AWS Lambda 从 Codepipeline 调用权限被拒绝错误答案

【问题标题】：AWS Lambda invoke from Codepipeline permission denied errorAWS Lambda 从 Codepipeline 调用权限被拒绝错误
【发布时间】：2021-09-30 05:52:15
【问题描述】：

我已将管道设置为调用 AWS Lamba 函数。运行30分钟后显示错误

AWS Lambda 函数 cloudfront-invalidation 未能返回结果。检查函数以验证它是否有权调用 PutJobSuccessResult 操作并调用 PutJobSuccessResult。

Lambda 角色有权设置 PutJobSuccessResult 和 Codepipeline Service 角色有权调用 lambda 函数。

这是我的 lambda 代码：

import boto3
import time

def lambda_handler(context, event):

    sts_connection = boto3.client('sts')
    acct_b = sts_connection.assume_role(
        RoleArn="arn:aws:iam::1234567890:role/AssumeRole",
        RoleSessionName="cross_acct_lambda"
    )
    
    ACCESS_KEY = acct_b['Credentials']['AccessKeyId']
    SECRET_KEY = acct_b['Credentials']['SecretAccessKey']
    SESSION_TOKEN = acct_b['Credentials']['SessionToken']

    client = boto3.client(
        'cloudfront',
        aws_access_key_id=ACCESS_KEY,
        aws_secret_access_key=SECRET_KEY,
        aws_session_token=SESSION_TOKEN,
    )
    
    response = client.create_invalidation(
        DistributionId='ABC',
        InvalidationBatch={
            'Paths': {
                'Quantity': 1,
                'Items': [
                    '/*',
                ]
            },
            'CallerReference': str(time.time()).replace(".", "")
        }
    )
    invalidation_id = response['Invalidation']['Id']
    
    print("Invalidation created successfully with Id: " + invalidation_id)
    
    pipeline = boto3.client('codepipeline')
    
    response = pipeline.put_job_success_result(
        jobId= event['CodePipeline.job']['id'] 
    )
    return response

【问题讨论】：

任何 lambda 错误日志？
您能否展示 lambda 执行角色和代码管道角色的 iam 策略？
Lambda 角色策略：{ "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:*" ], "Effect": "Allow", "Resource": "arn:aws:logs:*:*:*" }, { "Action": [ "codepipeline:PutJobSuccessResult", "codepipeline:PutJobFailureResult" ], "Effect": "Allow", "Resource": "*" } ] } Codepipeline 角色策略：AWSLambdaBasicExecutionRole

标签： python python-3.x aws-lambda aws-codepipeline

【解决方案1】：

问题已解决。下面更新了 lambda：

import boto3
import time
import json
import logging

def lambda_handler(event, context):

    sts_connection = boto3.client('sts')
    acct_b = sts_connection.assume_role(
        RoleArn="arn:aws:iam::123456789:role/CloudfrontAssumeRole",
        RoleSessionName="cross_acct_lambda"
    )
    
    ACCESS_KEY = acct_b['Credentials']['AccessKeyId']
    SECRET_KEY = acct_b['Credentials']['SecretAccessKey']
    SESSION_TOKEN = acct_b['Credentials']['SessionToken']

    client = boto3.client(
        'cloudfront',
        aws_access_key_id=ACCESS_KEY,
        aws_secret_access_key=SECRET_KEY,
        aws_session_token=SESSION_TOKEN,
    )
    
    response = client.create_invalidation(
        DistributionId='ABCD',
        InvalidationBatch={
            'Paths': {
                'Quantity': 1,
                'Items': [
                    '/*',
                ]
            },
            'CallerReference': str(time.time()).replace(".", "")
        }
    )
    invalidation_id = response['Invalidation']['Id']
    
    print("Invalidation created successfully with Id: " + invalidation_id)
    
    logger = logging.getLogger()
    logger.setLevel(logging.INFO)
    logger.debug(json.dumps(event))
 
    codepipeline = boto3.client('codepipeline')
    job_id = event['CodePipeline.job']['id']
 
    try:
        logger.info('Success!')
        response = codepipeline.put_job_success_result(jobId=job_id)
        logger.debug(response)
    except Exception as error:
        logger.exception(error)
        response = codepipeline.put_job_failure_result(
            jobId=job_id,
            failureDetails={
              'type': 'JobFailed',
              'message': f'{error.__class__.__name__}: {str(error)}'
            }
        )
        logger.debug(response)

【讨论】：