CloudFormation：Lambda函数的无效权限

Question

I am trying to create an Api-Gateway as a Lambda proxy using just CloudFormation. There seems to be an issue with getting the correct permissions on the Lambda function even though I have looked all over and seemingly tried everything possible, I am getting nowhere. The documentation around some important small details seem to be missing, (or I am just misinterpreting them?).

Here is what I have:

    {
        "Description": "",
        "Parameters": {
            "IngressLambdaName": {
                "Type": "String",
                "Description": "Name of the lambda behind Api Gateway",
                "Default": "LambdaIngress"
            }
        },

        "Mappings": {

        },

        "Resources": {
            "ApiGatewayToLambdaRole": {
                "Type": "AWS::IAM::Role",
                "Properties": {
                    "AssumeRolePolicyDocument": {
                        "Version": "2012-10-17",
                        "Statement": [ {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [ "apigateway.amazonaws.com" ]
                            },
                            "Action": "sts:AssumeRole"
                        }]
                    },
                    "Policies": [{
                        "PolicyName": "ApiGatewayToLambdaPolicy",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [{
                                "Effect": "Allow",
                                "Action": [
                                    "lambda:InvokeFunction"
                                ],
                                "Resource": "*"
                            }]
                        }
                    }]
                }
            },

            "IngressLambda":{
                "Type": "AWS::Lambda::Function",
                "Properties": {
                    "Handler": "index.handler",
                    "FunctionName": {"Ref": "IngressLambdaName"},
                    "Runtime": "nodejs4.3",
                    "Role": { "Fn::GetAtt": ["**Role that isn't shown here**", "Arn"]},
                    "Code": {
                        "ZipFile": { "Fn::Join": ["", [
                            "exports.handler = function(event, context) {",
                    "  console.log('invoked the lambda!');",
                    "  context.succeed({statusCode: 200, headers: {}, body: JSON.stringify({message: 'invoked the lambda!'})});",
                    "};"
                        ]]}
                    }
                }

            },

            "IngressLambdaPermission":{
                "Type" : "AWS::Lambda::Permission",
                "Properties" : {
                    "Action" : "lambda:InvokeFunction",
                    "FunctionName" : { "Ref" : "IngressLambdaName"},
                    "Principal" : "apigateway.amazonaws.com",
                    "SourceArn" : {"Fn::Sub": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${RestApi}/*/POST/*"}
                },
                "DependsOn": ["IngressLambda"]
            },

            "RestApi": {
                "Type": "AWS::ApiGateway::RestApi",
                "Properties": {
                    "Name": "API Gateway"
                }
            },

            "TagModel": {
                "Type": "AWS::ApiGateway::Model",
                "Properties": {
                    "ContentType": "application/json",
                    "Name": "Tag",
                    "RestApiId": { "Ref": "RestApi" },
                    "Schema": {
                        "$schema": "http://json-schema.org/draft-04/schema#",
                        "title": "TagModel",
                        "type": "object",
                        "properties": {
                            "payload": {"type": "object"},
                            "domain": {"type": "string"}
                        }
                    }
                }
            },

            "TagsResource": {
                "Type": "AWS::ApiGateway::Resource",
                "Properties": {
                    "RestApiId": { "Ref": "RestApi" },
                    "ParentId": { "Fn::GetAtt": ["RestApi", "RootResourceId"] },
                    "PathPart": "tag"
                }
            },

            "TagsPost": {
                "Type": "AWS::ApiGateway::Method",
                "Properties": {
                    "ApiKeyRequired": "False",
                    "AuthorizationType": "NONE",
                    "HttpMethod": "POST",
                    "RestApiId": {"Ref": "RestApi"},
                    "ResourceId": { "Fn::GetAtt": ["RestApi", "RootResourceId"] },
                    "Integration": {
                        "Type": "AWS_PROXY",
                        "IntegrationHttpMethod": "POST",
                        "PassthroughBehavior": "NEVER", 
                        "Uri": {"Fn::Join" : ["", ["arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/", {"Fn::GetAtt": ["IngressLambda", "Arn"]}, "/invocations"]]}
                    }
                }
            },

