amazon-web-services - 跨账户访问在CDK中调用AWS lambda

Question

这就是我向外部 AWS 账户授予对我的 lambda 调用权限的方式。

    myLambda.grantInvoke(new iam.AccountPrincipal('account_id_b'));

运行cdk部署

基于资源的策略具有以下 json，如控制台中所示

{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "generated_Sid",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::account_id_b:root"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "my_lambda_arn"
    }
  ]
}

我按照此处的步骤 https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-cross-account-lambda-integrations.html创建可以从 account_id_b 帐户调用此 lambda 的 API 网关。

从 account_id_b 测试 API 网关会产生以下日志:

Fri Mar 06 03:00:07 UTC 2020 : Execution failed due to configuration error: Invalid permissions on Lambda function
Fri Mar 06 03:00:07 UTC 2020 : Method completed with status: 500

我还需要做什么才能正确设置它？

Answer 1

该政策应采用以下形式:

{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "what-ever-sid",
      "Effect": "Allow",
      "Principal": {
        "Service": "apigateway.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "my_lambda_arn",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "api_gateway_arn"
        }
      }
    }
  ]
}

基本上，您在这里授予 api 网关服务调用您的函数的权限。该 API 可以与您的函数位于不同的帐户中。

为了测试和简单起见，您可以去掉Condition。

希望这有帮助。