amazon-web-services - 由于权限问题，无法从 API Gateway 调用简单 Lambda

Question

我遇到了一个非常愚蠢的错误，我感觉很愚蠢:)经过多次尝试，我决定将我的问题减少到绝对最低限度，看看我是否可以尝试隔离我做错的事情。

以下是 CloudFormation 模板，其中:

• 创建 root 角色
• 创建将 CloudWatch 和 S3 权限附加到角色的策略
• 创建 API 网关
• 创建 GET 方法
• 创建 POST 方法
• 使用 NodeJS 中的内联代码创建一个简单的 Lambda
• 为 POST 方法创建权限以允许执行 Lambda。
• 创建阶段和 API 帐户

一切正常，没有错误，但是当我尝试执行 API Gateway POST 来测试与 Lambda 的通信时，出现错误:

Fri Jul 19 18:31:41 UTC 2019 : Endpoint request body after transformations: 
Fri Jul 19 18:31:41 UTC 2019 : Sending request to https://lambda.us-<REGION>.amazonaws.com/2015-03-31/functions/arn:aws:lambda:<REGION>:<ACCOUNT_REMOVED>:function:FileUpload/invocations
Fri Jul 19 18:31:41 UTC 2019 : Execution failed due to configuration error: Invalid permissions on Lambda function
Fri Jul 19 18:31:41 UTC 2019 : Method completed with status: 500

我已经阅读了很多教程、AWS 引用资料，并与我已经运行的其他 API 网关作为示例进行了比较，但没有骰子，我正在做一些非常愚蠢的事情，也许有人可以在我的 CloudFormation 模板中发现它。

