将 AWS Lambda 代码存储桶指向不同账户中的存储桶

Question

我需要在不同的 AWS 账户中部署相同的 lambda。为了避免两个代码桶具有相同的内容，我想将账户 B lambda 指向账户 A S3 代码桶。我在 AWS 论坛上尝试了多种方法和技巧，但没有成功。这是我正在使用的配置（作为 Cloudformation 模板）的一瞥。

这是 lambda 角色：

AWSTemplateFormatVersion: '2010-09-09'
Description: 'lambda role'
Resources:
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: LambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: LambdaFullAccess
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - "longListOfActions"
            - "s3:*"
            Resource: 
            - '*'
Outputs: 
  LambdaRoleARN: 
    Value: 
      Fn::GetAtt: 
        - "LambdaExecutionRole"
        - "Arn"

这是 Lambda 模板：

AWSTemplateFormatVersion: '2010-09-09'
Description: Lambda for subscriptions
Parameters:
  LambdaBucket:
    Type: String
  TheRoleARN:
    Type: String
Resources:
  MyLambda:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: java11
      FunctionName: handler
      MemorySize: 3008
      Timeout: 180
      Role: !Ref 'TheRoleARN'
      Handler: com.project.Handler
      Code:
        S3Bucket: !Ref 'LambdaBucket'
        S3Key: handler.jar

最后，这是账户 A 上的存储桶策略：

{
    "Version": "2012-10-17",
    "Id": "Policy1608150492429",
    "Statement": [
        {
            "Sid": "Stmt1608150488840",
            "Effect": "Allow",
            "Principal": {
                "AWS": "Account-B-Lambda-Role-ARN"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::the-code-bucket/*"
        }
    ]
}

总而言之，以下是我遵循的步骤：

• 在账户 B 上创建 lambda 角色
• 在账户 A 上添加具有账户 B lambda 角色的存储桶策略
• 尝试在账户 B 上创建 lambda，结果失败：

Your access has been denied by S3, please make sure your request credentials have permission to GetObject for the-code-bucket/handler.jar. S3 Error Code: AccessDenied. S3 Error Message: Access Denied (Service: AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException; Request ID: abd49370-e172-4fc9-9348-804cc7ff5e23; Proxy: null)

这显然是一个权限问题。欢迎任何建议。

谢谢。

Answer 1

Lambda 将使用您的 IAM 用户/角色来访问不同帐户中的 zip，而不是您的函数角色。因此，您必须允许 IAM 用户访问它，这是使用以下存储桶策略完成的：

{
    "Version": "2012-10-17",
    "Id": "Policy1608150492429",
    "Statement": [
        {
            "Sid": "Stmt1608150488840",
            "Effect": "Allow",
            "Principal": {
                "AWS": "<Account-B-Id>"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::the-code-bucket/*"
        }
    ]
}