Cloud Formation：链接到 Lambda 的 S3 给出了 ARN 格式不正确

Question

我正在尝试使用 CloudFormation 部署一个在 ObjectCreate 上调用 Lambda 函数的 S3 存储桶。

这是我的资源：

"ExampleFunction": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Handler": "index.lambda_handler",
                "Code": {
                    "S3Bucket": "bucketname",
                    "S3Key": "something.zip"
                },
                "Runtime": "python3.6",
                "Role": {
                    "Fn::GetAtt": [
                        "LambdaExecutionRole",
                        "Arn"
                    ]
                }
            }
        },
        "InputDataBucket": {
            "Type": "AWS::S3::Bucket",
            "Properties": {
                "BucketName": "input-data",
                "NotificationConfiguration": {
                    "LambdaConfigurations": [
                        {
                            "Function": {
                                "Ref": "ExampleFunction"
                            },
                            "Event": "s3:ObjectCreated:*",
                            "Filter": {
                                "S3Key": {
                                    "Rules": [
                                        {
                                            "Name": "suffix",
                                            "Value": "zip"
                                        }
                                    ]
                                }
                            }
                        }
                    ]
                }
            }
        },
        "LambdaInvokePermission": {
            "Type": "AWS::Lambda::Permission",
            "Properties": {
                "Action": "lambda:InvokeFunction",
                "FunctionName": {
                    "Fn::GetAtt": [
                        "ExampleFunction",
                        "Arn"
                    ]
                },
                "Principal": "s3.amazonaws.com",
                "SourceAccount": {
                    "Ref": "AWS::AccountId"
                },
                "SourceArn": {
                    "Fn::Join": [
                        ":",
                        [
                            "arn",
                            "aws",
                            "s3",
                            "",
                            "",
                            {
                                "Ref": "InputDataBucket"
                            }
                        ]
                    ]
                }
            }
        }

我已尝试遵循通知配置的文档，其中指出可能存在循环依赖。但是，如果我按照说明进行操作，我会得到同样的错误。参考：https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-notificationconfig.html

当我尝试创建堆栈时，S3 总是错误地中断它 "The ARN is not well formed"

我尝试了很多方法，但总是收到同样的错误。

Answer 1

只要我提前知道 S3 存储桶名称（mybucketname，我就可以让它工作）。如果您事先不知道存储桶名称，则可以增强此功能以将存储桶名称请求为堆栈参数，它应该仍然有效。如果您需要自动生成存储桶名称（因此您无法提前预测名称），那么这将不起作用，您必须走 create/update 路线。

这里的关键是从已知的存储桶名称手动创建 S3 存储桶 ARN，而不是依赖 "Ref": "InputDataBucket" 为您获取存储桶名称。

同样值得一读this support article。

{
    "AWSTemplateFormatVersion": "2010-09-09",

    "Description": "Whosebug-48037497",

    "Resources" : {
        "ExampleFunction": {
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Handler": "index.lambda_handler",
                "Code": {
                    "S3Bucket": "bucketname",
                    "S3Key": "something.zip"
                },
                "Runtime": "python3.6",
                "Role": {
                    "Fn::GetAtt": [
                        "LambdaExecutionRole",
                        "Arn"
                    ]
                }
            }
        },
        "LambdaInvokePermission": {
            "Type": "AWS::Lambda::Permission",
            "DependsOn": [ "ExampleFunction" ],
            "Properties": {
                "Action": "lambda:InvokeFunction",
                "FunctionName": {
                    "Fn::GetAtt": [
                        "ExampleFunction",
                        "Arn"
                    ]
                },
                "Principal": "s3.amazonaws.com",
                "SourceAccount": {
                    "Ref": "AWS::AccountId"
                },
                "SourceArn": "arn:aws:s3:::mybucketname"
            }
        },
        "InputDataBucket": {
            "Type": "AWS::S3::Bucket",
            "DependsOn": [ "ExampleFunction", "LambdaInvokePermission" ],
            "Properties": {
                "BucketName": "mybucketname",
                "NotificationConfiguration": {
                    "LambdaConfigurations": [
                        {
                            "Function": { "Fn::GetAtt" : [ "ExampleFunction", "Arn" ] },
                            "Event": "s3:ObjectCreated:*"
                        }
                    ]
                }
            }
        }
    }
}