amazon-web-services - 无法修复 "The provided execution role does not have permissions to call CreateNetworkInterface on EC2"

Question

我尝试了this answer中的解决方案但这对我不起作用。我收到错误:

The provided execution role does not have permissions to call CreateNetworkInterface on EC2 (Service: AWSLambdaInternal; Status Code: 400; Error Code: InvalidParameterValueException; Request ID: 4c8d047c-2710-4334-86cd-51b7467c6f08)

以下是与错误关联的 CloudFormation:

EventLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub ${DeveloperPrefix}event-lambda-${Environment}-${DeployPhase}
      Handler: EventHandler
      Runtime: java8
      Code:
        S3Bucket: !Ref SharedBucketName
        S3Key: !Sub ${WorkspacePrefix}/event-subscriber-${AppVersion}.jar
        S3ObjectVersion: !Ref EventLambdaS3Version
      Role: !GetAtt EventLambdaRole.Arn
      Environment:
        Variables:
          retry_event_table_name: !Sub "${DeveloperPrefix}${AppName}-${RetryEventTableName}-${Environment}-${DeployPhase}"
          test_enabled: true # TODO: Remove once endpoint provided.
      VpcConfig:
        SecurityGroupIds:
          - !Ref LambdaSecurityGroup
        SubnetIds:
          - Fn::ImportValue: !Sub ${VPCStackName}-SubnetPrivateL
          - Fn::ImportValue: !Sub ${VPCStackName}-SubnetPrivateR
      Timeout: 28
      MemorySize: 256

  EventLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${DeveloperPrefix}${AppName}-${Environment}-${DeployPhase}-EventLambdaRole
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [lambda.amazonaws.com]
            Action: ['sts:AssumeRole']
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: !Sub ${DeveloperPrefix}${AppName}-${Environment}-${DeployPhase}-EventLambdaPolicy
          PolicyDocument:
            Statement:
              - Sid: DynamoDbPermissions
                Effect: Allow
                Action:
                  - dynamodb:PutItem
                Resource: !Sub 'arn:aws:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${DeveloperPrefix}${AppName}-EventRetry-${Environment}-${DeployPhase}'
              - Sid: LambdaVPCPermissions
                Effect: Allow
                Action:
                  - ec2:AttachNetworkInterface
                  - ec2:CreateNetworkInterface
                  - ec2:CreateNetworkInterfacePermission
                  - ec2:DeleteNetworkInterface
                  - ec2:DeleteNetworkInterfacePermission
                  - ec2:DescribeDhcpOptions
                  - ec2:DescribeNetworkInterfaces
                  - ec2:DescribeNetworkInterfacePermissions
                  - ec2:DescribeSubnets
                  - ec2:DescribeVpcs
                  - ec2:DescribeInstances
                Resource: '*'

我已经寻找了这个问题的答案，并尝试了一些找到的建议，但没有成功。我犯了什么明显的错误吗？我担心我现在只见树木不见森林。

Answer 1

由于 lambda 在 VPC 中运行，您可以使用 AWSLambdaVPCAccessExecutionRole 而不是 AWSLambdaBasicExecutionRole。理想情况下，它应该与您拥有的相同。从开发运营角度来看，优点之一是减少维护工作。

<强>!重要 该错误并不是警告我们有关用户的权限，而是警告我们与 lambda 函数关联的角色的权限。请确保

1. 您拥有 lambda 函数的角色，并且
2. 此角色具有 AWSLambdaBasicExecutionRole 权限策略
3. 此角色具有如下信任关系:

`

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "lambda.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}