AWS Lambda连接OpenSearch Serverless报404错误求助

背景 #

开发基于Python的AWS Lambda函数，与同VPC内的OpenSearch Serverless集合交互，权限和VPC配置已确认无误，但调用list_collections等操作时持续返回404错误。

Lambda函数代码 #

import json
import boto3
import logging
from botocore.exceptions import ClientError

logger = logging.getLogger()
logger.setLevel(logging.INFO)

def create_opensearch_client():
    try:
        session = boto3.Session()
        client = session.client('opensearchserverless', 
                                endpoint_url="https://zz44ttfldnkz06666uul.us-east-1.aoss.amazonaws.com",
                                verify=False,
                                use_ssl=True)
        logger.info("OpenSearch client created successfully")
        return client
    except Exception as e:
        logger.error(f"Error creating OpenSearch client: {str(e)}")
        logger.error(f"Traceback: {traceback.format_exc()}")
        raise

def test_opensearch_connection(client):
    try:
        response = client.list_collections()
        logger.info(f"Successfully listed collections: {json.dumps(response, default=str)}")
        
        response = client.batch_get_collection(ids=['my-collection-id'])
        logger.info(f"Successfully got collection details: {json.dumps(response, default=str)}")
        
        return True
    except ClientError as e:
        logger.error(f"Error connecting to OpenSearch: {str(e)}")
        return False

def lambda_handler(event, context):
    logger.info("Lambda function started")
    client = create_opensearch_client()
    connection_successful = test_opensearch_connection(client)
    
    if connection_successful:
        return {
            'statusCode': 200,
            'body': 'Successfully connected to OpenSearch collection.'
        }
    else:
        return {
            'statusCode': 500,
            'body': 'Failed to connect to OpenSearch collection.'
        }

错误信息 #

"Error in OpenSearch connection test: An error occurred (404) when calling the ListCollections operation"

已执行验证步骤 #

• 使用AWS CLI验证端点与集合，命令执行正常：

  aws opensearchserverless list-collections
  aws opensearchserverless batch-get-collection --ids "my-collection-id"
  

• 确认Lambda角色具备aoss:APIAccessAll等必要权限
• 反复核对Lambda与OpenSearch处于同一VPC及子网

Lambda附加IAM策略 #

Policies:
  - AWSLambdaVPCAccessExecutionRole
  - AWSLambdaBasicExecutionRole
  - AmazonElasticFileSystemClientReadWriteAccess
  - SecretsManagerReadWrite
  - AmazonRDSFullAccess
  - AmazonS3ReadOnlyAccess
  - Version: '2012-10-17'
    Statement:
      - Effect: Allow
        Action:
          - 'aoss:APIAccessAll'
        Resource: 'arn:aws:aoss:us-east-1:123456789012:collection/my-collection-id'
      - Effect: Allow
        Action:
          - 'lambda:GetFunctionConfiguration'
        Resource: 'arn:aws:lambda:us-east-1:123456789012:function:my-lambda-function'
      - Effect: Allow
        Action:
          - 'es:ESHttpGet'
          - 'es:ESHttpPost'
          - 'es:ESHttpPut'
          - 'es:ESHttpDelete'
        Resource: 'arn:aws:aoss:us-east-1:123456789012:collection/my-collection-id/*'

VPC配置 #

• Lambda已关联正确子网与安全组
• 子网及安全组配置已多次验证无误

1. 错误指定API端点类型 #

你在代码中使用的是数据平面端点（格式为https://<unique-id>.<region>.aoss.amazonaws.com），但list_collections、batch_get_collection属于控制平面API，需要调用控制平面端点（格式为https://aoss.<region>.amazonaws.com），而非数据平面端点。

解决方法：移除endpoint_url参数，让boto3自动解析正确的控制平面端点：

def create_opensearch_client():
    try:
        session = boto3.Session()
        client = session.client('opensearchserverless', 
                                verify=False,
                                use_ssl=True)
        logger.info("OpenSearch client created successfully")
        return client
    except Exception as e:
        logger.error(f"Error creating OpenSearch client: {str(e)}")
        import traceback
        logger.error(f"Traceback: {traceback.format_exc()}")
        raise

2. VPC内无法访问控制平面公网端点 #

OpenSearch Serverless控制平面API是公共端点，VPC内的Lambda默认无法直接访问公网。

解决方法：

• 配置NAT网关：确保Lambda所在子网的路由表指向NAT网关，允许出站访问公网。
• 创建VPC端点：创建com.amazonaws.<region>.aoss类型的Interface VPC端点，关联Lambda所在子网和安全组，确保安全组允许两者通信。

3. IAM权限资源范围限制 #

list_collections是全局操作，当前策略中aoss:APIAccessAll仅作用于单个集合ARN，无法覆盖全局操作的权限需求。

解决方法：更新IAM策略，为控制平面操作添加全局资源权限：

- Effect: Allow
  Action:
    - 'aoss:ListCollections'
    - 'aoss:BatchGetCollection'
  Resource: '*'

内容的提问来源于stack exchange，提问作者Hrvoje