InvalidParameterValueException:无法访问流 [英] InvalidParameterValueException: Cannot access stream

问题描述

我正在尝试使用 Terraform 创建一个 dynamodb 表和 lambda 触发器.这就是我定义表、角色策略和 lambda 触发器的方式:

I am trying to create a dynamodb table and lambda trigger using Terraform. This is how I define the table, role policy and lambda trigger:

resource "aws_dynamodb_table" "filenames" {
  name           = local.dynamodb_table_filenames
  billing_mode   = "PROVISIONED"
  read_capacity  = 1000
  write_capacity = 1000
  hash_key       = "filename"
  stream_enabled = true
  stream_view_type = "NEW_IMAGE"

  #range_key      = ""

  attribute {
    name = "filename"
    type = "S"
  }

  tags = var.tags
}

resource "aws_iam_role_policy" "dynamodb_policy" {
  policy = jsonencode(
  {
    Version: "2012-10-17",
    Statement: [
      {
        Action: [
          "dynamodb:GetItem",
          "dynamodb:PutItem",
          "dynamodb:UpdateItem",
          "dynamodb:Query",
          "dynamodb:GetRecords",
          "dynamodb:GetShardIterator",
          "dynamodb:DescribeStream",
          "dynamodb:ListShards",
          "dynamodb:ListStreams",
        ],
        Effect: "Allow",
        Resource: aws_dynamodb_table.filenames.arn
      }
    ]
  }
  )
  role = aws_iam_role.processing_lambda_role.id
}

resource "aws_lambda_event_source_mapping" "allow_dynamodb_table_to_trigger_lambda" {
  event_source_arn  = aws_dynamodb_table.filenames.stream_arn
  function_name     = aws_lambda_function.trigger_stepfunction_lambda.arn
  starting_position = "LATEST"
}

即使我已经添加了角色中添加的相关策略，我仍然收到此错误:

I am getting this error even though I have already added the relevant policies added in the role:

error creating Lambda Event Source Mapping (arn:aws:dynamodb:eu-central-12:table/tablename/stream): InvalidParameterValueException: Cannot access stream arn:aws:dynamodb:eu-central-1:299093934558:table/4tablename/stream. Please ensure the role can perform the GetRecords, GetShardIterator, DescribeStream, ListShards, and ListStreams Actions on your stream in IAM.

我该如何解决这个问题?

How can I fix this?

推荐答案

流操作适用于流，而不适用于表.流的 ARN 具有 表单 的:

The stream actions apply to streams, not to tables. The ARN for stream has the form of:

arn:${Partition}:dynamodb:${Region}:${Account}:table/${TableName}/stream/${StreamLabel}

因此，您应该使用(或等效的东西):

Thus, you should use (or something equivalent):

Resource: "${aws_dynamodb_table.filenames.arn}/stream/*"

或更笼统地说:

Resource: "${aws_dynamodb_table.filenames.arn}/*"

这篇关于InvalidParameterValueException:无法访问流的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！