Aws Lambda 無權執行：SNS：在資源上發布：+358

Question

我已經制作了 Cognito PostConfirmation lambda function。當用戶成功注冊時，我想向他們發送短信。 為此，我正在使用AWS-SNS 。 我已經創建了一個 Sns 主題並附加到我的 PostConfirmation lambda function。我允許 lambda 用於 Sns 發布。 在 cloudwatch 中它說，lambda 沒有授權執行此 Sns 發布。

我在 cloudwatch 中收到此錯誤：

PostConfirmation 無權執行：SNS:Publish on resource: +358.... 因為沒有基於身份的策略允許 SNS:Publish 操作

我不確定我錯過了什么。

這是我的 YAML 文件：

  plugins:
    - serverless-webpack
    - serverless-offline
    - serverless-plugin-warmup
    - serverless-iam-roles-per-function
  ## post Confirmation
  PostConfirmation:
    handler: src/handlers/postConfirmation.postConfirmation
    events:
      - cognitoUserPool:
          pool: ${self:provider.environment.COGNITO}
          trigger: PostConfirmation
          existing: true
    iamRoleStatements:
      - Effect: Allow
        Action:
          - cognito-idp:*
        Resource: arn:aws:cognito-idp:*:*:*
      - Effect: Allow
        Action:
          - dynamodb:PutItem
          - lambda:InvokeFunction # Added this like mentioned above
        Resource: 'arn:aws:dynamodb:${opt:region, self:provider.region}:*:table/${self:provider.environment.ITEM_TABLE}'
      - Effect: Allow
        Action:
          - sns:Publish ## This is where I am giving my permisson 
          - sns:SetSMSAttributes
        Resource: !Ref SendMessageSns ## Sns Topic

resources:
  Resources:
    SendMessageSns:
      Type: AWS::SNS::Topic
      Properties:
        DisplayName: It will send sms when user successfully signUp
        TopicName: ${self:service}-${opt:stage, self:provider.stage}-successful

這就是我嘗試發布消息的方式

import { SNS } from '@aws-sdk/client-sns';
const snsClient = new SNS({ region: 'eu-north-1' });
exports.postConfirmation = async (event: any, context: any) => {

  const messageParams = {
    Message:
      'congrats it works',
    PhoneNumber: '+358.......',
  };

  try {
    console.log('1');
    const snsSucess = await snsClient.publish(messageParams);
    console.log('Success.', snsSucess);
    console.log('2');
    context.done(null, event);
  } catch (error) {
    console.log('error', { error });
    return {
      statusCode: 500,
      body: JSON.stringify(error),
    };
  }
};

Answer 1

您允許發布到 SNS 主題，但正在嘗試將 SMS 直接發送到電話號碼。 發布到 SNS 主題時，您需要向該主題發布消息並訂閱該主題的電話號碼，請參閱https://docs.aws.amazon.com/sns/latest/dg/sms_publish-to-topic.html

或者，您可以直接發布到電話號碼，但您需要修改 IAM 策略，並且還可能移出 SMS 沙箱 - https://docs.aws.amazon.com/sns/latest/dg/sms_publish-to-電話.html