aws-lambda - AWS自动化文档不更新Lambda别名

Question

我使用云形成创建了一个自动化文档来更新给定函数的live别名。它运行正常，没有任何错误，我没有看到任何云踪迹。但是当我检查哪个版本设置为 alias:live 时，它保持不变。

模板.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "AWS CloudFormation Template for Response Plans"
Parameters:
  Environment:
    Type: String
    Default: "sandbox"
  Domain:
    Type: String
  Team:
    Type: String
  NotificationARN:
    Type: AWS::SSM::Parameter::Value<String>
Resources:
  ResponsePlan:
    Type: AWS::SSMIncidents::ResponsePlan
    Properties:
      Actions:
        - SsmAutomation:
            RoleArn: !GetAtt Role.Arn
            DocumentName: UpdateAliasDocument
      DisplayName: "UpdateLambdaAlias"
      IncidentTemplate:
        Impact: 3
        NotificationTargets:
          - SnsTopicArn:
              Ref: NotificationARN
        Summary: "String"
        Title: "String"
      Name: "UpdateLambdaAlias"
      Tags:
        - Key: "Team"
          Value: !Ref Team
        - Key: "Domain"
          Value: !Ref Domain
        - Key: "Environment"
          Value: !Ref Environment
  Document:
    Type: AWS::SSM::Document
    Properties:
      Content:
        schemaVersion: "2.2"
        parameters:
          FunctionVersion:
            type: "String"
            default: "1"
          FunctionName:
            type: "String"
        mainSteps:
          - name: "UpdateLambdaAlias"
            action: aws:runShellScript
            inputs:
              runCommand:
                - aws lambda update-alias --function-name {{FunctionName}} --name live --function-version {{FunctionVersion}}
      DocumentType: "Command"
      TargetType: /
      Tags:
        - Key: "Team"
          Value: !Ref Team
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: EC2Instances
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - ec2:*
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
        - PolicyName: UpdateAliasPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:UpdateFunctionConfiguration
                Resource:
                  - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${Environment}-*
  Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0c2b8ca1dad447f8a
      InstanceType: t2.micro
      Monitoring: true
      Tags:
        - Key: "Team"
          Value: !Ref Team

更新

看起来没有找到运行脚本的目标

Answer 1

您的Role条目似乎没有执行update-alias命令所需的权限。您的策略仅允许 lambda:UpdateFunctionConfiguration。

您至少还需要 lambda:UpdateAlias 权限。如果这还不够，您可以尝试对您的角色非常宽松，然后再减少权限。