我使用无服务器部署应用程序，在该应用程序中我使用自定义资源迁移RDS数据库。
部署时一切正常，但当我删除堆栈时，自定义资源在一个小时后超时，并显示消息"自定义资源未能在预期时间内稳定"。对预签名的AWS S3 URL的请求返回403，错误代码为AccessDenied。
我对预签名URL的第一个发送的、成功的响应体(创建时)：
{
"Status": "SUCCESS",
"RequestId": "bd487606-8017-49f2-99af-b29b2bbad40b",
"LogicalResourceId": "SheltersDBMigrationTrigger",
"StackId": "arn:aws:cloudformation:us-east-1:848139458219:stack/update-shelters-dev/c08a80e0-2e4e-11e9-87a6-124d1eab42ba",
"PhysicalResourceId": "DB_MIGRATION"
}
我的第二次发送，失败，对预签名URL的响应主体(删除时)：
{
"Status": "SUCCESS",
"RequestId": "2d166d36-7c0c-4848-9eb5-aedaf5e9172c",
"LogicalResourceId": "SheltersDBMigrationTrigger",
"StackId": "arn:aws:cloudformation:us-east-1:848139458219:stack/update-shelters-dev/c08a80e0-2e4e-11e9-87a6-124d1eab42ba",
"PhysicalResourceId": "DB_MIGRATION"
}
λ.go:
func handler(ctx context.Context, event cfn.Event) (rid string, data map[string]interface{}, err error) {
rid = "DB_MIGRATION"
if event.RequestType != cfn.RequestCreate {
return
}
db, err := sql.Open("mysql", fmt.Sprintf("%s:%s@(%s)/", os.Getenv("DB_MASTER_USER"), os.Getenv("DB_MASTER_PASSWORD"), os.Getenv("DB_ADDRESS")))
if err != nil {
panic(err)
}
defer db.Close()
defer func() {
if r := recover(); r != nil {
err = fmt.Errorf("handler: Failed to migrate DB: %v", r)
}
}()
MigrateDb(db)
return
}
func main() {
lambda.Start(cfn.LambdaWrap(handler))
}
Lambda CFN的无服务器配置：
functions:
dbMigration:
handler: lambda-bin/migrate-db
environment:
DB_MASTER_USER: ${env:DB_MASTER_USER}
DB_MASTER_PASSWORD: ${env:DB_MASTER_PASSWORD}
DB_ADDRESS:
"Fn::GetAtt": [ SheltersDB, Endpoint.Address ]
vpc:
securityGroupIds:
- Ref: SheltersVPCSecurityGroup
subnetIds:
- Ref: SheltersSubnet1
- Ref: SheltersSubnet2
...
Resources:
SheltersDBMigrationTrigger:
Type: Custom::DBMigration
DependsOn:
- SheltersDB
Properties:
ServiceToken: !GetAtt
- DbMigrationLambdaFunction
- Arn
SheltersSubnet1:
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone: !Select [ 0, {Fn::GetAZs: ""} ]
CidrBlock: 10.0.1.0/24
VpcId: !Ref SheltersVPC
SheltersSubnet2:
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone: !Select [ 1, {Fn::GetAZs: ""} ]
CidrBlock: 10.0.2.0/24
VpcId: !Ref SheltersVPC
SheltersVPCSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: "Security group for DB connections"
VpcId: !Ref SheltersVPC
SheltersVPCSecurityGroupIngress:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !Ref SheltersVPCSecurityGroup
IpProtocol: tcp
FromPort: "3306"
ToPort: "3306"
SourceSecurityGroupId: !Ref SheltersVPCSecurityGroup
SheltersVPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16
SheltersRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref SheltersVPC
SheltersSubnet1Association:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref SheltersSubnet1
RouteTableId: !Ref SheltersRouteTable
SheltersSubnet2Association:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref SheltersSubnet2
RouteTableId: !Ref SheltersRouteTable
SheltersVPCS3Endpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
VpcId: !Ref SheltersVPC
PolicyDocument: "{"Version":"2008-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"*","Resource":"*"}]}"
RouteTableIds:
- !Ref SheltersRouteTable
ServiceName: !Join ['', ['com.amazonaws.', !Ref 'AWS::Region', '.s3']]
以下是我的完整源文件和日志的要点。
已识别问题的更新
我指向S3的VPCE端点SheltersVPCS3Endpoint似乎在dBMigration之前被删除，这就是我收到403的原因。
对于纯Cloudformation，我想通过将DependsOn放在dbMigration上可以很容易地解决这个问题，但对于无服务器，这似乎是不可能的。
经过与AWS支持部门的长期调查，我们发现SheltersVPCS3Endpoint在dbMigration被删除之前就被删除了，因此Lambda fn无法与触发超时的S3 bucket取得任何联系。
由于不可能向Serverless中的函数添加任何DependsOn，我不得不从Serverless迁移到Cloudformation。当我添加以下内容时，它似乎得到了解决。
DbMigrationLambdaFunction:
DependsOn:
- SheltersVPCS3Endpoint
您需要给lambda函数正确的权限。如果添加
provider:
name: aws
iamRoleStatements:
$ref: ./iamRoleStatements.json
到您的无服务器配置
然后构造你的iamRoleStatements.json，为S3存储桶授予函数权限，这些存储桶与你的无服务器配置位于同一目录中
[
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": "*"
}
]
这确实让你所有的资源都有权对你的s3桶做他们想做的每一件事
如果您想了解有关使用IAM i无服务器功能的更多信息，请查看https://serverless.com/blog/abcs-of-iam-permissions/