            "RestApiDeployment": {
                "Type": "AWS::ApiGateway::Deployment",
                "Properties": {
                    "RestApiId": { "Ref": "RestApi" },
                    "StageName": "v1"
                },
                "DependsOn": ["RestApi", "TagModel", "TagsResource", "TagsPost"]
            },

        },

        "Outputs": {

        }

    }

When running the test in API Gateway in the aws web portal console, i get the error: Execution failed due to configuration error: Invalid permissions on Lambda function

This is driving me mad. Any direction here would be great. I would guess that my Permission is wrong somehow, but I am not sure how (this is where I struggle with the documentation).

Answer 1

According to the API Gateway documentation section Resource Format of Permissions for Executing API in API Gateway , the SourceArn property should have the following structure:

arn:aws:execute-api: region : account-id : api-id / stage-name / HTTP-VERB / resource-path-specifier

where:

• region is the AWS region (such as us-east-1 or * for all AWS regions) that corresponds to the deployed API for the method.
• account-id is the 12-digit AWS account Id of the REST API owner.
• api-id is the identifier API Gateway has assigned to the API for the method. ( * can be used for all APIs, regardless of the API's identifier.)
• stage-name is the name of the stage associated with the method ( * can be used for all stages, regardless of the stage's name.)
• HTTP-VERB is the HTTP verb for the method. It can be one of the following: GET , POST , PUT , DELETE , PATCH , HEAD , OPTIONS .
• resource-path-specifier is the path to the desired method. ( * can be used for all paths).

Your current template provided:

arn:aws:execute-api:us-west-2::${RestApi.RootResourceId}/null/POST

Try something like this (using Fn::Sub and ${} syntax to simplify references):

arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${RestApi}/*/POST/*

In addition, a proxy-integration Lambda function must return output according to the Output Format of a Lambda Function for Proxy Integration , otherwise it will return a 502 Bad Gateway error:

{
    "statusCode": httpStatusCode,
    "headers": { "headerName": "headerValue", ... },
    "body": "..."
}

Change your Lambda function to the following:

exports.handler = function(event, context) {
  context.succeed({statusCode: 200, headers: {}, body: "invoked the lambda!"});
};

---

Here's a complete, self-contained, working example template that demonstrates a properly-executing Lambda proxy function from an API Gateway (I've converted the original example to YAML for readability):

