调用 CreateChangeSet 操作时出现 ValidationError：模板错误：Fn::GetAtt 的实例引用未定义的资源”答案

【问题标题】：Getting ValidationError when calling the CreateChangeSet operation: Template error: instance of Fn::GetAtt references undefined resource"调用 CreateChangeSet 操作时出现 ValidationError：模板错误：Fn::GetAtt 的实例引用未定义的资源”
【发布时间】：2021-11-21 02:21:06
【问题描述】：

我正在尝试使用 sam 模板在堆栈下方部署它应该部署 lambda 并添加一个 s3 触发器，但我收到以下错误

Getting ValidationError when calling the CreateChangeSet operation: Template error: instance of Fn::GetAtt references undefined resource"

我不确定这里出了什么问题来得到这样的错误

yml 模板


AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  Environment:
    Type: String
  S3:
    Type: String
  Key:
    Type: String
  SecretMgr:
    Type: String
  
Resources:
  LambdaS3ToKinesis:  
    Type: AWS::Serverless::Function
    Properties:
      Handler: lambda_function.lambda_handler
      Runtime: python3.7
      Timeout: 60
      FunctionName: !Sub "my_s3_to_kinesis" 
      CodeUri: ./test/src
      Role: !GetAtt testKinesisRole.Arn
      Description: "My lambda"
      Environment:
        Variables:
          KINESIS_STREAM: !Sub "test_post_kinesis"
          DDB_TRACKER_TABLE: my_tracker_table
          ENVIRONMENT: !Sub "${Environment}"
          BUCKET_NAME: !Sub "${S3}" 
      Events:
          FileUpload:
              Type: S3
              Properties:
                Bucket: !Sub "${S3}"
                Events: s3:ObjectCreated:*
                Filter:
                  S3Key:
                    Rules:
                      - Name: prefix
                        Value: "${Environment}/test1/INPUT/"
                      - Name: suffix
                        Value: ".json"
                      - Name: prefix
                        Value: "${Environment}/test2/INPUT/"
                      - Name: suffix
                        Value: ".json"                     
                               
          


  LambdaTest1KinesisToDDB:
    Type: AWS::Serverless::Function
    Properties:
      Handler: lambda_function.lambda_handler
      Runtime: python3.7
      Timeout: 60
      FunctionName: !Sub "${Environment}_test1_to_ddb"
      CodeUri: test1_kinesis_to_ddb/src/
      Role: !GetAtt testKinesisToDDBRole.Arn
      Description: "test post kinesis"
      Layers:
        - !Ref LambdaLayertest1
      Environment:
        Variables:
          BUCKET_NAME: !Sub "${S3}"
          DDB_ACC_PLCY_TABLE:test1
          DDB_TRACKER_TABLE: test_tracker
          ENVIRONMENT: !Sub "${Environment}"
          S3_INVALID_FOLDER_PATH: invalid_payload/
          S3_RAW_FOLDER_PATH: raw_payload/
          S3_UPLOAD_FLAG: false
      Events:
        KinesisEvent:
          Type: Kinesis
          Properties:
            Stream: !GetAtt Kinesistest1.Arn
            StartingPosition: LATEST
            BatchSize: 1
            Enabled: true
            MaximumRetryAttempts: 0

  LambdaLayerTest1KinesisToDDB:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: !Sub "${Environment}_test1_kinesis_to_ddb_layer"
      ContentUri: test1_kinesis_to_ddb/dependencies/
      CompatibleRuntimes:
        - python3.7
    Metadata:
      BuildMethod: python3.7

  testKinesisRole: 
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${Environment}_s3_to_kinesis_role"
      Description: Role for first lambda
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - s3.amazonaws.com   
                - lambda.amazonaws.com
            Action:
              - "sts:AssumeRole"
      Policies:
        - PolicyName: !Sub "${Environment}_s3_to_kinesis_policy"
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:DeleteObject  
                Resource:
                  - !Sub "arn:aws:s3:::${S3}/*" 
                  - !Sub "arn:aws:s3:::${S3}"
              - Effect: Allow
                Action:
                  - kinesis:PutRecord
                Resource:
                  - !Sub "arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:mystream1/${Environment}_test1"
                  - !Sub "arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:mystream2/${Environment}_test2"
              - Effect: Allow
                Action:
                  - lambda:*
                  - cloudwatch:*
                Resource: "*"
              - Effect: Allow
                Action:
                  - dynamodb:Put*
                  - dynamodb:Get*
                  - dynamodb:Update*
                  - dynamodb:Query
                Resource:
                  - !GetAtt Dynamomytracker.Arn
              - Effect: Allow
                Action:
                  - kms:*
                Resource:
                  - !Sub "${Key}"

  testKinesisToDDBRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${Environment}_test1_to_ddb_role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - kinesis.amazonaws.com
                - lambda.amazonaws.com
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - "arn:aws:iam::aws:test/service-role/AWSLambdaBasicExecutionRole"
      Policies:
        - PolicyName: !Sub "${Environment}_test1_kinesis_to_ddb_policy"
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:DeleteObject
                Resource:
                  - !Sub "arn:aws:s3:::${S3}/*"
                  - !Sub "arn:aws:s3:::${S3}"
              - Effect: Allow
                Action:
                  - kinesis:Get*
                  - kinesis:List*
                  - kinesis:Describe*

