S3事件触发配置报错：无法验证目标配置，请协助排查

报错信息 #

调用PutBucketNotificationConfiguration操作时发生错误(InvalidArgument)：无法验证以下目标配置
++ aws sns create-topic --name s3-lambda-sns --output json
++ jq -r .TopicArn

当前配置代码 #

# Create an S3 event trigger for the Lambda function
LambdaFunctionArn="arn:aws:lambda:us-east-1:$aws_account_id:function:s3-lambda-function"
aws s3api put-bucket-notification-configuration \
  --region "$aws_region" \
  --bucket "$bucket_name" \
  --notification-configuration '{
    "LambdaFunctionConfigurations": [{
        "LambdaFunctionArn": "'"$LambdaFunctionArn"'",
        "Events": ["s3:ObjectCreated:*"]
    }]
}'

已执行的权限配置 #

# Create IAM Role for the project
role_response=$(aws iam create-role --role-name s3-lambda-sns --assume-role-policy-document '{
  "Version": "2012-10-17",
  "Statement": [{
    "Action": "sts:AssumeRole",
    "Effect": "Allow",
    "Principal": {
      "Service": [
         "lambda.amazonaws.com",
         "s3.amazonaws.com",
         "sns.amazonaws.com"
      ]
    }
  }]
}')

# Add Permissions to S3 Bucket to invoke Lambda
aws lambda add-permission \
  --function-name "$lambda_func_name" \
  --statement-id "s3-lambda-sns" \
  --action "lambda:InvokeFunction" \
  --principal s3.amazonaws.com \
  --source-arn "arn:aws:s3:::$bucket_name"

# Attach Permissions to the Role
aws iam attach-role-policy --role-name $role_name --policy-arn arn:aws:iam::aws:policy/AWSLambda_FullAccess
aws iam attach-role-policy --role-name $role_name --policy-arn arn:aws:iam::aws:policy/AmazonSNSFullAccess

后续解决建议 #

• 修正Lambda权限的source-arn格式：S3触发Lambda时，source-arn需要包含对象层级的通配符，否则无法通过权限验证。更新命令如下：

aws lambda add-permission \
  --function-name "$lambda_func_name" \
  --statement-id "s3-lambda-sns" \
  --action "lambda:InvokeFunction" \
  --principal s3.amazonaws.com \
  --source-arn "arn:aws:s3:::$bucket_name/*"

• 绑定IAM角色到Lambda函数：你创建的s3-lambda-sns角色需要被设置为Lambda的执行角色，否则Lambda无法获取运行权限。执行以下命令完成绑定：

aws lambda update-function-configuration \
  --function-name "$lambda_func_name" \
  --role "$(echo "$role_response" | jq -r .Role.Arn)"

• 校验资源区域一致性：确认S3桶和Lambda函数处于同一区域，S3不支持跨区域触发Lambda，需保证$aws_region变量同时匹配两者的区域配置。

• 简化IAM角色信任策略：Lambda执行角色仅需要信任lambda.amazonaws.com，无需添加s3.amazonaws.com和sns.amazonaws.com，避免权限冲突：

aws iam update-assume-role-policy --role-name s3-lambda-sns --policy-document '{
  "Version": "2012-10-17",
  "Statement": [{
    "Action": "sts:AssumeRole",
    "Effect": "Allow",
    "Principal": {
      "Service": "lambda.amazonaws.com"
    }
  }]
}'

• 检查变量赋值正确性：确认$aws_account_id、$aws_region、$bucket_name、$lambda_func_name、$role_name所有变量均已正确赋值，避免因变量为空或错误导致ARN无效。

内容的提问来源于stack exchange，提问作者SwatiKa