aws-lambda - AWS CloudFormation 将 SNS 触发器设置为 Lambda

Question

我想在 CloudFormation 模板中添加 SNS 作为 Lambda 的触发器，但它对我不起作用。下面是我应用的代码，我获得了 lambda、sns 和 lambda 订阅 SNS，但我无法向 lambda 添加触发器。有人知道该怎么做吗？

LambdaRole:
Type: 'AWS::IAM::Role'
Properties:
  AssumeRolePolicyDocument:
    Version: "2012-10-17"
    Statement:
      - Effect: Allow
        Principal:
          Service:
            - lambda.amazonaws.com
        Action:
          - 'sts:AssumeRole'
  Path: /
  Policies:
    - PolicyName: lambda_policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: '*'
            Resource: '*'

Lambdafunction:
Type: AWS::Lambda::Function
Properties:
  Handler: index.handler
  Role: !GetAtt LambdaRole.Arn
  # Role: !GettAtt [LambdaRole, Arn]
  Code:
    S3Bucket: lambda-s3
    S3Key: lambda.zip
  Runtime: python3.9
  Timeout: 30

PermissionSNStoLambda:
Type: 'AWS::Lambda::Permission'
Properties:
  Action: 'lambda:InvokeFunction'
  FunctionName: !Ref Lambdafunction
  Principal: sns.amazonaws.com

test2Topic:
Type: 'AWS::SNS::Topic'
Properties:
  DisplayName: Scale of Test Web group
  Subscription:
    - Protocol: lambda
      Endpoint: !GetAtt Lambdafunction.Arn   

  SNSPolicy:
Type: 'AWS::SNS::TopicPolicy'
Properties:
  Topics:
    - !Ref test2Topic
  PolicyDocument:
    Version: '2012-10-17'
    Statement:
      - Effect: Allow
        Principal: AWS: '*'
        Action:
          - 'SNS:GetTopicAttributes'
          - 'SNS:SetTopicAttributes'
          - 'SNS:AddPermission'
          - 'SNS:RemovePermission'
          - 'SNS:DeleteTopic'
          - 'SNS:Subscribe'
          - 'SNS:ListSubscriptionsByTopic'
          - 'SNS:Publish'
          - 'SNS:Receive'
        Resource: !Ref test2Topic

这是我用来添加触发器的最合逻辑的方法，但没有成功:

SNSTriggersLambda:            
Type: AWS::Lambda::EventInvokeConfig
Properties: 
  DestinationConfig: 
      OnFailure:
        Destination: !Ref test2Topic
      OnSuccess:
        Destination: !Ref test2Topic
  FunctionName: !Ref Lambdafunction
  MaximumEventAgeInSeconds: 70
  MaximumRetryAttempts: 1
  Qualifier: $LATEST

Answer 1

我刚刚设法解决了这个问题。我需要在权限部分添加一行，说明 SNS 主题的源 ARN:

  PermissionSNStoLambda:
Type: 'AWS::Lambda::Permission'
Properties:
  Action: 'lambda:InvokeFunction'
  FunctionName: !Ref Lambdafunction
  Principal: sns.amazonaws.com
  SourceArn: !Ref test2Topic

现在可以了!