                Resource:
                  - !GetAtt KinesisTest1.Arn
                  - !GetAtt KinesisTest2.Arn

              - Effect: Allow
                Action:
                  - dynamodb:Put*
                  - dynamodb:Get*
                  - dynamodb:Describe*
                  - dynamodb:List*
                  - dynamodb:Update*
                  - dynamodb:Query
                  - dynamodb:DeleteItem
                  - dynamodb:BatchGetItem
                  - dynamodb:BatchWriteItem
                  - dynamodb:Scan
                Resource:
                  - !Sub
                    - "${Table}*"
                    - { Table: !GetAtt "Dynamotest.Arn" }
                  - !Sub
                    - "${Table}*"
                    - { Table: !GetAtt "Dynamotest.Arn" }
                 
              - Effect: Allow
                Action:
                  - kms:*
                Resource:
                  - !Sub "${Key}"

  ######################################
  # Update for TEst2
  ######################################
  KinesisTest2:
    Type: AWS::Kinesis::Stream
    Properties:
      Name: !Sub ${Environment}_test2_kinesis
      StreamEncryption:
        EncryptionType: KMS
        KeyId: !Sub "${Key}"
      RetentionPeriodHours: 24
      ShardCount: 1

  LambdaLayerTest2KinesisToDDB:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: !Sub "${Environment}_test2_kinesis_to_ddb_layer"
      ContentUri: test2_kinesis_to_ddb/dependencies/
      CompatibleRuntimes:
        - python3.7
    Metadata:
      BuildMethod: python3.7

  LambdaTest2KinesisToDDB:
    Type: AWS::Serverless::Function
    Properties:
      Handler: lambda_function.lambda_handler
      Runtime: python3.7
      Timeout: 60
      FunctionName: !Sub "${Environment}_Test2_kinesis_to_ddb"
      CodeUri: Test2_kinesis_to_ddb/src/
      Role: !GetAtt testKinesisToDDBRole.Arn
      Description: "Test2"
      Layers:
        - !Ref LambdaLayerTest2KinesisToDDB
      Environment:
        Variables:
          BUCKET_NAME: !Sub "${S3}"
          DDB_ACC_PLCY_TABLE: my_table2
          DDB_TRACKER_TABLE: my_log
          ENVIRONMENT: !Sub "${Environment}"
          S3_INVALID_FOLDER_PATH: invalid_payload/
          S3_RAW_FOLDER_PATH: raw_payload/
          S3_UPLOAD_FLAG: false
      Events:
        KinesisEvent:
          Type: Kinesis
          Properties:
            Stream: !GetAtt KinesisTest2.Arn
            StartingPosition: LATEST
            BatchSize: 1
            Enabled: true
            MaximumRetryAttempts: 0

谁能帮我解决这个问题？我不确定模板中到底遗漏了什么以及如何解决此错误

【问题讨论】：

您有多个 GetAtt。哪个资源失败了？
您引用了不存在的 KinesisTest1 和 Kinesistest1。下次查看GetAtt 的每次用法，看看您指定的资源名称是否确实存在。记住它是区分大小写的。
是的@Marcin 我添加了遗漏的参考并且该问题已解决，但现在我收到以下错误“模板格式错误：无法识别的资源类型：[AWS::Serverless::Function, AWS::Serverless: :LayerVersion]（服务：AmazonCloudFormation；状态码：400；错误码：ValidationError；"
我看到你发布了一个新问题，并在我写的时候添加了Transform: AWS::Serverless-2016-10-31。因此，我将不胜感激接受我的回答，因为它帮助您通过了您在此问题中报告的错误。
进展如何？仍然不清楚为什么会出现该错误？

标签： amazon-web-services yaml amazon-cloudformation aws-sam aws-sam-cli

【解决方案1】：

您正在使用AWS Serverless Application Model，并且您的模板不符合其format。例如，它缺少的 required Transform 声明：

Transform: AWS::Serverless-2016-10-31

可能还有很多其他问题，因为此时您的模板既不是 CloudFormation 也不是 Serverless。

【讨论】：