Resources:
  ApiGatewayToLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: {Service: [apigateway.amazonaws.com]}
          Action: "sts:AssumeRole"
      Policies:
      - PolicyName: ApiGatewayToLambdaPolicy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action: ["lambda:InvokeFunction"]
            Resource: "*"
  IngressLambda:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs4.3
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        ZipFile: !Sub |
          exports.handler = (event, context) =>
            context.succeed({statusCode: 200, headers: {}, body: "Invoked the Lambda!"});
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal: {Service: [lambda.amazonaws.com]}
          Action: ['sts:AssumeRole']
      Path: /
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  IngressLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: "lambda:InvokeFunction"
      FunctionName: !Ref IngressLambda
      Principal: "apigateway.amazonaws.com"
      SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${RestApi}/*/POST/*"
  RestApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: API Gateway
  TagModel:
    Type: AWS::ApiGateway::Model
    Properties:
      ContentType: application/json
      Name: Tag
      RestApiId: !Ref RestApi
      Schema:
        $schema: "http://json-schema.org/draft-04/schema#"
        title: TagModel
        type: object
        properties:
          payload: {type: object}
          domain: {type: string}
  TagsResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RestApi
      ParentId: !GetAtt RestApi.RootResourceId
      PathPart: tag
  TagsPost:
    Type: AWS::ApiGateway::Method
    Properties:
      ApiKeyRequired: False
      AuthorizationType: NONE
      HttpMethod: POST
      RestApiId: !Ref RestApi
      ResourceId: !GetAtt RestApi.RootResourceId
      Integration:
        Type: AWS_PROXY
        IntegrationHttpMethod: POST
        PassthroughBehavior: NEVER
        Uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${IngressLambda.Arn}/invocations"
  RestApiDeployment:
    Type: AWS::ApiGateway::Deployment
    DependsOn: [RestApi, TagModel, TagsResource, TagsPost]
    Properties:
      RestApiId: !Ref RestApi
      StageName: v1
  HttpRequestFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Returns an HTTP request as a Custom Resource
      Handler: index.handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        ZipFile: !Sub |
          var response = require('cfn-response');
          exports.handler = (event, context) => {
              console.log("Request received:\n", JSON.stringify(event));
              var success = data => response.send(event, context, response.SUCCESS, data);
              var failed = e => response.send(event, context, response.FAILED, e);
              process.on('uncaughtException', e=>failed(e));
            try {
              if (event.RequestType == 'Delete') { return success({}); }
              var https = require("https");
              var url = require("url");
              var parsedUrl = url.parse(event.ResourceProperties.Url);
              var options = {
                hostname: parsedUrl.hostname,
                path: parsedUrl.path,
                method: event.ResourceProperties.Method || 'GET',
              };
              var request = https.request(options, response => {
                console.log("Status code: " + response.statusCode);
                console.log("Status message: " + response.statusMessage);
                var body = '';
                response.setEncoding('utf8');
                response.on('data', chunk => body += chunk);
                response.on('end', ()=>success({Data: body}));
              });
              request.on("error", e=>failed(e));
              request.end();
            } catch (e) { failed(e); }
          };
      Timeout: 30
      Runtime: nodejs4.3
  HttpRequest:
    Type: Custom::HttpRequest
    DependsOn: RestApiDeployment
    Properties:
      ServiceToken: !GetAtt HttpRequestFunction.Arn
      Url: !Sub "https://${RestApi}.execute-api.${AWS::Region}.amazonaws.com/v1"
      Method: POST
Outputs:
  Result:
    Value: !GetAtt HttpRequest.Data

This stack returns Invoked the lambda! in its Stack Outputs, indicating a successful HTTP request to the newly-created API Gateway backed by the simple Lambda function. If it fails, it's possible your CloudFormation stack is lacking IAM permissions or there are unsupported services in your AWS region.

Answer 2

Similar to wjordan's recent comment, I think the source arn is the problem. It should be of a format like this:

arn:aws:execute-api:REGION:ACCOUNT_ID:API_ID/*/*/API_NAME

because this is how I execute the command with CLI:

aws lambda add-permission --function-name ${FUNCTION_ARN} --action "lambda:InvokeFunction" --statement-id 1 --principal apigateway.amazonaws.com --source-arn "arn:aws:execute-api:"${REGION}":"${ACCOUNT_ID}":"${API_ID}"/*/*/"${API_NAME}

I did some digging and it may be due to because you missed the Account ID. I'm editing my answer based on Michael Wittig's example on GitHub: https://github.com/AWSinAction/apigateway/blob/master/template.json

Yours:

"SourceArn" : { "Fn::Join" : ["", ["arn:aws:execute-api:us-west-2::", {"Fn::GetAtt": ["RestApi", "RootResourceId"]}, "/null/POST" ]]}

His:

"SourceArn": {"Fn::Join": ["", ["arn:aws:execute-api:", {"Ref": "AWS::Region"}, ":", {"Ref": "AWS::AccountId"}, ":", {"Ref": "RestApi"}, "/*"]]}

Notice how he used the reference:

{"Ref": "AWS::AccountId"}

Amazon says that "ARNs for some resources don't require an account number, so this component might be omitted." but it's unclear which ones require and which don't.

Reference: http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html

Answer 3

your ApiGateway may not have right to call your lambda function. try below steps;

select your API Gateway Rest end point select resources select one of your methods select 'Integration Request' click edit button next to your 'Lambda Function' click confirm button, this step will ask you to approve you are giving right your ApiGateway to call your lambda function confirm the access right

--- now you can retest your method