AWS SAM部署失败：如何为UploadTriggerFunction添加调用EmoryParserFunction的权限？

尝试在AWS SAM的template.yaml中为UploadTriggerFunction Lambda函数添加调用EmoryParserFunction Lambda的权限，执行sam deploy --guided部署失败，提示UploadTriggerFunctionRole的IAM策略存在语法错误。

原错误配置代码 #

UploadTriggerFunction:
  Type: AWS::Serverless::Function
  Properties:
    CodeUri: src/upload_trigger/
    Policies:
      - DynamoDBCrudPolicy:
          TableName: !Ref DocumentTable
      - DynamoDBCrudPolicy:
          TableName: !Ref MemoryTable
      - S3ReadPolicy:
          BucketName: !Sub "${AWS::StackName}-${AWS::Region}-${AWS::AccountId}*"
      - SQSSendMessagePolicy:
          QueueName: !GetAtt EmbeddingQueue.QueueName
      - Statement:
          - Sid: "LambdaInvokePermission"
            Action: "lambda:*"
            FunctionName: !Ref EmoryParserFunction
            Principal: "*"

部署错误信息 #

UPDATE_FAILED                    AWS::IAM::Role                   UploadTriggerFunctionRole        Resource handler returned       
                                                                                               message: "Syntax errors in     
                                                                                               policy. (Service: Iam, Status  
                                                                                               Code: 400, Request ID: 67a2b4d 
                                                                                               6-4efd-483e-9a20-              
                                                                                               290b983f3521)" (RequestToken:  
                                                                                               afebd2d9-cc06-70e2-ba50-       
                                                                                               5dca6751f288,                  
                                                                                               HandlerErrorCode:              
                                                                                               InvalidRequest)    

错误原因 #

自定义IAM策略Statement存在以下问题：

• 缺少必填的Effect字段（必须指定Allow或Deny）
• 错误使用FunctionName字段，IAM策略中需要用Resource指定目标Lambda的ARN，而非FunctionName
• Principal字段属于资源级权限配置（给外部主体授权调用Lambda），但此处是给当前角色添加调用权限，不需要该字段

正确配置方式 #

方式一：使用SAM内置的LambdaInvokePolicy（推荐） #

SAM提供了内置策略简化Lambda调用权限配置，直接指定目标函数即可：

UploadTriggerFunction:
  Type: AWS::Serverless::Function
  Properties:
    CodeUri: src/upload_trigger/
    Policies:
      - DynamoDBCrudPolicy:
          TableName: !Ref DocumentTable
      - DynamoDBCrudPolicy:
          TableName: !Ref MemoryTable
      - S3ReadPolicy:
          BucketName: !Sub "${AWS::StackName}-${AWS::Region}-${AWS::AccountId}*"
      - SQSSendMessagePolicy:
          QueueName: !GetAtt EmbeddingQueue.QueueName
      - LambdaInvokePolicy:
          FunctionName: !Ref EmoryParserFunction

方式二：自定义完整IAM策略Statement #

如果需要更精细的权限控制（比如仅允许lambda:InvokeFunction动作），可以使用标准IAM策略格式：

UploadTriggerFunction:
  Type: AWS::Serverless::Function
  Properties:
    CodeUri: src/upload_trigger/
    Policies:
      - DynamoDBCrudPolicy:
          TableName: !Ref DocumentTable
      - DynamoDBCrudPolicy:
          TableName: !Ref MemoryTable
      - S3ReadPolicy:
          BucketName: !Sub "${AWS::StackName}-${AWS::Region}-${AWS::AccountId}*"
      - SQSSendMessagePolicy:
          QueueName: !GetAtt EmbeddingQueue.QueueName
      - Statement:
          - Sid: "LambdaInvokePermission"
            Effect: "Allow"
            Action: "lambda:InvokeFunction"
            Resource: !GetAtt EmoryParserFunction.Arn

注意：如果目标Lambda函数和当前函数不在同一个AWS账号或区域，需要在Resource中指定完整的ARN，同时确保跨账号权限配置正确。

内容的提问来源于stack exchange，提问作者eduardosufan