AWS Lambda函數中的循環依賴

Question

以下是lambda函數的template.yaml。 我正在嘗試添加訪問status數據庫的權限。 但是，它需要數據庫存在，反之亦然，因此我收到DynamoDBIamPolicy的循環依賴項錯誤。 我該如何解決？

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: An AWS Serverless Specification template describing your function.
Resources:
  friendTeachers:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: friendTeachers/index.handler
      Runtime: nodejs6.10
      Description: ''
      MemorySize: 128
      Timeout: 15
  status:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: status
      AttributeDefinitions:
        - AttributeName: screenName
          AttributeType: S
      KeySchema:
        - AttributeName: screenName
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1
  # A policy is a resource that states one or more permssions. It lists actions, resources and effects.
  DynamoDBIamPolicy: 
    Type: 'AWS::IAM::Policy'
    DependsOn: status
    Properties:
      PolicyName: lambda-dynamodb
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:DescribeTable
              - dynamodb:Query
              - dynamodb:Scan
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:DeleteItem
              - dynamodb:batchWriteItem
            Resource: arn:aws:dynamodb:*:*:table/status
      Roles:
        - Ref: IamRoleLambdaExecution

Answer 1

您缺少指定lambda服務可以使用AssumeRole的角色 。 角色需要具有關聯的策略，該策略指定可以在DynamoDb表中完成的操作。 在下面找到一個示例，該示例顯示您要完成的任務：

---
AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'
Description: An AWS Serverless Specification template describing your function.
Resources:
  friendTeachersFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket:
          Ref: LambdaCodeBucket
        S3Key:
          Ref: LambdaCodePath
      Handler: friendTeachers/index.handler
      Runtime: "nodejs6.10"
      Description: ''
      MemorySize: 128
      Timeout: 15
      Role:
        Fn::GetAtt:
        - friendTeachersExecutionRole
        - Arn
  friendTeachersExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: UseDBPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
              - dynamodb:DescribeTable
              - dynamodb:Query
              - dynamodb:Scan
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:DeleteItem
              - dynamodb:batchWriteItem
            Resource: arn:aws:dynamodb:*:*:table/status
  APIDynamoDBTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: status
      AttributeDefinitions:
        - AttributeName: screenName
          AttributeType: S
      KeySchema:
        - AttributeName: screenName
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 1
        WriteCapacityUnits: 1

注意，將Code.S3Bucket和Code.S3Key定義為參數。 在AWS Console中創建堆棧時，您可以在此處指定路徑。