触发 AWS Lambda 函数以扫描 ECR 存储库答案

【问题标题】：Trigger AWS Lambda function to scan ECR Repositores触发 AWS Lambda 函数以扫描 ECR 存储库
【发布时间】：2019-11-14 08:25:08
【问题描述】：

我想确保为 ECR 扫描自动启用现有/新 ECR 存储库。我已经写下了 lambda 函数，但它在执行时出错。我的代码：

from datetime import datetime

def lambda_handler(event, context):
  print(event)
  repository = event(repository)
  scan_client = boto3.client('ecr')
  response = client.put_image_scanning_configuration(registryId='string',repositoryName='repository',imageScanningConfiguration={'scanOnPush': True})

它似乎无法识别存储库。错误如下：

Response:
{
  "errorMessage": "local variable 'repository' referenced before assignment",
  "errorType": "UnboundLocalError",
  "stackTrace": [
    [
      "/var/task/index.py",
      7,
      "lambda_handler",
      "repository = event(repository)"
    ]
  ]
}

【问题讨论】：

repository = event(repository) 应该是对特定存储库名称的引用还是什么？它可能应该是 repository = event('repository')，因为现在 Python 正在寻找一个名为 repository 的对象，但没有找到。
您能提供您正在打印的活动吗？这应该在 lambda 日志中。事件应该是一个字典，所以你想要类似event['repository']

标签： python python-3.x amazon-web-services aws-lambda amazon-ecr

【解决方案1】：

当然，我使用 CFN 脚本创建的事件是： CloudWatchTrigger: Type: AWS::Events::Rule Properties: Description: 'Trigger ecr-scanning lambda' Name: 'ECR-scanning-lambda-trigger' ScheduleExpression: "cron(0 8 * * ? *)" Targets: - Arn: !GetAtt ECRScanningLambda.Arn Id: !Ref AWS::StackName EventPattern: !Sub | { "source": [ "aws.ecr" ], "detail-type": [ "AWS API Call via CloudTrail" ], "detail": { "eventSource": [ "ecr.amazonaws.com" ], "eventName": [ "CreateRepository" ] } }

并以 json 格式创建事件日志：

{'version': '0', 'id': '9231de02-71ce-3229-465b-0de35af14c83', 'detail-type': 'AWS API Call via CloudTrail', 'source': 'aws.ecr', 'account': '778784494011', 'time': '2019-11-13T22:50:03Z', 'region': 'us-east-1', 'resources': [], 'detail': {'eventVersion': '1.05', 'userIdentity': {'type': 'AssumedRole', 'principalId': 'AROA3KUZMKG5QPDELUJVP:f2b4e859-fb58-416a-a936-0fd489ed8747', 'arn': 'arn:aws:sts::778784494011:assumed-role/ret-datain-mapping-svc-master-deploy-ExecutionRole-1UDREMWKP0SQB/f2b4e859-fb58-416a-a936-0fd489ed8747', 'accountId': '778784494011', 'accessKeyId': 'ASIAIIJ7YJLEZDBCYTHQ', 'sessionContext': {'sessionIssuer': {'type': 'Role', 'principalId': 'AROA3KUZMKG5QPDELUJVP', 'arn': 'arn:aws:iam::778784494011:role/gbts/wsg-devops/ecs-service/ret-datain-mapping-svc-master-deploy-int/ret-datain-mapping-svc-master-deploy-ExecutionRole-1UDREMWKP0SQB', 'accountId': '778784494011', 'userName': 'ret-datain-mapping-svc-master-deploy-ExecutionRole-1UDREMWKP0SQB'}, 'webIdFederationData': {}, 'attributes': {'mfaAuthenticated': 'false', 'creationDate': '2019-11-13T13:32:20Z'}}, 'invokedBy': 'AWS Internal'}, 'eventTime': '2019-11-13T22:50:03Z', 'eventSource': 'ecr.amazonaws.com', 'eventName': 'BatchGetImage', 'awsRegion': 'us-east-1', 'sourceIPAddress': 'AWS Internal', 'userAgent': 'AWS Internal', 'requestParameters': {'imageIds': [{'imageTag': '5LtgRyzi'}], 'acceptedMediaTypes': ['application/json', 'application/vnd.oci.image.manifest.v1+json', 'application/vnd.oci.image.index.v1+json', 'application/vnd.docker.distribution.manifest.v2+json', 'application/vnd.docker.distribution.manifest.list.v2+json', 'application/vnd.docker.distribution.manifest.v1+prettyjws'], 'repositoryName': 'ret-datain-mapping-svc-master', 'registryId': '778784494011'}, 'responseElements': None, 'requestID': 'ff3d48b9-e988-41fc-b50a-d89dc19a5a70', 'eventID': '5cb34f61-2933-451a-940b-3d6dcdc60485', 'resources': [{'accountId': '778784494011', 'ARN': 'arn:aws:ecr:us-east-1:778784494011:repository/ret-datain-mapping-svc-master'}], 'eventType': 'AwsApiCall', 'vpcEndpointId': 'vpce-05bef348d7105d0c3'}}

【讨论】：

基于上面的输出，我用下面的 boto3 函数更新了 lambda，但给出了另一个错误：import boto3 from botocore.config import Config from datetime import datetime def lambda_handler(event, context): print(event) print(event['detail']['requestParameters']['repositoryName']) 但它带有错误：Response: { "errorMessage": "'detail'", "errorType": "KeyError", "stackTrace": [ [ "/var/task/index.py"
我认为您不会有任何东西可以扫描规则创建图像，对吧？您不希望您的规则在 PutImage 上触发吗？每当更新图像时，您的 lambda 就会触发