![](/img/trans.png)
[英]How to give RDS instance permission to invoke lambda from CFT or SAM template
[英]Give permission to invoke lambda from ECS by cdk
从ECS
调用lambda
时出现权限错误。
botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the Invoke operation: User: arn:aws:sts::678100228XXX:assumed-role/vw-dev-fargate-stack-TaskDefAdminTaskRoleA25A3679-1K9EPRKUW9TNV/21bdeb6c10b14db4b1515986d946959a is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:ap-northeast-1:678100228XXX:function:vw-dev-lambda because no identity-based policy allows the lambda:InvokeFunction action
所以,我想给ECS增加访问lambda的权限。
我在lambda.ts
中设置了ecs
,在ecs.ts
中设置了lambda
我目前的想法是给lambda.ts
中的ecs
权限
在我的ecs.ts
中
const ecsAdminService = new ecs.FargateService(this, "AdminService", {
cluster,
taskDefinition:taskDefinitionAdmin,
desiredCount: 2,
vpcSubnets: {subnetType: ec2.SubnetType.PUBLIC },
assignPublicIp: true,
securityGroups:[adminServiceSg],
enableExecuteCommand:true,
serviceName: "sw-ecs-my-dx-tokyo-jxc-91"
});
在我的lambda.ts
const myLambda = new lambda.DockerImageFunction(this, "myLambda", {
functionName: `vw-${targetEnv}-lambda`,
vpc:vpc,
vpcSubnets: {subnetType: ec2.SubnetType.PRIVATE_WITH_NAT },
timeout: cdk.Duration.minutes(1),
code: lambda.DockerImageCode.fromEcr(myEcrRepo),
environment:{
}
});
# I am making here below.
const ecs = "somehow get the ecs here"
myLambda.grantInvoke(ecs) # Something like this.
我对么??
我遇到了两个问题。
如何获取在另一个文件中定义的ecs
?
怎么给ecs
权限调用呢?
或者,我基本上错了吗?
任何帮助表示赞赏。 非常感谢你。
这很容易通过在堆栈之间传递变量来完成
例如在some-app
中
// bin/some-app.ts
import * as cdk from 'aws-cdk-lib';
import { SomeEcsStack } from '../lib/ecs';
import { SomeLambdaStack} from '../lib/lambda'
const app = new cdk.App();
const lmb = new SomeLambdaStack(app, 'SomeLambdaStack');
new SomeEcsStack(app, 'SomeEcsStack', {
lambdaFunc: lmb.lambdaFunc
});
公开你的 lambda function
// lib/lambda.ts
import { Duration, Stack, StackProps } from 'aws-cdk-lib';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
export class SomeLambdaStack extends Stack {
public readonly lambdaFunc: lambda.Function; // <-- making it available
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, props);
const myLambda = new lambda.DockerImageFunction(this, "myLambda", {
functionName: `vw-${targetEnv}-lambda`,
vpc:vpc,
vpcSubnets: {subnetType: ec2.SubnetType.PRIVATE_WITH_NAT },
timeout: cdk.Duration.minutes(1),
code: lambda.DockerImageCode.fromEcr(myEcrRepo),
});
this.lambdaFunc = myLambda; // <-- making it available
}
授予ecs任务定义角色权限调用
// lib/ecs.ts
import { Duration, Stack, StackProps } from 'aws-cdk-lib';
import * as ecs from 'aws-cdk-lib/aws-ecs';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
export interface SomeEcsStackProps extends StackProps {
readonly lambdaFunc: lambda.Function; // <-- expect lambda to be passed
}
export class SomeEcsStack extends Stack {
constructor(scope: Construct, id: string, props?: SomeEcsStackProps) {
super(scope, id, props);
const ecsAdminService = new ecs.FargateService(this, "AdminService", {
cluster,
taskDefinition:taskDefinitionAdmin,
desiredCount: 2,
vpcSubnets: {subnetType: ec2.SubnetType.PUBLIC },
assignPublicIp: true,
securityGroups:[adminServiceSg],
enableExecuteCommand:true,
serviceName: "sw-ecs-my-dx-tokyo-jxc-91"
});
props.lambdaFunc.grantInvoke(taskDefinitionAdmin.taskRole) // <-- Grant permission to task role
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.