使用Terraform创建AWS Lambda无法拉取复制的ECR镜像

我在ap-south-1区域拥有一个私有ECR仓库，已通过CLI将镜像复制到us-west-1区域，复制操作正常，镜像同步完成且本地可正常拉取。但通过Terraform使用us-west-1的image_uri创建AWS Lambda函数时失败，报错信息如下：

creating Lambda Function (my_sample_tmp): operation error Lambda: CreateFunction, https response error StatusCode: 400, RequestID: 310e56ea-e5f7-4f50-a9e5-fcf4555c55f5, InvalidParameterValueException: Source image 12345678910.dkr.ecr.us-west-1.amazonaws.com/my-repo:2-my-tag is not valid. Provide a valid source image

通过AWS控制台创建该Lambda函数则可正常运行，以下是相关配置代码：

Terraform Lambda配置 #

resource "aws_lambda_function" "data_beacon" {
  count         = length(keys(var.app_clients_config))
  function_name = "${var.app_name}_${var.server_name}_${var.app_environment}_${element(keys(var.app_clients_config), count.index)}"
  description   = "c360 Data Beacon function to process insights & alerts"
  timeout       = 50 # seconds
  image_uri     = "${var.aws_account_id}.dkr.ecr.${var.aws_region}.amazonaws.com/${var.aws_registry_image_name}:${var.app_data_beacon_version}"
  package_type  = "Image"

  role = var.aws_iam_role_lambda_exec_role_arn
  environment {
    variables = {
      ENVIRONMENT = var.app_environment,
      CLIENT      = element(keys(var.app_clients_config), count.index)
    }
  }
}

IAM策略文档 #

data "aws_iam_policy_document" "lambda_exec_policy" {
  statement {
    sid    = "AllowInvokingLambdas"
    effect = "Allow"

    resources = [
      "arn:aws:lambda:*:*:function:*"
    ]

    actions = [
      "lambda:InvokeFunction"
    ]
  }

  statement {
    sid    = "AllowECRAccessForLambda"
    effect = "Allow"

    resources = ["*"]

    actions = [
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "ecr:BatchCheckLayerAvailability",
      "ecr:DescribeRepositories",
      "ecr:ListImages"
    ]
  }

  statement {
    sid    = "AllowECRAuthTokenForLambda"
    effect = "Allow"

    resources = ["*"]

    actions = [
      "ecr:GetAuthorizationToken"
    ]
  }

  statement {
    sid    = "AllowWritingLogs"
    effect = "Allow"

    resources = [
      "arn:aws:logs:*:*:log-group:/aws/lambda/*:*"
    ]

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }

  statement {
    sid    = "AccessSecrets"
    effect = "Allow"

    resources = [
      "*"]

    actions = [
      "secretsmanager:DescribeSecret",
      "secretsmanager:GetSecretValue",
    ]
  }
}

1. 校验变量准确性

   • 确认var.aws_region是否明确设置为us-west-1，Terraform可能默认使用配置文件中的其他区域，导致生成的image_uri指向错误区域的ECR仓库。
   • 核对var.app_data_beacon_version标签与us-west-1区域ECR中的镜像标签完全一致，标签区分大小写，仅允许.、_、-三种特殊字符。

2. 验证镜像Lambda兼容性

   • 确保镜像符合Lambda容器规范：必须包含Runtime Interface Client或基于Lambda官方基础镜像构建。可用AWS CLI验证镜像合法性：

     aws lambda validate-image --image-uri 12345678910.dkr.ecr.us-west-1.amazonaws.com/my-repo:2-my-tag --region us-west-1
     

3. 升级Terraform AWS Provider版本

   • 旧版本Provider可能存在Lambda容器镜像的API兼容性问题，在versions.tf中指定最新稳定版本：

     terraform {
       required_providers {
         aws = {
           source  = "hashicorp/aws"
           version = "~> 5.0"
         }
       }
     }
     

4. 确认IAM角色信任策略

   • 确保Lambda执行角色的信任策略允许Lambda服务扮演该角色，需添加以下配置：

     data "aws_iam_policy_document" "lambda_assume_role" {
       statement {
         actions = ["sts:AssumeRole"]
         principals {
           type        = "Service"
           identifiers = ["lambda.amazonaws.com"]
         }
       }
     }
     

5. 使用ECR镜像完整ARN格式

   • 尝试将image_uri替换为ARN格式，部分场景下API对ARN兼容性更好：

     image_uri = "arn:aws:ecr:us-west-1:${var.aws_account_id}:repository/${var.aws_registry_image_name}:${var.app_data_beacon_version}"
     

内容的提问来源于stack exchange，提问作者swateek