amazon-web-services - 资源之间的循环依赖 AWS::S3/LAMBDA

Question

描述:将 AWS::Serverless::Function 定义为 AWS::S3::Bucket 的触发器时，目前无法使用受限访问的 SAM 预定义策略。

例如，让我们看一下以下模板:

Resources:

  BlobsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "blobs-${AWS::AccountId}-${AWS::Region}"


  ProcessBlobFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: blobsprjct/
      Handler: processBlob.lambda_handler
      Runtime: python3.8
      Policies:
        - S3ReadPolicy:
            BucketName: !Sub "blobs-${AWS::AccountId}-${AWS::Region}"
        - AmazonRekognitionFullAccess
      Events:
        BlobsBucket:
          Type: S3
          Properties:
            Bucket: !Ref BlobsBucket
            Events: s3:ObjectCreated:*

这将失败:

Error: Failed to create changeset for the stack: blob, ex: WaiterChangeSetCreateComplete failed: Waiter encountered a terminal failurestate: For expression "Status" we matched expected path: "FAILED"Status: FAILED. Reason: Circular dependency between resources:[ProcessBlobFunction, ProcessBlobFunctionBlobsBucketPermission,BlobsBucket]

所有资源都说要设置 BucketName - 我已经有了它，我还添加了权限(不确定是否需要，导致错误保持更大的 1 点)

  AllowS3ToCallLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !Ref ProcessBlobFunction
      Principal: s3.amazonaws.com
      SourceArn: !GetAtt BlobsBucket.Arn

这将会失败:

Error: Failed to create changeset for the stack: blob, ex: WaiterChangeSetCreateComplete failed: Waiter encountered a terminal failurestate: For expression "Status" we matched expected path: "FAILED"Status: FAILED. Reason: Circular dependency between resources:[ProcessBlobFunction, ProcessBlobFunctionBlobsBucketPermission,AllowS3ToCallLambdaPermission, BlobsBucket]

我被困了很长时间找不到解决方案。

Answer 1

不要在函数中使用!Ref BlobsBucket。您的存储桶具有固定且预定义的名称。因此请使用名称:

Bucket: !Sub "blobs-${AWS::AccountId}-${AWS::Region}"

权限中的存储桶 ARN 也是如此。另外，您可以添加DependsOn强制资源创建的正确顺序。