如何引用 SAM 模板中定义的角色？答案

【问题标题】：How do I reference a role defined in a SAM template?如何引用 SAM 模板中定义的角色？
【发布时间】：2019-10-30 06:49:42
【问题描述】：

我是 AWS SAM 模板的新手，希望能够使用一系列策略创建角色，然后为 Lambda 函数引用该角色。但是，我在尝试部署时收到以下错误：

“角色”中的值“MyRole”未能满足约束：成员必须满足正则表达式模式： arn:(aws[a-zA-Z-]*)?:iam::\d{12}:role/?[a-zA-Z_0-9+=,.@-_/]+

这个答案提到我可以将策略直接添加到函数中，但我会有很多需要相同策略的函数，所以这不是一个非常干燥的方法 IAM role inside SAM template

是我不能在新创建的角色上使用!GetAtt 的问题吗？

这就是我的template.yml 的样子：

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  OMW Backend Services

Globals:
  Function:
    Timeout: 3

Resources:

  MyRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonRDSFullAccess'
        - 'arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - 'lambda.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Policies:       
          PolicyName: 'ParameterStoreDevParameterAccess'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  - 'ssm:GetParameter*'
                Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/dev/*'
        -
          PolicyName: 'ParameterStoreDevLambdaBasicExecution'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource: '*'
        -
          PolicyName: 'ParameterStoreDevXRayAccess'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  - 'xray:PutTraceSegments'
                  - 'xray:PutTelemetryRecords'
                Resource: '*'
  MyFunction:
    Type: AWS::Serverless::Function
      Tracing: Active
      CodeUri: functions/src/
      Handler: lookup.lambdaHandler
      Runtime: nodejs10.x
      Timeout: 10
      MemorySize: 256
      Role: !GetAtt MyRole.Arn
      Events:
        Lookup:
          Type: Api
          Properties:
            Path: /somePath/{id}
            Method: get

【问题讨论】：

标签： aws-lambda amazon-cloudformation aws-sam

【解决方案1】：

您的 lambda 函数定义中缺少 Properties 标记，并且缺少策略列表 - 对于第一个策略。

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  OMW Backend Services

Globals:
  Function:
    Timeout: 3

Resources:

  MyRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonRDSFullAccess'
        - 'arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - 'lambda.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Policies:
        -
          PolicyName: 'ParameterStoreDevParameterAccess'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  - 'ssm:GetParameter*'
                Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/dev/*'
        -
          PolicyName: 'ParameterStoreDevLambdaBasicExecution'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  - 'logs:CreateLogGroup'
                  - 'logs:CreateLogStream'
                  - 'logs:PutLogEvents'
                Resource: '*'
        -
          PolicyName: 'ParameterStoreDevXRayAccess'
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              -
                Effect: Allow
                Action:
                  - 'xray:PutTraceSegments'
                  - 'xray:PutTelemetryRecords'
                Resource: '*'
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Tracing: Active
      CodeUri: functions/src/
      Handler: lookup.lambdaHandler
      Runtime: nodejs10.x
      Timeout: 10
      MemorySize: 256
      Role: !GetAtt MyRole.Arn
      Events:
        Lookup:
          Type: Api
          Properties:
            Path: /somePath/{id}
            Method: get

【讨论】：

谢谢@Prajilesh 抱歉，这是一个复制/粘贴/错字错误，因为我将函数和角色的名称更改为在此处发布并打错字。我发现的一个问题是 AmazonRDSFullAccess 角色不正确，应该是 - 'arn:aws:iam::aws:policy/AmazonRDSFullAccess' 我注意到运行 sam 包时并不总是重新创建 packaged.yml 文件，这意味着，虽然我现在有这个工作，但最终的改变是什么使它工作尚不清楚。
@RossCoundon 很高兴知道问题已得到解决，我正在使用 sam validate 命令验证模板并注意到这些属性丢失了。