principal states.amazonaws.com无权担任所提供的角色

Question

我使用Terraform创建了一个AWS步骤函数。目前，阶跃函数只有一个lambda函数：

resource "aws_iam_role_policy" "sfn_policy" {
policy = jsonencode(
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "*"
},
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction",
"lambda:InvokeAsync"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [ "states:StartExecution" ],
"Resource": "*"
}
]
}
)
role = aws_iam_role.processing_lambda_role.id
}

resource "aws_sfn_state_machine" "sfn_state_machine_zip_files" {
name     = local.zip_files_step_function_name
role_arn = aws_iam_role.processing_lambda_role.arn
definition = <<EOF
{
"Comment": "Process Incoming Zip Files",
"StartAt": "ProcessIncomingZipFiles",
"States": {
"ProcessIncomingZipFiles": {
"Type": "Task",
"Resource": "${aws_lambda_function.process_zip_files_lambda.arn}",
"ResultPath": "$.Output",
"End": true
}
}
}
EOF
}

这就是角色最初的定义：

resource "aws_iam_role" "processing_lambda_role" {
name = local.name
path = "/service-role/"
assume_role_policy = jsonencode({
Version   = "2012-10-17"
Statement = [
{
Effect    = "Allow"
Principal = { Service = "lambda.amazonaws.com" }
Action    = "sts:AssumeRole"
}
]
})
}

为什么在策略中已经包含"假定角色"策略的情况下仍会收到此错误消息。我还尝试删除其中一个sts:AssumeRole策略，但错误仍然存在。

"Neither the global service principal states.amazonaws.com, nor the regional one is authorized to assume the provided role."

AWS文档参考：https://aws.amazon.com/premiumsupport/knowledge-center/step-functions-iam-role-troubleshooting/

Answer 1

角色aws_iam_role.processing_lambda_role只能由lambda函数承担。所以，你的aws_sfn_state_machine.sfn_state_machine_zip_files不能承担这个角色。您必须将角色中的Principal从：更改为

Principal = { Service = "lambda.amazonaws.com" }

进入

Principal = { Service = "states.amazonaws.com" }

你可能还有其他问题，具体取决于你想做什么。但你报告的错误是由于我提到的。