amazon-web-services - 云形成 : Invalid permissions on Lambda function

Question

我正在尝试仅使用 CloudFormation 创建一个 Api-Gateway 作为 Lambda 代理。尽管我已经仔细查看并似乎尝试了一切可能的方法，但在 Lambda 函数上获得正确的权限似乎存在问题，但我一无所获。关于一些重要小细节的文档似乎丢失了(或者我只是误解了它们？)。

这是我所拥有的:

    {
        "Description": "",
        "Parameters": {
            "IngressLambdaName": {
                "Type": "String",
                "Description": "Name of the lambda behind Api Gateway",
                "Default": "LambdaIngress"
            }
        },

        "Mappings": {

        },

        "Resources": {
            "ApiGatewayToLambdaRole": {
                "Type": "AWS::IAM::Role",
                "Properties": {
                    "AssumeRolePolicyDocument": {
                        "Version": "2012-10-17",
                        "Statement": [ {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [ "apigateway.amazonaws.com" ]
                            },
                            "Action": "sts:AssumeRole"
                        }]
                    },
                    "Policies": [{
                        "PolicyName": "ApiGatewayToLambdaPolicy",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [{
                                "Effect": "Allow",
                                "Action": [
                                    "lambda:InvokeFunction"
                                ],
                                "Resource": "*"
                            }]
                        }
                    }]
                }
            },

            "IngressLambda":{
                "Type": "AWS::Lambda::Function",
                "Properties": {
                    "Handler": "index.handler",
                    "FunctionName": {"Ref": "IngressLambdaName"},
                    "Runtime": "nodejs4.3",
                    "Role": { "Fn::GetAtt": ["**Role that isn't shown here**", "Arn"]},
                    "Code": {
                        "ZipFile": { "Fn::Join": ["", [
                            "exports.handler = function(event, context) {",
                    "  console.log('invoked the lambda!');",
                    "  context.succeed({statusCode: 200, headers: {}, body: JSON.stringify({message: 'invoked the lambda!'})});",
                    "};"
                        ]]}
                    }
                }

            },

            "IngressLambdaPermission":{
                "Type" : "AWS::Lambda::Permission",
                "Properties" : {
                    "Action" : "lambda:InvokeFunction",
                    "FunctionName" : { "Ref" : "IngressLambdaName"},
                    "Principal" : "apigateway.amazonaws.com",
                    "SourceArn" : {"Fn::Sub": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${RestApi}/*/POST/*"}
                },
                "DependsOn": ["IngressLambda"]
            },

            "RestApi": {
                "Type": "AWS::ApiGateway::RestApi",
                "Properties": {
                    "Name": "API Gateway"
                }
            },

            "TagModel": {
                "Type": "AWS::ApiGateway::Model",
                "Properties": {
                    "ContentType": "application/json",
                    "Name": "Tag",
                    "RestApiId": { "Ref": "RestApi" },
                    "Schema": {
                        "$schema": "http://json-schema.org/draft-04/schema#",
                        "title": "TagModel",
                        "type": "object",
                        "properties": {
                            "payload": {"type": "object"},
                            "domain": {"type": "string"}
                        }
                    }
                }
            },

            "TagsResource": {
                "Type": "AWS::ApiGateway::Resource",
                "Properties": {
                    "RestApiId": { "Ref": "RestApi" },
                    "ParentId": { "Fn::GetAtt": ["RestApi", "RootResourceId"] },
                    "PathPart": "tag"
                }
            },

            "TagsPost": {
                "Type": "AWS::ApiGateway::Method",
                "Properties": {
                    "ApiKeyRequired": "False",
                    "AuthorizationType": "NONE",
                    "HttpMethod": "POST",
                    "RestApiId": {"Ref": "RestApi"},
                    "ResourceId": { "Fn::GetAtt": ["RestApi", "RootResourceId"] },
                    "Integration": {
                        "Type": "AWS_PROXY",
                        "IntegrationHttpMethod": "POST",
                        "PassthroughBehavior": "NEVER", 
                        "Uri": {"Fn::Join" : ["", ["arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/", {"Fn::GetAtt": ["IngressLambda", "Arn"]}, "/invocations"]]}
                    }
                }
            },

            "RestApiDeployment": {
                "Type": "AWS::ApiGateway::Deployment",
                "Properties": {
                    "RestApiId": { "Ref": "RestApi" },
                    "StageName": "v1"
                },
                "DependsOn": ["RestApi", "TagModel", "TagsResource", "TagsPost"]
            },

        },

        "Outputs": {

        }

    }

在 AWS Web 门户控制台中的 API Gateway 中运行测试时，出现错误:由于配置错误而执行失败:Lambda 函数的权限无效

这让我抓狂。这里的任何方向都会很棒。我猜想我的权限在某种程度上是错误的，但我不确定如何(这是我与文档斗争的地方)。

Answer 1

与 wjordan 最近的评论类似，我认为源 arn 是问题所在。它应该是这样的格式:

arn:aws:execute-api:REGION:ACCOUNT_ID:API_ID/*/*/API_NAME

because this is how I execute the command with CLI:

aws lambda add-permission --function-name ${FUNCTION_ARN} --action "lambda:InvokeFunction" --statement-id 1 --principal apigateway.amazonaws.com --source-arn "arn:aws:execute-api:"${REGION}":"${ACCOUNT_ID}":"${API_ID}"/*/*/"${API_NAME}

我做了一些挖掘，这可能是因为您错过了帐户 ID。我正在根据 GitHub 上 Michael Wittig 的示例编辑我的答案: https://github.com/AWSinAction/apigateway/blob/master/template.json

你的:

"SourceArn": { "Fn::Join": ["", ["arn:aws:execute-api:us-west-2::", {"Fn::GetAtt": [ "RestApi", "RootResourceId"]}, "/null/POST"]]}

他的:

"SourceArn": {"Fn::Join": ["", ["arn:aws:execute-api:", {"Ref": "AWS::Region"}, ":", {"Ref": "AWS::AccountId"}, ":", {"Ref": "RestApi"}, "/*"]]}

注意他如何使用引用文献:

{"Ref": "AWS::AccountId"}

亚马逊表示，“某些资源的 ARN 不需要帐号，因此该组件可能会被省略。”但尚不清楚哪些需要，哪些不需要。

引用:http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html