时间戳

首页 > 解决方案 > AWS lambda 和 IAM 网络策略

kubernetes - AWS lambda 和 IAM 网络策略

问题描述

我正在部署一个 lambda 函数 -StatusCheck在我的 VPC 中。该功能是使用 awscli 从我的 k8s 集群中的工作节点上运行的一个 pod 部署的。我将AWSLambdaVPCAccessExecutionRole策略附加到 k8s 工作节点，策略看起来像

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "ec2:CreateNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DeleteNetworkInterface",
                "ec2:AssignPrivateIpAddresses",
                "ec2:UnassignPrivateIpAddresses"
            ],
            "Resource": "*"
        }
    ]
}

显然，默认情况下，它还允许 k8s 集群中的其他 pod 创建/删除网络接口，这是不可取的。

更新上述策略以添加资源不起作用。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "ec2:CreateNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DeleteNetworkInterface",
                "ec2:AssignPrivateIpAddresses",
                "ec2:UnassignPrivateIpAddresses"
            ],
            "Resource": "arn:aws:lambda:*:77777777:function:*StatusCheck*"
        }
    ]
}

错误 ： StatusCheck. Create Failed. Resource handler returned message: "The provided execution role does not have permissions to call CreateNetworkInterface on EC2 (Service: Lambda, Status Code: 400

是否可以将 ENI 的创建/删除仅限于 lambda 函数StatusCheck？

标签： kubernetesaws-lambdaamazon-iam

解决方案

使用 AWS SAM 时遇到了同样的问题。我还必须添加“ec2:DescribeInstances”权限。所以我的完整政策是：

          - Effect: "Allow"
            Action:
              [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:DescribeLogStreams"
              ]
            Resource: "arn:aws:logs:*:*:*"

          - Effect: "Allow"
            Action: 
              [
                "ec2:DescribeNetworkInterfaces",
                "ec2:CreateNetworkInterface",
                "ec2:AttachNetworkInterface",
                "ec2:DescribeInstances",
                "ec2:DeleteNetworkInterface"
              ]
            Resource: "arn:aws:ec2:*:*:*"

推荐阅读