用于 SQS Lambda 触发器的消息

Question

我有触发 lambda 的 SQS。

当我将消息放入 SQS 队列时，它会显示消息在飞行中，而我的 lambda 无法处理消息。

我的 Lambda 具有以下权限

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sqs:DeleteMessage",
                "sqs:GetQueueUrl",
                "sqs:ListDeadLetterSourceQueues",
                "sqs:DeleteMessageBatch",
                "sqs:ReceiveMessage",
                "sqs:GetQueueAttributes",
                "sqs:ListQueueTags"
            ],
            "Resource": "*"
        }
    ]
}

它还具有以下权限

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:us-east-1:5722*****:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:us-east-1:5722****:log-group:/aws/lambda/815223_Test:*"
            ]
        }
    ]
}

当我附加“管理员访问”权限时，它起作用并且 lambda 被触发。 我不确定我在这里缺少哪个权限。我的 SQS 队列未加密。

Answer 1

查看 CloudTrail 以确定 API 失败的根本原因。还要检查用于 SQS 的队列策略。

对于默认 SQS 和 Lambda 组合，您只需要以下权限。

- "SQS:SendMessage"
- "SQS:ReceiveMessage"
- "SQS:DeleteMessage"
- "SQS:GetQueueAttributes"

以下是供您参考的示例 CloudFormation 模板。

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Creates the SQS and Lambda pattern
Resources:
  # SQS queue and queue policy
  FileProcessingEventsQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: "FileProcessingEventsQueue"
      VisibilityTimeout: 60
  FileProcessingEventsQueuePolicy:
    Type: AWS::SQS::QueuePolicy
    Properties:
      Queues:
        - !Ref FileProcessingEventsQueue
      PolicyDocument:
        Statement:
          - Action:
              - "SQS:*"
            Effect: "Allow"
            Resource: !GetAtt FileProcessingEventsQueue.Arn
            Principal:
              AWS: "*"
            Condition:
              StringEquals:
                aws:SourceAccount: !Sub "${AWS::AccountId}"
  # Lambda function and role for handling the SQS events
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: InlinePolicy
          PolicyDocument:
            Statement:
              - Action:
                  - "SQS:SendMessage"
                  - "SQS:ReceiveMessage"
                  - "SQS:DeleteMessage"
                  - "SQS:GetQueueAttributes"
                Effect: Allow
                Resource: "*"
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: "Lambda for the event processing"
      Runtime: "python3.7"
      Role: !GetAtt LambdaExecutionRole.Arn
      Handler: index.handler
      MemorySize: 128
      Timeout: 60
      Code:
        ZipFile: |
          import json
          import logging

          # Configure logging

          LOGGER = logging.getLogger(__name__)
          LOGGER.setLevel(logging.DEBUG)

          def handler(event, context):
              LOGGER.debug(json.dumps(event, indent=4, default=str))
              data = {'status': 'event printed'}
              return data
  SQSAndLambdaMapping:
    Type: AWS::Lambda::EventSourceMapping
    Properties:
      EventSourceArn: !GetAtt FileProcessingEventsQueue.Arn
      FunctionName: !GetAtt LambdaFunction.Arn
Outputs:
  SQSQueue:
    Description: File processing queue
    Value: !Ref FileProcessingEventsQueue