AWS lambda 函数中的循环依赖

Question

以下是 lambda 函数的 template.yaml。我正在尝试添加访问status 数据库的权限。但是，它需要数据库存在，反之亦然，因此我收到DynamoDBIamPolicy 的循环依赖错误。我该如何解决这个问题？

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: An AWS Serverless Specification template describing your function.
Resources:
  friendTeachers:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: friendTeachers/index.handler
      Runtime: nodejs6.10
      Description: ''
      MemorySize: 128
      Timeout: 15
  status:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: status
      AttributeDefinitions:
        - AttributeName: screenName
          AttributeType: S
      KeySchema:
        - AttributeName: screenName
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
  # A policy is a resource that states one or more permssions. It lists actions, resources and effects.
  DynamoDBIamPolicy: 
    Type: 'AWS::IAM::Policy'
    DependsOn: status
    Properties:
      PolicyName: lambda-dynamodb
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:DescribeTable
              - dynamodb:Query
              - dynamodb:Scan
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:DeleteItem
              - dynamodb:batchWriteItem
            Resource: arn:aws:dynamodb:*:*:table/status
      Roles:
        - Ref: IamRoleLambdaExecution

Answer 1

您缺少指定 lambda 服务可以AssumeRole 的角色。该角色需要有一个关联的策略，该策略指定可以在 DynamoDb 表中执行的操作。在下面找到一个示例，说明您要完成的工作：

---
AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: An AWS Serverless Specification template describing your function.
Resources:
  friendTeachersFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket:
          Ref: LambdaCodeBucket
        S3Key:
          Ref: LambdaCodePath
      Handler: friendTeachers/index.handler
      Runtime: "nodejs6.10"
      Description: ''
      MemorySize: 128
      Timeout: 15
      Role:
        Fn::GetAtt:
        - friendTeachersExecutionRole
        - Arn
  friendTeachersExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: UseDBPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
              - dynamodb:DescribeTable
              - dynamodb:Query
              - dynamodb:Scan
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:DeleteItem
              - dynamodb:batchWriteItem
            Resource: arn:aws:dynamodb:*:*:table/status
  APIDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: status
      AttributeDefinitions:
        - AttributeName: screenName
          AttributeType: S
      KeySchema:
        - AttributeName: screenName
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1

注意 Code.S3Bucket 和 Code.S3Key 被定义为参数。当您在 AWS 控制台中创建堆栈时，您可以在那里指定路径。