错误更新堆栈以添加S3触发器 [英] Error Updating Stack to Add S3 Trigger

问题描述

我使用cloudformation堆栈成功创建了lambda函数和S3存储桶.然后，我对堆栈进行了更新，以向S3存储桶添加触发器以调用lambda函数.

I successfully created a lambda function and S3 bucket using a cloudformation stack. I then ran an update to the stack to add a trigger to the S3 bucket to invoke a lambda function.

运行更新时，出现以下错误:

When I run the update it's giving the following error:

Unable to validate the following destination configurations (Service: Amazon S3; Status Code: 400; Error Code: InvalidArgument; Request ID: XXXXX; S3 Extended Request ID: XXXXX

这是我用来将触发器添加到S3存储桶的更新JSON:

This is the update JSON I'm using to add the trigger to the S3 bucket:

   "MyBucket": {
        "Type": "AWS::S3::Bucket",
        "Properties": {
            "BucketName":  "my-bucket",
            "NotificationConfiguration": {
                "LambdaConfigurations": [
                    {
                        "Event": "s3:ObjectCreated:*",
                        "Function": "arn:aws:lambda:ap-southeast-2:my-lambda-arn"
                    }
                ]
            }

然后我添加了一个IAM角色，以授予对S3存储桶的访问权以调用lambda函数:

I then added an IAM role to give access to the S3 bucket to invoke a lambda function:

"ResourceAccess": {
    "Type": "AWS::IAM::Role",
    "Properties": {
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": [
                            "lambda.amazonaws.com"
                        ]
                    },
                    "Action": [
                        "sts:AssumeRole"
                    ]
                }
            ]
        },
        "Path": "/",
        "Policies": [
            {
                "PolicyName": "giveaccesstodeltas3",
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "s3.amazonaws.com"
                            },
                            "Action": "lambda:InvokeFunction",
                            "Resource": "arn:aws:lambda:ap-southeast-2:my-lambda-arn",
                            "Condition": {
                                "StringEquals": {
                                    "AWS:SourceAccount": "123456"
                                },
                                "ArnLike": {
                                    "AWS:SourceArn": "arn:aws:s3:::my-bucket"
                                }
                            }
                        }
                    ]
                }
            }
       ]
    }

出现错误提示:

Policy document should not specify a principal. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: XXXXXX)

推荐答案

为了添加此触发器，必须授予S3存储桶权限以调用lambda函数.此外，您的lambda必须有权调用它影响的任何服务.我的猜测是您缺少要提供的第一个权限: 允许您的S3存储桶调用lambda函数.

In order to add this trigger, you must give your S3 bucket permission to invoke the lambda function. In addition, your lambda must have permission to invoke whatever services it affects. My guess is you are missing the first permissions to give: permissions for your S3 bucket to invoke your lambda function.

您可以创建类似于以下内容的策略来为您的S3存储桶赋予适当的权限:

You can create a policy similar to the following to give the appropriate permissions to your S3 bucket:

{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "<optional>",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "<ArnToYourFunction>",
      "Condition": {
        "StringEquals": {
          "AWS:SourceAccount": "<YourAccountId>"
        },
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:s3:::<YourBucketName>"
        }
      }
    }
  ]
}

有关更多信息，请参见此AWS文档

See this AWS documentation for more info.

这篇关于错误更新堆栈以添加S3触发器的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！