Aws lambda 函数添加权限错误:PolicyLengthExceededException

Question

我正在创建一个云监视事件，该事件应该在未来的特定时间调用aws lambda函数。我正在使用 aws nodejs 开发工具包，如下所述：http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/index.html

用于创建 CloudWatch 事件的代码块如下所示：

 module.exports.createReservationReminder = function (reservationModel, user, restaurant) {
return new Promise(function (resolve, reject) {
    const ruleName = "rsv_" + reservationModel.reservationId;
    const description = "Reservation reminder of `" + user.name + "` @ `" + restaurant.title + "` on `" + reservationModel.time + "`";
    let reservationTime = reservationModel.time;
    let lambdaFunctionName = module.exports.buildLamdaFunctionArn("restaurant")
    let alertTime = moment(reservationTime).tz(AppConfig.defaultTimezone).subtract( // Create alert 45 minute before a reservation
            45,
            'minutes'
        );
    let lambda = new AWS.Lambda({
        accessKeyId: AppConfig.accessKeyId,
        secretAccessKey: AppConfig.secretAccessKey,
        region: AppConfig.region
    });
    let scheduleExpression1 = "cron(" + alertTime.utc().format('m H D MMM ? YYYY') + ')';
    let ruleParams = {
        Name: ruleName, 
        Description: description,
        ScheduleExpression: scheduleExpression1,
        State: 'ENABLED',
    };
    cloudwatchevents.deleteRule({Name: ruleName}, function (err, deleteRuleData) { //remove if a previous rule was created halfway
        cloudwatchevents.putRule(ruleParams, function (err, ruleData) {  //create the rule 
            if (err) {
                reject(err)
            }
            else {

                let lambdaPermission = {
                    FunctionName: lambdaFunctionName,
                    StatementId: ruleName,
                    Action: 'lambda:InvokeFunction',
                    Principal: 'events.amazonaws.com',
                    SourceArn: ruleData.RuleArn
                };
                let removePermission = {
                    FunctionName: lambdaFunctionName,
                    StatementId: ruleName,
                }
                //now to create the rule's target, need to add permission to lambda
                lambda.removePermission(removePermission, function (err, removeLambdaData) { //remove if rule of same name was added as permission to this lambda before, ignore if rule not found error is thrown
                    lambda.addPermission(lambdaPermission, function (err, lamdaData) { //now add the permission
                        if (err) {
                            reject(err) // FAIL : throws error  PolicyLengthExceededException after ~50 cloudwatch events are registered to this lambda function
                        }
                        else {
                            let targetParams = {
                                Rule: ruleName,
                                Targets: [
                                    {
                                        Arn: module.exports.buildLamdaFunctionArn("restaurant"), 
                                        Id: ruleName, 
                                        Input: JSON.stringify({
                                            func: "notifyUserOfUpcomingReservation",
                                            data: {
                                                reservationId: reservationModel.reservationId
                                            }
                                        }),
                                    },
                                ]
                            };
                            cloudwatchevents.putTargets(targetParams, function (err, targetData) {
                                if (err) {
                                    reject(err)
                                }
                                else {
                                    resolve(targetData)
                                }
                            })
                        }
                    })
                })
            }
        });
    })

})

}

上述功能在前~50次工作正常(所以我可以轻松地提醒50个预订。然而，它最终总是会失败，并带有：

策略长度超出异常Lambda 函数访问策略限制为 20 KB。

HTTP 状态代码：400

这是有道理的，因为政策文件不能太大。那么解决这个问题的正确方法是什么：用lambda函数目标做无限的云观看事件提醒。

Answer 1

创建一个

角色并为该角色添加该策略或权限，然后您的 lambda 就可以代入角色并运行。您可以使用 AWS STS模块来实现此目的。

而不是每次都创建和删除权限。STS 将临时担任角色，然后执行代码。