非常感谢

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "AWS CloudFormation Template to create file server",
    "Parameters": {
        "Environment": {
            "Description": "Environment name",
            "Type": "String",
            "Default": "dev",
            "AllowedValues" : ["dev", "int", "stg", "prd"],
            "ConstraintDescription": "must be dev, int, stg or prd"
        },
        "deploymentVersion": {
            "Description": "Version of the lambda code",
            "Type": "String"
        }
    },
    "Resources": {
        "RootRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "RoleName": {"Fn::Join": ["", ["kepler-", {"Ref": "Environment"} ,"-keplerfiles-rootrole"]]},
                "AssumeRolePolicyDocument": {
                    "Version" : "2012-10-17",
                    "Statement": [ {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": [ "apigateway.amazonaws.com", "lambda.amazonaws.com" ]
                        },
                        "Action": [ "sts:AssumeRole" ]
                    } ]
                }
            }
        },
        "RolePolicies": {
            "Type": "AWS::IAM::Policy",
            "Properties": {
                "PolicyName": {"Fn::Join": ["", ["kepler-", {"Ref": "Environment"} ,"-keplerfiles-rootpolicy"]]},
                "PolicyDocument": {
                   "Version" : "2012-10-17",
                   "Statement": [ {
                      "Effect": "Allow",
                      "Action": [
                        "logs:CreateLogGroup",
                        "logs:CreateLogStream",
                        "logs:PutLogEvents",
                        "s3:*"
                        ],
                      "Resource": "*"
                    } ]
                },
                "Roles": [ { "Ref": "RootRole" } ]
            }
        },
        "FilesRestApi": {
            "Type": "AWS::ApiGateway::RestApi",
            "Properties": {
                "Name" : "Kepler-FileServer-Next",
                "Description" : "API used for uploading and downloading files from S3",
                "FailOnWarnings" : true
            }
        },
        "RootFileResource": {
            "Type": "AWS::ApiGateway::Resource",
            "Properties": {
                "RestApiId": {"Ref": "FilesRestApi"},
                "ParentId": {"Fn::GetAtt": ["FilesRestApi", "RootResourceId"]},
                "PathPart": "keplerfiles2"
            }
        },
        "FolderResource": {
            "Type": "AWS::ApiGateway::Resource",
            "Properties": {
                "RestApiId": {"Ref": "FilesRestApi"},
                "ParentId": {"Ref": "RootFileResource"},
                "PathPart": "{folder}"
            }
        },
        "ItemResource": {
            "Type": "AWS::ApiGateway::Resource",
            "Properties": {
                "RestApiId": {"Ref": "FilesRestApi"},
                "ParentId": {"Ref": "FolderResource"},
                "PathPart": "{item}"
            }
        },
        "FileGetMethod": {
            "Type": "AWS::ApiGateway::Method",
            "Properties": {
                "AuthorizationType": "NONE",
                "HttpMethod": "GET",
                "RequestParameters" : {
                    "method.request.path.item": false,
                    "method.request.path.folder": false
                },
                "Integration": {
                    "Credentials" : {"Fn::GetAtt": ["RootRole", "Arn"]},
                    "Type": "AWS",
                    "IntegrationHttpMethod": "GET",
                    "PassthroughBehavior": "WHEN_NO_MATCH",
                    "RequestParameters" : {
                        "integration.request.path.object": "method.request.path.item",
                        "integration.request.header.x-amz-acl": "'authenticated-read'",
                        "integration.request.path.bucket": "method.request.path.folder"
                    },
                    "Uri": {"Fn::Join" : ["",
                        ["arn:aws:apigateway:", {"Ref": "AWS::Region"}, ":s3:path/{bucket}/{object}"]
                    ]},
                    "IntegrationResponses": [
                        {
                            "StatusCode": 500
                        },
                        {
                            "ResponseTemplates": {
                                "text/csv": "$input.body"
                            },
                            "SelectionPattern" : "2\\d{2}",
                            "StatusCode" : 200
                        }
                    ]
                },
                "ResourceId": {"Ref": "ItemResource"},
                "RestApiId": {"Ref": "FilesRestApi"},
                "MethodResponses": [
                    {
                        "ResponseModels": {
                            "text/csv": "Empty"
                        },
                        "StatusCode": 200
                    },
                    {
                        "StatusCode": 400
                    }
                ]
            }
        },
        "FilePostMethod": {
            "DependsOn": "FilePostPermission",
            "Type": "AWS::ApiGateway::Method",
            "Properties": {
                "AuthorizationType": "NONE",
                "HttpMethod": "POST",
                "Integration": {
                    "Credentials" : {"Fn::GetAtt": ["RootRole", "Arn"]},
                    "Type": "AWS",
                    "IntegrationHttpMethod": "POST",
                    "Uri": {"Fn::Join" : ["",
                        ["arn:aws:apigateway:", {"Ref": "AWS::Region"}, ":lambda:path/2015-03-31/functions/", {"Fn::GetAtt": ["SaveFileLambda", "Arn"]}, "/invocations"]
                    ]},
                    "IntegrationResponses": [
                        {
                            "StatusCode": 200
                        }
                    ]
                },
                "ResourceId": {"Ref": "RootFileResource"},
                "RestApiId": {"Ref": "FilesRestApi"},
                "MethodResponses": [
                    {
                        "StatusCode": 200
                    },
                    {
                        "StatusCode": 400
                    }
                ]
            }
        },
        "FilePostPermission": {
            "Type": "AWS::Lambda::Permission",
            "Properties": {
                "Action": "lambda:InvokeFunction",
                "FunctionName": {"Fn::GetAtt": ["SaveFileLambda", "Arn"]},
                "Principal": "apigateway.amazonaws.com",
                "SourceArn": {"Fn::Join": ["", [
                    "arn:aws:execute-api:",
                    {"Ref": "AWS::Region"}, ":",
                    {"Ref": "AWS::AccountId"}, ":",
                    {"Ref": "FilesRestApi"},
                    "/*"]
                ]}
            }
        },
        "SaveFileLambda": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "FunctionName" : "FileUpload",
                "Description" : "Save file to S3",
                "Handler": "index.handler",
                "Role": { "Fn::GetAtt" : ["RootRole", "Arn"] },
                "Code": {
                    "ZipFile": {
                        "Fn::Join": [
                            "\n",
                            [
                                "exports.handler = function(event, context) {",
                                "  return { statusCode: 200, headers: { \"Content-Type\": \"text/html\" }, body: \"hello world!\" };",
                                "};"
                            ]
                        ]
                    }
                },
                "Runtime": "nodejs8.10",
                "Environment" : {
                    "Variables" : {
                        "DATABASE_REGION":{"Ref": "AWS::Region"}
                    }
                }
            }
        },
        "ApiGatewayCloudWatchLogsRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Effect": "Allow",
                        "Principal": { "Service": ["apigateway.amazonaws.com"] },
                        "Action": ["sts:AssumeRole"]
                    }]
                },
                "Policies": [{
                    "PolicyName": "ApiGatewayLogsPolicy",
                    "PolicyDocument": {
                        "Version": "2012-10-17",
                        "Statement": [{
                            "Effect": "Allow",
                            "Action": [
                                "logs:CreateLogGroup",
                                "logs:CreateLogStream",
                                "logs:DescribeLogGroups",
                                "logs:DescribeLogStreams",
                                "logs:PutLogEvents",
                                "logs:GetLogEvents",
                                "logs:FilterLogEvents"
                            ],
                            "Resource": "*"
                        }]
                    }
                }]
            }
        },
        "ApiGatewayAccount": {
            "Type" : "AWS::ApiGateway::Account",
            "Properties" : {
                "CloudWatchRoleArn" : {"Fn::GetAtt" : ["ApiGatewayCloudWatchLogsRole", "Arn"] }
            }
        },
        "ApiDeployment": {
            "Type": "AWS::ApiGateway::Deployment",
            "DependsOn": ["FileGetMethod","FilePostMethod"],
            "Properties": {
                "RestApiId": {"Ref": "FilesRestApi"},
                "StageName": "cfstage"
            }
        },
        "ApiStage": {
            "DependsOn" : ["ApiGatewayAccount"],
            "Type": "AWS::ApiGateway::Stage",
            "Properties": {
                "DeploymentId": {"Ref": "ApiDeployment"},
                "MethodSettings": [{
                    "DataTraceEnabled": true,
                    "HttpMethod": "*",
                    "LoggingLevel": "INFO",
                    "ResourcePath": "/*"
                }],
                "RestApiId": {"Ref": "FilesRestApi"},
                "StageName": "v1"
            }
        }
    }
}

Answer 1

您看到的问题来自于设置集成角色以及 Lambda 权限。

因此，如果您从方法中删除执行角色并只保留权限对象，就可以了:

"FilePostMethod": {
    "DependsOn": "FilePostPermission",
    "Type": "AWS::ApiGateway::Method",
    "Properties": {
        "AuthorizationType": "NONE",
        "HttpMethod": "POST",
        "Integration": {
            "Type": "AWS",
            "IntegrationHttpMethod": "POST",
            "Uri": {"Fn::Join" : ["",
                ["arn:aws:apigateway:", {"Ref": "AWS::Region"}, ":lambda:path/2015-03-31/functions/", {"Fn::GetAtt": ["SaveFileLambda", "Arn"]}, "/invocations"]
            ]},
            "IntegrationResponses": [
                {
                    "StatusCode": 200
                }
            ]
        },
        "ResourceId": {"Ref": "RootFileResource"},
        "RestApiId": {"Ref": "FilesRestApi"},
        "MethodResponses": [
            {
                "StatusCode": 200
            },
            {
                "StatusCode": 400
            }
        ]
    }
},

或者，您可以删除该权限并向执行角色添加 lambda:InvokeFunction 权限。