aws lambda function 支持秘密管理器輪換

Question

I have created a lambda function which I intend to serve as a secret rotation function to be used by the secrets manager, but when I try to add this function as a rotation function in the secrets manager I get the error "Secrets Manager cannot invoke the specified lambda function. Ensure that the function policy grants access to the principal secretsmanager.amazonaws.com" but I have already allowed secrets manager to invoke the function in the functions resource based policy , this is what I have defined

{   
 "Version": "2012-10-17",   
 "Id": "default",   
 "Statement": [
     {
       "Sid": "Secret-Manager-Access-To-fun_SSH-function",
       "Effect": "Allow",
       "Principal": {
         "Service": "secretsmanager.amazonaws.com"
       },
       "Action": "lambda:Invoke",
       "Resource": "arn:aws:lambda:us-east-1:296808031351:function:fun_ssh"
     }   
  ] 
}

我無法理解我錯過了什么，我該如何讓它工作？

TIA

Answer 1

一個原因可能是您使用了不正確的操作： lambda:Invoke 。

調用 lambda function 的正確動作是lambda:InvokeFunction 。