amazon-web-services - 未知错误，没有消息，CF 模板在逻辑上不适用于我的自动 s3 存储桶测试

Question

我的模板是:

Resources:
  LambdaFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      Code:
        ZipFile: |
          import json
          import boto3

          s3 = boto3.client('s3')

          def lambda_handler(event, context):
            # Get bucket name from the S3 event
            print(event)

            bucket_name = event['detail']['requestParameters']['bucketName']

            # Create a bucket policy
            bucket_policy =json.dumps({
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Sid": "MustBeEncryptedAtRest",
                  "Effect": "Deny",
                  "Principal": "*",
                  "Action": "s3:PutObject",
                  "Resource": [
                    "arn:aws:s3:::{}".format(bucket_name),
                    "arn:aws:s3:::{}/*".format(bucket_name)
                  ],
                  "Condition": {
                    "StringNotEquals": {
                      "s3:x-amz-server-side-encryption": [
                        AES256
                        "aws:kms"
                      ]
                    }
                  }
                },
                {
                  "Sid": "MustBeEncryptedInTransit",
                  "Effect": "Deny",
                  "Principal": "*",
                  "Action": "s3:*",
                  "Resource": [
                    "arn:aws:s3:::{}".format(bucket_name),
                    "arn:aws:s3:::{}/*".format(bucket_name)
                  ],
                  "Condition": {
                    "Bool": {
                      "aws:SecureTransport": "false"
                      }
                  }
                } ] })


            # Set the new policy
            s3.put_bucket_policy(Bucket=bucket_name, Policy=bucket_policy),
      Handler: index.lambda_handler
      Role: 'arn:aws:iam::role'
      Runtime: python3.7
  EventRule:
    Type: 'AWS::Events::Rule'
    Properties:
      EventPattern:
        source:
          - aws.s3
        detail-type:
          - AWS API Call via CloudTrail
        detail:
          eventSource:
            - s3.amazonaws.com
          eventName:
            - CreateBucket

这成功创建了 lambda 函数以及事件桥事件，我必须手动添加事件桥的触发器，但当我创建 s3 存储桶时，没有策略。我没有看到任何错误引用，目前我找不到任何逻辑错误。这是我用上面的模板创建的堆栈上的。有什么想法吗？

Answer 1

调查此问题的最佳方法是通过 CloudWatch。

首先检查 Lambda 所在区域的 CloudWatch 日志。这将识别 Lambda 函数的任何问题，例如:

• IAM 缺少您角色的权限
• Python 解析错误(语法无效)

如果没有日志，请检查 CloudWatch 指标以确保正在调用该函数。如果不是，则事件不会触发。

此外，要将 Lambda 自动添加为触发器，您需要将其包含为 target模板中的 CloudWatch 事件规则。

以下大致是您需要的模板。

Resources:
  LambdaFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      Code:
        ZipFile: |
          import json
          import boto3

          s3 = boto3.client('s3')

          def lambda_handler(event, context):
            # Get bucket name from the S3 event
            print(event)

            bucket_name = event['detail']['requestParameters']['bucketName']

            # Create a bucket policy
            bucket_policy =json.dumps({
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Sid": "MustBeEncryptedAtRest",
                  "Effect": "Deny",
                  "Principal": "*",
                  "Action": "s3:PutObject",
                  "Resource": [
                    "arn:aws:s3:::{}".format(bucket_name),
                    "arn:aws:s3:::{}/*".format(bucket_name)
                  ],
                  "Condition": {
                    "StringNotEquals": {
                      "s3:x-amz-server-side-encryption": [
                        AES256
                        "aws:kms"
                      ]
                    }
                  }
                },
                {
                  "Sid": "MustBeEncryptedInTransit",
                  "Effect": "Deny",
                  "Principal": "*",
                  "Action": "s3:*",
                  "Resource": [
                    "arn:aws:s3:::{}".format(bucket_name),
                    "arn:aws:s3:::{}/*".format(bucket_name)
                  ],
                  "Condition": {
                    "Bool": {
                      "aws:SecureTransport": "false"
                      }
                  }
                } ] })


            # Set the new policy
            s3.put_bucket_policy(Bucket=bucket_name, Policy=bucket_policy),
      Handler: index.lambda_handler
      Role: 'arn:aws:iam::role'
      Runtime: python3.7
  EventRule:
    Type: 'AWS::Events::Rule'
    Properties:
      EventPattern:
        source:
          - aws.s3
        detail-type:
          - AWS API Call via CloudTrail
        detail:
          eventSource:
            - s3.amazonaws.com
          eventName:
            - CreateBucket
      Targets:
        - 
          Arn: !GetAtt LambdaFunction.Arn
          Id: "TargetFunctionV1"
  PermissionForEventsToInvokeLambda: 
    Type: AWS::Lambda::Permission
    Properties: 
      FunctionName: 
        Ref: "LambdaFunction"
      Action: "lambda:InvokeFunction"
      Principal: "events.amazonaws.com"
      SourceArn: !GetAtt EventRule.Arn