更新堆栈以添加 S3 触发器时出错

Question

我使用cloudformation堆栈成功创建了一个lambda函数和S3存储桶。然后，我对堆栈进行了更新，以向 S3 存储桶添加触发器以调用 lambda 函数。

当我运行更新时，它给出以下错误：

Unable to validate the following destination configurations (Service: Amazon S3; Status Code: 400; Error Code: InvalidArgument; Request ID: XXXXX; S3 Extended Request ID: XXXXX

这是我用于将触发器添加到 S3 存储桶的更新 JSON：

"MyBucket": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketName":  "my-bucket",
"NotificationConfiguration": {
"LambdaConfigurations": [
{
"Event": "s3:ObjectCreated:*",
"Function": "arn:aws:lambda:ap-southeast-2:my-lambda-arn"
}
]
}

然后，我添加了一个 IAM 角色，以授予对 S3 存储桶的访问权限以调用 lambda 函数：

"ResourceAccess": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"lambda.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
},
"Path": "/",
"Policies": [
{
"PolicyName": "giveaccesstodeltas3",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "lambda:InvokeFunction",
"Resource": "arn:aws:lambda:ap-southeast-2:my-lambda-arn",
"Condition": {
"StringEquals": {
"AWS:SourceAccount": "123456"
},
"ArnLike": {
"AWS:SourceArn": "arn:aws:s3:::my-bucket"
}
}
}
]
}
}
]
}

它给出一个错误说：

Policy document should not specify a principal. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: XXXXXX)

Answer 1

要添加此触发器，您必须授予 S3 存储桶调用 lambda 函数的权限。此外，您的 lambda 必须有权调用它影响的任何服务。我的猜测是您缺少要授予的第一个权限：S3 存储桶调用 Lambda 函数的权限。

您可以创建类似于以下内容的策略，以向 S3 存储桶授予适当的权限：

{
"Version": "2012-10-17",
"Id": "default",
"Statement": [
{
"Sid": "<optional>",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "lambda:InvokeFunction",
"Resource": "<ArnToYourFunction>",
"Condition": {
"StringEquals": {
"AWS:SourceAccount": "<YourAccountId>"
},
"ArnLike": {
"AWS:SourceArn": "arn:aws:s3:::<YourBucketName>"
}
}
}
]
}

有关更多信息，请参阅此 AWS 文档。