如何在无服务器框架中将iamRoleStatements添加到S3触发器存储桶

Question

当我在serverless.yml文件中添加以下代码时

provider:
  name: aws
  runtime: python3.6
  stage: dev
  region: [REGION]
  iamRoleStatements:
    - Effect: "Allow"
      Action:
       - "s3:GetObject"
      Resource: { "Fn::Join": ["", ["arn:aws:s3:::", { "Ref": [BUCKET NAME] }, "/*" ] ] }

在部署时,我得到"CloudFormation模板无效:资源之间的循环依赖:"

我正在使用boto3和python3来获取在触发器事件之后上传到S3存储桶的私有文件,以便为该存储桶提供Lambda函数的权限.

Answer 1

我遇到了同样的问题,我花了好几个小时.最后我找到了一个解决方案:不要反驳桶.

更改

provider:
  name: aws
  runtime: python3.6
  stage: dev
  region: [REGION]
  iamRoleStatements:
    - Effect: "Allow"
      Action:
       - "s3:GetObject"
      Resource: { "Fn::Join": ["", ["arn:aws:s3:::", { "Ref": [BUCKET NAME] }, "/*" ] ] }

至

provider:
  name: aws
  runtime: python3.6
  stage: dev
  region: [REGION]
  iamRoleStatements:
    - Effect: "Allow"
      Action:
       - "s3:GetObject"
      Resource: { "Fn::Join": ["", ["arn:aws:s3:::<s3-bucket-name>", "/*" ] ] }

甚至更简单:

provider:
  name: aws
  runtime: python3.6
  stage: dev
  region: [REGION]
  iamRoleStatements:
    - Effect: "Allow"
      Action:
       - "s3:GetObject"
      Resource: "arn:aws:s3:::<s3-bucket-name>/*"