部署 lambda 函数时出现 AccessDeniedException

Question

我试图通过 AWS 命令​​在 aws 中创建 lambda 函数。当我执行命令时，出现以下错误。但是我在 AWS 命令​​中提到的角色有足够的权限来部署 lambda 函数。即使角色有权限，我也不确定出了什么问题。

命令：

aws lambda create-function --function-name ukmon-appd-disabled- 
health-rules --runtime python3.7 --zip-file 
fileb://bin/disabled_health_rules.zip --handler index.handler --timeout 10 - 
-memory-size 1024 --role arn:aws:iam::99999999999:role/crossaccount

政策：

"AllowLambdaFunctionStack": {
      "Type": "AWS::IAM::ManagedPolicy",
      "Properties": {
        "Description": "Policy for allowing jenkins cross account service role to create, update, delete lambda functions.",
        "Path": "/",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": [
                "lambda:InvokeFunction",
                "lambda:CreateFunction",
                "lambda:DeleteFunction",
                "lambda:GetFunction",
                "lambda:ListFunctions",
                "lambda:UpdateFunctionCode",
                "lambda:GetFunctionConfiguration",
                "lambda:UpdateFunctionConfiguration",
                "lambda:AddPermission",
                "lambda:RemovePermission",
                "lambda:CreateAlias",
                "lambda:DeleteAlias",
                "lambda:GetAlias",
                "lambda:ListAliases",
                "lambda:UpdateAlias",
                "lambda:GetPolicy",
                "lambda:InvokeAsync",
                "lambda:ListVersionsByFunction",
                "lambda:PublishVersion",
                "lambda:CreateEventSourceMapping",
                "lambda:GetEventSourceMapping",
                "lambda:ListEventSourceMappings",
                "lambda:DeleteEventSourceMapping",
                "lambda:UpdateEventSourceMapping",
                "lambda:TagResource",
                "lambda:ListTags",
                "lambda:UntagResource"
              ],
              "Effect": "Allow",
              "Resource": "arn:aws:lambda:eu-west-1:999999999999:function:crossaccount-*",
              "Sid": "AllowLambdaFuctionsStacks"
            }
          ]
        },

错误：

调用 CreateFunction 操作时发生错误 (AccessDeniedException)：用户：arn:aws:sts::9999999999999:assumed-role/crossaccount/i-0d2dd689c2784f174 无权在资源上执行：lambda:CreateFunction：arn:aws:lambda: eu-west-1:999999999999:功能:ukmon-appd-disabled-health-rules

提前致谢。

Answer 1

我有相同或非常相似的问题。

问题

我的 CodeBuild 构建运行良好，直到进行新更改后出现此错误。

Error: error creating Lambda Function (1): AccessDeniedException: 

status code: 403, request id: 31ea35dd-7c9f-4911-94ef-7c8eaae58b66
with module.app.module.lambda.aws_lambda_function.this,
on ../../../libraries/zip_lambda/main.tf line 22, 
in resource "aws_lambda_function" "this":

之前的构建进展顺利，因此显然引入这个 lambda 破坏了构建。

第 1 步 - 检查地形规划

# module.app.module.lambda.aws_lambda_function. This will be created
  + resource "aws_lambda_function" "this" {
      + arn                            = (known after apply)
      + filename                       = "../../../libraries/zip_lambda/../../../out/lambdas/some-name.zip"
      + function_name                  = "some-name"
      + handler                        = "some-lambda-package/handler/handler.handler"
      + package_type                   = "Zip"
      + role                           = "arn:aws:iam::111122223333:role/LambdaExecution-some-lambda"
      + runtime                        = "python3.9"
      ...
      ...
      + vpc_config {
          + security_group_ids = [
              + "sg-some-sg-id",
            ]
          + subnet_ids         = [
              + "subnet-some-subnet-1-id",
              + "subnet-some-subnet-2-id",
            ]
          + vpc_id             = (known after apply)
        }
    }

关键是要意识到这个 lambda 正在尝试添加 VPC 配置。

所以我寻找lambda in vpc security group permission

第一个链接将我带到了 AWS 的文档：Lambda 的 VPC 配置。即 AWS 文档 > Lambda > 管理功能 > 网络 > 执行角色和用户权限

When you configure VPC connectivity, Lambda uses your permissions to verify network resources. To configure a function to connect to a VPC, your AWS Identity, and Access Management (IAM) user needs the following permissions:

User permissions
    ec2:DescribeSecurityGroups
    ec2:DescribeSubnets
    ec2:DescribeVpcs

解决方案

将这些权限添加到 CodeBuild 假定构建和部署 Terraform 中描述的基础设施的角色。

ec2:DescribeSecurityGroups
ec2:DescribeSubnets
ec2:DescribeVpcs

笔记

需要注意的是，出现 AccessDeniedException 是因为部署的服务或用户缺乏足够的权限。这与分配给 Lambda 角色的权限无关。

我的 lambda 使用的 IAM 角色role/LambdaExecution-some-lambda几乎就是AWS Lambda 开发人员指南文档中的角色

策略权限

permissions = ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
  "arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess"]

承担角色政策

data "aws_iam_policy_document" "assume_role_policy" {
  statement {
    sid     = "LambdaRole"
    actions = ["sts:AssumeRole"]
    effect  = "Allow"
    principals {
      type        = "Service"
      identifiers = ["lambda.amazonaws.com"]
    }
  }
}

Answer 2

我认为您在问题中混淆了 IAM 角色。您传递给 AWS CLI 调用的 IAM 角色create-function是 Lambda 服务在运行时将承担的角色：即您在运行时授予 lambda 函数的权限。
要获得进行aws lambda create-functionCLI 调用的授权，您的环境必须拥有CreateFunction授权。

但如果你没有混淆角色，那么你的策略就有问题。它授权对符合以下条件的 Lambda 资源上列出的所有 API 调用

"Resource": "arn:aws:lambda:eu-west-1:999999999999:function:crossaccount-*",

您尝试创建的 lambda 函数名为“ukmon-appd-disabled- health-rules只有以以下开头的函数名称crossaccount-才会被授权”。