :lambda:us-west-2:994979977450:function:test-dev-lambdaTwo

UnhandledPromiseRejectionWarning: Unhandled promise rejection (rejection id: 1): AccessDeniedException: User: arn:aws:sts::12345678909876:assumed-role/test-dev-us-west-2-lambdaRole/test-dev-lambdaOne is not authorized to perform: lambda:Invoke Function on resource: arn:aws:lambda:us-west-2:994979977450:function:test-dev-lambdaTwo

据我了解，无服务器创建了所有lambda函数的默认IAM 角色.因此，我应该只能在iamRoleStatements下添加一个新条目.

To my understanding, Serverless creates a default IAM role for all lambda functions. So, I should be able to just to add a new entry under iamRoleStatements.

我要引用的资源(lambdaTwo)已经定义为

My confusion arises from the fact that the resource I want to reference (lambdaTwo) is already defined as a function.

是否可以引用function作为资源?

Is there a way to reference a function as a resource?

推荐答案

当前，没有快捷方式来声明Lambda函数的权限.您需要根据其ARN授予权限.

Currently, there is no shortcut to declare permissions for a Lambda function. You need to give permissions based on its ARN.

下面是一个工作示例.

serverless.yml

service: test-invoke-function

provider:
  name: aws
  runtime: nodejs6.10
  region: us-east-1
  stage: dev
  environment:
    AWS_ACCOUNT: 1234567890 # use your own AWS ACCOUNT number here

    # define the ARN of the function that you want to invoke
    FUNCTION_ARN: "arn:aws:lambda:${self:provider.region}:${self:provider.environment.AWS_ACCOUNT}:function:${self:service}-${self:provider.stage}-lambdaTwo"  

functions:
  # lambdaOne will invoke lambdaTwo
  lambdaOne: 
    handler: handler.lambdaOne
    role: functionPermission # we'll define later in this file

  lambdaTwo:
    handler: handler.lambdaTwo

# define the IAM permissions of our Lambda function
resources:
  Resources:
    functionPermission:
      Type: AWS::IAM::Role
      Properties:
        RoleName: functionPermission
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: functionPermission
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: "Allow"
                  Action:
                    - "lambda:InvokeFunction"
                  Resource: "${self:provider.environment.FUNCTION_ARN}"

handler.js

const AWS = require('aws-sdk');

module.exports.lambdaOne = (event, context, callback) => {  
  const lambda = new AWS.Lambda();
  const params = {
    FunctionName: process.env.FUNCTION_ARN,
    Payload: JSON.stringify({ message: 'lambdaOne invoking lambdaTwo' })
  };

  // invoke lambdaTwo
  lambda.invoke(params, (err, data) => {
    if (err) {
      callback(err, null);
      return;
    }

    const response = {
      statusCode: 200,
      body: JSON.stringify({
        message: 'lambdaOne result',
        result: data
      })
    };

    callback(null, response);
  });
};

module.exports.lambdaTwo = (event, context, callback) => {  
  const response = {
    statusCode: 200,
    body: JSON.stringify({
      message: 'lambdaTwo result',
      data: event
    })
  };

  callback(null, response);
};

这篇关于来自serverless.yml中的引用函数的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！