AWS Lambda 访问 API Gateway

Question

我有一个如下定义的无服务器函数

UserLockoutLambda:
    Type: "AWS::Lambda::Function"
    Properties:
        Handler: "com.url.ftp.userlockout.LockUserLambda::handleRequest"
        Role: !GetAtt UserLockoutLambdaRole.Arn
        Code:
            S3Bucket: !Ref lambdas3bucketname
            S3Key: !Ref lambdas3key
        Runtime: "java8"
        MemorySize: 256
        Timeout: 300
        FunctionName: !Sub 'url-lambda-lam-${AWS::Region}-${envtag}'
        Environment:
            Variables:
                USER_MGMT_API_URL:
                    !Sub 'https://urlapi.${envtag}.${hostedzonename}/uma/LATEST/'
                USER_MGMT_API_KEY_NAME:
                    !Sub 'url-cfmusermgmt-apikey-${envtag}'
        Tags:
            - Key: Name
                Value: !Sub 'url-cfmuserlockoutlambda-lam-${AWS::Region}-${envtag}'
            - Key: function
                Value: lambda function that locks the proftp user when failed login attempts reach threshold value

我已经设置了角色和策略（这是为了让 lambda 访问 apiGateway）

UserLockoutLambdaRole:
    Type: "AWS::IAM::Role"
    Properties:
        RoleName: !Sub "url-lambda-iam-${AWS::Region}-role_${envtag}"
        AssumeRolePolicyDocument:
            Version: "2012-10-17"
            Statement:
                - Effect: "Allow"
                    Principal:
                        Service:
                            - "lambda.amazonaws.com"
                            - "apigateway.amazonaws.com"
                    Action:
                        - "sts:AssumeRole"
        Path: "/"
        ManagedPolicyArns:
            - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
            - !Ref UserLockoutLambdaManagedPolicy

UserLockoutLambdaManagedPolicy:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
        ManagedPolicyName: !Sub "url-lambda-iam-${AWS::Region}-policy_${envtag}"
        PolicyDocument:
            Version: "2012-10-17"
            Statement:
                - Effect: "Allow"
                    Action:
                        - "execute-api:Invoke"
                    Resource:
                        - !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${userMgmtApiId}/*/PUT/ftpuser/lockuser/*'
                        - !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${userMgmtApiId}/*/PUT/ftpuser/invalidlogin/*'
                        - !Sub 'arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${userMgmtApiId}/*/PUT/ftpuser/unlockuser/*'
                - Effect: "Allow"
                    Action:
                        - "apigateway:GET"
                    Resource:
                        - !Sub 'arn:aws:apigateway:${AWS::Region}::/apikeys'

但是，当我从代码中调用 api 网关时，我收到以下错误：

"Message": "User: arn:aws:sts::<id>:assumed-role/url-lambda-iam-us-east-1-role_i2388/url-cfmuserlockoutlambda-lam-us-east-1-i2388
is not authorized to perform: execute-api:Invoke on resource: 
arn:aws:execute-api:us-east-1:********3636:apiGatewayID/LATEST/PUT/ftpuser/invalidlogin" }

从外观上看，Lambda 函数名称已添加到代入角色中，而策略显然不是为此而编写的。我不确定为什么要附加函数名称，以及我可以做些什么来更改策略以使其正常工作。

非常感谢任何帮助。

谢谢 卡提克

Answer 1

我发现了一个可能有问题的地方 您的 lambda 授权在资源上调用 api - '.../invalidlogin/*'

但试图调用 '.../invalidlogin'

我认为您需要从资源 arn 中删除 '/*'