amazon-web-services - 如何解决资源之间的循环依赖: [s3bucketvideo, S3InvokeLambdaPermission]

Question

提前致谢。我正在尝试创建 s3 存储桶和 lambda 函数。目标是当我们在 s3 存储桶上上传任何内容时执行 lambda 函数。我尝试过不同的方法，但似乎不起作用。如有任何帮助，我们将不胜感激。

Resources:
s3bucketvideo:
    Type: AWS::S3::Bucket
    DependsOn: S3InvokeLambdaPermission
    Properties:
        BucketName: s3bucketvideo
        NotificationConfiguration:
            LambdaConfigurations:
              - Event: 's3:ObjectCreated:*'
                Function: !GetAtt VideoToImageLambda.Arn
        
S3InvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
        Action: lambda:InvokeFunction
        FunctionName: !Ref VideoToImageLambda
        Principal: s3.amazonaws.com
        SourceArn: !GetAtt s3bucketvideo.Arn
    
cflambdarole:
    Type: AWS::IAM::Role
    Properties: 
        RoleName: cflambdarole
        AssumeRolePolicyDocument:
            Statement:
              - Effect: Allow
                Principal:
                  Service: lambda.amazonaws.com
                Action: sts:AssumeRole
        ManagedPolicyArns:
            - arn:aws:iam::aws:policy/AWSLambda_FullAccess
            - arn:aws:iam::aws:policy/AWSLambdaExecute
            - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

VideoToImageLambda:
    Type: AWS::Lambda::Function
    Properties:
        FunctionName: VideoToImageLambda
        Timeout: 120
        Role:
            Fn::GetAtt:
                - cflambdarole
                - Arn
        Runtime: python3.9
        Handler: script.hprint
        Code:
            S3Bucket: s3-neuralopsdev
            S3Key: script.zip

  

Answer 1

一个快速解决方案是在权限中使用 SourceAccount 而不是 SourceArn:

SourceAccount: !Ref 'AWS::AccountId'

创建堆栈后，您还可以添加 SourceArn 并进行更新。

这也被讨论过here .