amazon-web-services - 如何从 lambda 正确调用另一个帐户中的 lambda 函数？

Question

我在从账户 A 中的不同 lambda 调用账户 B 中的 lambda 时遇到问题。

账户 A 的角色 arn 为 arn:aws:iam::ACCOUNT_A:role/DeviceApiStack-simServiceRole427DA44E-1WS2T3INIV6IP

账户 A 的角色名称为 DeviceApiStack-simServiceRole427DA44E-1WS2T3INIV6IP

账户 B 的角色名称为 Chris-APIStack1-Q6AJ1PZ8V-LambdaCrossAccountExecut-1N3JU88L5AON1

账户 B 的角色 arn 为 arn:aws:lambda:us-east-1:462087996972:function:GetActiveDeviceIdsLambdaChris

对于帐户 A，我的 lambda 角色具有以下权限:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::ACCOUNT_B:role/Chris-APIStack1-Q6AJ1PZ8V-LambdaCrossAccountExecut-1N3JU88L5AON1",
            "Effect": "Allow"
        },
        {
            "Action": "lambda:InvokeFunction",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "lambda:InvokeFunction",
            "Resource": "arn:aws:iam::ACCOUNT_B:role/Chris-APIStack1-Q6AJ1PZ8V-LambdaCrossAccountExecut-1N3JU88L5AON1",
            "Effect": "Allow"
        }
    ]
}

账户 B 中的 lambda 具有使用 cloudformation 定义的以下角色:

    "CrossAccountExecutionRoleDemo": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:sts::ACCOUNT_A:role/DeviceApiStack-simServiceRole427DA44E-1WS2T3INIV6IP"
              },
              "Action": "sts:AssumeRole"
            },
            {
              "Effect": "Allow",
              "Principal": { "Service": ["lambda.amazonaws.com"] },
              "Action": ["sts:AssumeRole"]
            }
          ]
        }
      }
    },
    "CrossAccountExecutionPolicyDemo": {
      "Type": "AWS::IAM::ManagedPolicy",
      "Properties": {
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "lambda:InvokeFunction",
              "Resource": { "Fn::GetAtt": ["GetActiveDeviceIdsLambdaDemo", "Arn"] }
            }
          ]
        },
        "Roles": [
          {
            "Ref": "CrossAccountExecutionRoleDemo"
          }
        ]
      }
    }

当我发出以下请求时，出现错误

let roleArn = 'arn:aws:iam::ACCOUNT_B:role/Chris-APIStack1-Q6AJ1PZ8V-CrossAccountExecutionRol-1ANKXFZ6YS23'
sts.assumeRole(
      {
        RoleArn: roleArn,
        RoleSessionName: 'NightlySimService',
      }, function(err, res){ ... }

错误:

'AccessDenied:用户:arn:aws:sts::ACCOUNT_A:assumed-role/DeviceApiStack-simServiceRole427DA44E-1WS2T3INIV6IP/DeviceApiStack-nightlySimServiceLambdaA51B2AFE-JSUFU8F5BZGC 无权对资源执行:sts:AssumeRole:arn:aws:iam::ACCOUNT_B:role/Chris-APIStack1-Q6AJ1PZ8V-CrossAccountExecutionRol-1ANKXFZ6YS23F'

Answer 1

我可以在角色中发现两个明显的问题，这可能是导致您错误的原因。

首先。 错误原则:

  "Principal": {
      "AWS": "arn:aws:sts::ACCOUNT_A:role/DeviceApiStack-simServiceRole427DA44E-1WS2T3INIV6IP"
   },

正如您所写，角色 arn 是 arn:aws:iam::ACCOUNT_A:role/DeviceApiStack-simServiceRole427DA44E-1WS2T3INIV6IP ，这与您在 Principal 中提供的内容不匹配.

第二。 资源不正确:

  {
     "Action": "lambda:InvokeFunction",
     "Resource": "arn:aws:iam::ACCOUNT_B:role/Chris-APIStack1-Q6AJ1PZ8V-LambdaCrossAccountExecut-1N3JU88L5AON1",
     "Effect": "Allow"
  }

行动lambda:InvokeFunction适用于 lambda 函数，不适用于 IAM 角色。因此，Resource应该是 lambda 的 ARN。

可能还有更多问题，但目前还不那么明显。