aws-cloudformation - 无法执行 lambda 函数。确保您已授予 CloudWatch Logs 执行您的函数的权限

Question

我想根据日志组中的事件触发 lambda 函数。这是我的 cdk

    const glueLogGroup = new LogGroup(this, 'LogGroup', {
        logGroupName: '/aws-glue/crawlers'
    });
    const lambdaFunction = new lambda.Function(this, 'crawlerStatusMonitorFunction', {
        runtime: lambda.Runtime.NODEJS_12_X,
        handler: 'index.handler',
        code: lambda.Code.fromInline('exports.handler = (event, context, callback) => {\n' +
            '  // TODO implement\n' +
            '  callback(null, \'Hello from Lambda\');\n' +
            '};')
    });

    const lambdaPolicy = new PolicyStatement({
        effect: Effect.ALLOW,
        resources: ['*'],
        actions: ['*']
    });
    lambdaFunction.addToRolePolicy(lambdaPolicy);
   
    new lambda.CfnPermission(this, 'resourcePolicyForLambdaFunction', {
        action: 'lambda:InvokeFunction',
        principal: 'logs.us-east-1.amazonaws.com',
        functionName: lambdaFunction.functionName,
        sourceArn: `${glueLogGroup.logGroupArn}:*`,
        sourceAccount: accountId.valueAsString
    });
    glueLogGroup.addSubscriptionFilter('lambda', {
        destination: new eventTargets.LambdaFunction(lambdaFunction),
        filterPattern: FilterPattern.allEvents()
    });

这是上面 cdk 生成的 cloudformation 的 lambda 资源策略:

"resourcePolicyForLambdaFunction": {
  "Type": "AWS::Lambda::Permission",
  "Properties": {
    "Action": "lambda:InvokeFunction",
    "FunctionName": {
      "Ref": "crawlerStatusMonitorFunction78ACA584"
    },
    "Principal": "logs.us-east-1.amazonaws.com",
    "SourceAccount": {
      "Ref": "accountId"
    },
    "SourceArn": {
      "Fn::Join": [
        "",
        [
          {
            "Fn::GetAtt": [
              "LogGroupF5B46931",
              "Arn"
            ]
          },
          ":*"
        ]
      ]
    }
  }
}

每当我尝试从 cloudformation 创建堆栈时，都会收到此错误。

无法执行 lambda 函数。确保您已授予 CloudWatch Logs 执行您的函数的权限

Answer 1

我也遇到这个问题了。当我找到下面的主题时，这个问题就解决了。 https://github.com/aws/serverless-application-model/issues/315#issuecomment-371050286

函数名称应该是目标 arn，而不是函数名称。

new lambda.CfnPermission(this, 'resourcePolicyForLambdaFunction', {
    action: 'lambda:InvokeFunction',
    principal: 'logs.us-east-1.amazonaws.com',
    functionName: lambdaFunction.functionArn, <= Change to Function arn.
    sourceArn: `${glueLogGroup.logGroupArn}:*`,
    sourceAccount: accountId.valueAsString
});