Lambda调用S3Client.send()时执行中断问题排查求助

问题 #

我正尝试在Lambda函数中从S3获取JSON对象，代码在本地测试运行正常，但在Lambda环境中调用s3client.send(command)时，执行会立即中断。

代码实现 #

const { S3Client, GetObjectCommand } = require("@aws-sdk/client-s3");

const s3Client = new S3Client({ region: process.env.REGION });

console.log("S3 Client Configuration: ", JSON.stringify(s3Client.config));

const getObjectFromS3 = async (bucket, key) => {
  console.log(`Entering getObjectFromS3. Bucket: ${bucket}, Key: ${key}`);
  try {
    console.log(`Creating GetObjectCommand`);
    const command = new GetObjectCommand({
      Bucket: bucket,
      Key: key,
    });

    console.log("About to log S3Client configuration");
    console.log("S3 Client Configuration: ", JSON.stringify(s3Client.config));

    let response;
    try {
      console.log("Executing S3Client.send()");
      console.log("Timestamp before S3 send: ", new Date().toISOString());
      response = await s3Client.send(command);
      console.log("Timestamp after S3 send: ", new Date().toISOString());
    } catch (err) {
      console.error("S3Client.send() failed", err);
      throw err;
    }

    console.log("Decoding body from response");
    const body = await new TextDecoder("utf-8").decode(
      await streamToPromise(response.Body)
    );

    console.log("Decoded body: ", body);
    return JSON.parse(body);

  } catch (error) {
    console.error(
      `Caught an error fetching object from S3 bucket: ${bucket}, key: ${key}`,
      JSON.stringify(error)
    );
    throw error;
  }
};

function streamToPromise(stream) {
  console.log("Entering streamToPromise");
  return new Promise((resolve, reject) => {
    const chunks = [];
    stream.on("data", (chunk) => {
      console.log("Received a data chunk");
      chunks.push(chunk);
    });
    stream.on("error", (error) => {
      console.error("Stream error: ", JSON.stringify(error));
      reject(error);
    });
    stream.on("end", () => {
      console.log("Stream ended");
      resolve(Buffer.concat(chunks));
    });
  });
}

日志信息 #

2023-10-03T13:15:21.290Z    d89a668a-8eef-4d10-8653-8bf145a5f282    INFO    Creating GetObjectCommand

2023-10-03T13:15:21.290Z    d89a668a-8eef-4d10-8653-8bf145a5f282    INFO    About to log S3Client configuration

2023-10-03T13:15:21.290Z    d89a668a-8eef-4d10-8653-8bf145a5f282    INFO    S3 Client Configuration:  {
    "apiVersion": "2006-03-01",
    "disableHostPrefix": false,
    "logger": {},
    "serviceId": "S3",
    "signingEscapePath": false,
    "runtime": "node",
    "requestHandler": {
        "metadata": {
            "handlerProtocol": "http/1.1"
        },
        "configProvider": {}
    },
    "tls": true,
    "isCustomEndpoint": false,
    "systemClockOffset": 0,
    "bucketEndpoint": false,
    "forcePathStyle": false,
    "useAccelerateEndpoint": false,
    "eventStreamMarshaller": {
        "universalMarshaller": {
            "eventStreamCodec": {
                "headerMarshaller": {}
            }
        }
    }
}

2023-10-03T13:15:21.290Z    d89a668a-8eef-4d10-8653-8bf145a5f282    INFO    Executing S3Client.send()

2023-10-03T13:15:21.290Z    d89a668a-8eef-4d10-8653-8bf145a5f282    INFO    Timestamp before S3 send:  2023-10-03T13:15:21.290Z

2023-10-03T13:15:21.323Z    d89a668a-8eef-4d10-8653-8bf145a5f282    WARN    {
    "source": "serverlessSdk",
    "type": "WARNING_TYPE_SDK_USER",
    "message": "Serverless SDK Warning: Following trace spans didn't end before end of lambda invocation: aws.sdk.s3.getobject\n",
    "code": "SDK_SPAN_NOT_CLOSED"
}

已排查内容 #

• Lambda执行时长设置为120秒
• Bucket和Key名称正确无误
• 未进入catch代码块，Lambda仅直接中断执行
• 本地测试角色与Lambda角色权限一致（均拥有该Bucket的GetObject策略）

请问该如何排查Lambda从S3获取对象时执行中断的原因？

排查方案 #

1. 检查Lambda的VPC网络配置
   如果Lambda部署在VPC内，需确认网络通路：

   • 若通过公网访问S3，子网需配置NAT网关，且安全组允许出站HTTP/HTTPS流量
   • 若通过内网访问，需配置S3 VPC端点，确保端点策略允许该Lambda角色访问目标Bucket
     网络不通会导致请求无法送达S3，触发Lambda进程强制终止。

2. 启用AWS SDK详细日志
   修改S3Client配置开启DEBUG日志，获取请求执行的完整链路信息：

   const s3Client = new S3Client({ 
     region: process.env.REGION,
     logger: console,
     logLevel: 'debug'
   });
   

   详细日志会暴露请求发送状态、握手过程、响应头或隐藏的错误信息。

3. 验证Lambda角色的权限边界与信任关系

   • 检查角色信任策略，确认允许lambda.amazonaws.com扮演该角色
   • 查看是否存在权限边界（Permission Boundary），即使附加了GetObject策略，权限边界可能会限制实际可执行的操作

4. 调整Lambda内存配置并测试小对象
   若S3对象体积较大，Lambda内存不足可能导致进程崩溃：

   • 临时将Lambda内存从默认值调高至512MB或1GB，测试是否恢复正常
   • 使用小体积的测试对象验证是否存在内存或处理能力瓶颈

5. 替换自定义流处理逻辑
   自定义streamToPromise可能存在未捕获的异常，改用AWS SDK内置方法处理响应体：

   // 替换原有解码逻辑
   const body = await response.Body.transformToString();
   return JSON.parse(body);
   

   避免自定义流处理带来的潜在阻塞或异常问题。

6. 排查Serverless SDK的影响
   日志中出现Serverless SDK的未关闭跟踪警告，临时移除Serverless SDK相关配置，测试是否是SDK拦截请求导致执行中断。

内容的提问来源于stack exchange，提问作者leon