Javascript serverless.yml中的引用函数
我有几个AWS lambda正在运行,由无服务器框架支持。我需要一个lambda(称为Javascript serverless.yml中的引用函数,javascript,amazon-web-services,aws-lambda,serverless-framework,amazon-cloudformation,Javascript,Amazon Web Services,Aws Lambda,Serverless Framework,Amazon Cloudformation,我有几个AWS lambda正在运行,由无服务器框架支持。我需要一个lambda(称为lambdaOne),它将使用AWS的javascript sdk调用第二个lambda(称为lambdaTwo)。问题是,当我尝试此操作时,我得到了一个AccessDenied异常: 未处理的PromisejectionWarning:未处理的承诺拒绝(拒绝id:1): AccessDeniedException:用户:arn:aws:sts::12345678909876:假定角色/test-dev-us-
lambdaOne
),它将使用AWS的javascript sdk调用第二个lambda(称为lambdaTwo
)。问题是,当我尝试此操作时,我得到了一个AccessDenied
异常:
未处理的PromisejectionWarning:未处理的承诺拒绝(拒绝id:1):
AccessDeniedException:用户:arn:aws:sts::12345678909876:假定角色/test-dev-us-west-2-lambdaRole/test-dev-lambdaOne无权对资源执行:lambda:Invoke函数:arn:aws:lambda:us-west-2:994979977450:函数:test-dev-lambdaTwo
据我所知,Serverless为所有lambda函数创建了一个角色。因此,我应该能够在iarolestatements
下添加一个新条目
我的困惑源于这样一个事实:我想要引用的资源(lambdaTwo
)已经被定义为
是否有方法将
函数
引用为资源?目前,没有为Lambda函数声明权限的快捷方式。您需要根据其ARN授予权限
下面是一个工作示例
serverless.yml
service: test-invoke-function
provider:
name: aws
runtime: nodejs6.10
region: us-east-1
stage: dev
environment:
AWS_ACCOUNT: 1234567890 # use your own AWS ACCOUNT number here
# define the ARN of the function that you want to invoke
FUNCTION_ARN: "arn:aws:lambda:${self:provider.region}:${self:provider.environment.AWS_ACCOUNT}:function:${self:service}-${self:provider.stage}-lambdaTwo"
functions:
# lambdaOne will invoke lambdaTwo
lambdaOne:
handler: handler.lambdaOne
role: functionPermission # we'll define later in this file
lambdaTwo:
handler: handler.lambdaTwo
# define the IAM permissions of our Lambda function
resources:
Resources:
functionPermission:
Type: AWS::IAM::Role
Properties:
RoleName: functionPermission
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: functionPermission
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: "Allow"
Action:
- "lambda:InvokeFunction"
Resource: "${self:provider.environment.FUNCTION_ARN}"
handler.js
const AWS = require('aws-sdk');
module.exports.lambdaOne = (event, context, callback) => {
const lambda = new AWS.Lambda();
const params = {
FunctionName: process.env.FUNCTION_ARN,
Payload: JSON.stringify({ message: 'lambdaOne invoking lambdaTwo' })
};
// invoke lambdaTwo
lambda.invoke(params, (err, data) => {
if (err) {
callback(err, null);
return;
}
const response = {
statusCode: 200,
body: JSON.stringify({
message: 'lambdaOne result',
result: data
})
};
callback(null, response);
});
};
module.exports.lambdaTwo = (event, context, callback) => {
const response = {
statusCode: 200,
body: JSON.stringify({
message: 'lambdaTwo result',
data: event
})
};
callback(null, response);
};
您还可以使用插件,该插件允许您为每个lambda函数附加单个IAM角色,并与之结合,您可以引用其他lambda。Ah,Bonismo!这非常有用。谢谢