java - 如何使用 .yaml 文件向 AWS Lambda 函数添加策略?
问题描述
我正在开发一个带有AWS Lambda
, API Gateway
,的 REST API RDS (MySQL)
。我正在使用该aws-sam
工具来构建、配置我的工作并将其发布到云端。
template.yaml
请检查我现在使用的以下文件。
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
aaaa-restapi
Sample SAM Template for aaaa-restapi
# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
Function:
Timeout: 100
Resources:
GetAllAccountTypesLambda:
Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
Properties:
CodeUri: aaaa-restapi
Handler: com.aaaa.dao.accountingtype.GetAllAccountTypesLambda::getAllAccountTypes
Runtime: java11
MemorySize: 1024
Environment: # More info about Env Vars: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#environment-object
Variables:
PARAM1: VALUE
Events:
HelloWorld:
Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
Properties:
Path: /accounttype
Method: get
然而,为了让我的 lambda 函数能够找到数据库,我必须从 AWS Web 控制台启用一些策略。我点击了这个链接 - https://ao.ms/the-provided-execution-role-does-not-have-permissions-to-call-createnetworkinterface-on-ec2/
以下是我在 AWS Web 控制台中为我的 Lambda 函数创建的策略。
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DescribeNetworkInterfaces",
"ec2:CreateNetworkInterface",
"ec2:DeleteNetworkInterface",
"ec2:DescribeInstances",
"ec2:AttachNetworkInterface"
],
"Resource": "*"
}
]
}
但是,从功能到功能,我无法在 Web 控制台中执行此操作。我需要在yaml
文件中完成这项工作。
使用yaml
上面提供的文件,我如何将这些权限赋予我的 Lambda 函数?
- - - - - - 更新 - - - - - - - -
根据 Gaurauv 的评论,我对文件进行了以下更改yaml
。
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
aaaa-restapi
Sample SAM Template for aaaa-restapi
# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
Function:
Timeout: 100
Resources:
GetAllAccountTypesLambda:
Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
Properties:
CodeUri: aaaa-restapi
Handler: com.aaaa.dao.accountingtype.GetAllAccountTypesLambda::getAllAccountTypes
Runtime: java11
MemorySize: 1024
Environment: # More info about Env Vars: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#environment-object
Variables:
PARAM1: VALUE
Events:
HelloWorld:
Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
Properties:
Path: /accounttype
Method: get
Role: !GetAtt LambdaRole.Arn
LambdaRole:
Type: "AWS::IAM::Role"
Properties:
Path: "/"
ManagedPolicyArns:
- "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
Policies:
- PolicyName: 'ec2-access-policy'
PolicyDocument:
Statement:
- Effect: Allow
Action:
- ec2:DescribeNetworkInterfaces
- ec2:CreateNetworkInterface
- ec2:DeleteNetworkInterface
- ec2:DescribeInstances
- ec2:AttachNetworkInterface
Resource: '*'
但是它未能部署,产生了以下错误。
CREATE_FAILED AWS::IAM::Role LambdaRole Property AssumeRolePolicyDocument
cannot be empty.
解决方案
根据IAM::Role Resource,创建角色时需要 AssumeRolePolicyDocument。此属性管理与此角色关联的信任策略。信任策略定义了哪些实体可以担任该角色。您只能将一个信任策略与角色相关联。
请为您的用例查找更新的角色资源
AWSTemplateFormatVersion: "2010-09-09"
Resources:
LambdaRole:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action:
- 'sts:AssumeRole'
Path: /
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
Policies:
- PolicyName: root
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- ec2:DescribeNetworkInterfaces
- ec2:CreateNetworkInterface
- ec2:DeleteNetworkInterface
- ec2:DescribeInstances
- ec2:AttachNetworkInterface
Resource: '*'
推荐阅读
- html - 带下划线的文本,尽管 `text-decoration: none;` 和 ` 旁边的白线` 部分
- php - Laravel 背包。1-1(一对一)关系
- swift - 通知的定时器间隔和日历触发可能吗?
- python - 使用自定义损失函数运行 Light gbm 时 Python 崩溃
- asp.net-mvc - Automapper 仅将子对象重新映射到现有的扁平化 VM
- python - Matplotlib:来自 3 列熊猫数据框的 pcolormesh 或 pcolor
- ios - Xcode10 随机弹出“无法读取 XCode10Project.app 的包标识符。”
- c# - 为什么在浏览器中手动删除 Anti-forgery cookie 并发布会出现 404(.net core 2.0Razor 页面)
- amazon-web-services - 无法访问函数返回列表中的已处置对象?
- java - 如何自定义适配器以限制要显示的项目