CloudFormation 创建的 Lambda 不创建 LogStream/ 日志

Question

我有一个包含 lambda 函数的 CloudFormation 模板。相关部分是

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  Environment:
    Description: Environment name
    Type: String
    Default: Prod
Resources:
  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Policies:
        - PolicyName: !Join [ '-', ['lambda-log', !Ref Environment, 'sqs-distributor'] ]
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource: !GetAtt LambdaLogGroup.Arn
  SqsDistributor:
    Type: 'AWS::Lambda::Function'
    Properties:
      Code:
        ZipFile: !Sub
          ...
          ...
      Handler: index.handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: nodejs8.10
      Timeout: 120
      MemorySize: 128
  LambdaLogGroup:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      RetentionInDays: 7

lambda 函数无法按预期工作，而且在通过 cloudformation 创建时也不会将任何内容记录到流中

我检查了 Lambda 函数的语法错误以及 ExecutionRole，其创建时如下所示

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:us-east-1:765121849689:log-group:ProdSQSDistributor-LambdaLogGroup-1CVWUP6CZHAWX:*",
            "Effect": "Allow"
        }
    ]
}

日志组也如预期就位。

Answer 1

创建了一个 LogGroup，并且该角色有权对该 LogGroup 执行操作，但我在该AWS::Lambda::Function定义中没有看到任何指定它将使用该 LogGroup 的内容：

为 AWS lambda 指定日志组？

AWS 管理的 IAM 策略arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole Provides write permissions to CloudWatch Logs：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "*"
        }
    ]
}

使用该策略将允许它创建一个它将使用的 LogGroup。