如何在CloudFormation中为Lambda配置DLQ及EventBridge触发重试设置

1. CloudFormation中Lambda异步DLQ的配置格式 #

要在CloudFormation中为Lambda配置异步调用的DLQ，需在Lambda函数资源的Properties字段下添加DeadLetterConfig，指定已创建的SQS队列或SNS主题的ARN即可，格式示例如下：

DeadLetterConfig:
  TargetArn: "arn:aws:sqs:us-east-1:123456789012:YourExistingDLQ"

2. 是否需要在lambda.yaml和manifest.yaml中添加配置？ #

• 如果lambda.yaml是CloudFormation模板的组成部分（比如单独定义Lambda资源的子模板），需要在其中添加DeadLetterConfig配置。
• manifest.yaml通常用于SAM或其他部署工具的部署配置，若你的部署流程依赖该文件，需同步配置DLQ相关参数；如果是纯CloudFormation部署，仅需在CloudFormation模板中完成配置即可。

3. EventBridge->Lambda->DLQ架构的CloudFormation模板示例 #

以下是包含EventBridge规则、Lambda绑定DLQ、EventBridge重试配置的完整模板：

AWSTemplateFormatVersion: '2010-09-09'
Description: EventBridge触发Lambda并配置异步DLQ及重试规则

Resources:
  # 若已存在DLQ，可删除此段，直接引用其ARN
  LambdaAsyncDLQ:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: LambdaAsyncFailureQueue

  # 目标Lambda函数
  EventTriggeredLambda:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: EventDrivenProcessingLambda
      Runtime: python3.11
      Handler: index.lambda_handler
      Code:
        ZipFile: |
          import json
          def lambda_handler(event, context):
              # 模拟处理失败，触发DLQ流转
              raise Exception("Event processing failed")
      Role: !GetAtt LambdaExecutionRole.Arn
      # 配置异步调用DLQ
      DeadLetterConfig:
        TargetArn: !GetAtt LambdaAsyncDLQ.Arn
      # 可选：设置Lambda自身的异步重试次数（默认2次）
      AsyncInvokeConfig:
        MaxRetryAttempts: 1

  # Lambda执行角色
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: LambdaExecutionRole-EventBridge
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      # 赋予Lambda向DLQ发送消息的权限
      Policies:
        - PolicyName: SendToDLQPermission
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: sqs:SendMessage
                Resource: !GetAtt LambdaAsyncDLQ.Arn

  # EventBridge触发规则
  LambdaTriggerRule:
    Type: AWS::Events::Rule
    Properties:
      RuleName: EventMatchTriggerRule
      Description: Trigger Lambda when event pattern matches
      EventPattern:
        source:
          - "your.event.source"
        detail-type:
          - "your.event.detail.type"
      Targets:
        - Arn: !GetAtt EventTriggeredLambda.Arn
          Id: "LambdaTarget"
          # 配置EventBridge层面的重试策略
          RetryPolicy:
            MaximumRetryAttempts: 3
            MaximumEventAgeInSeconds: 86400 # 事件最长留存1天
          # EventBridge调用Lambda的角色ARN
          RoleArn: !GetAtt EventBridgeInvokeLambdaRole.Arn

  # EventBridge调用Lambda的权限角色
  EventBridgeInvokeLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EventBridgeInvokeLambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: InvokeLambdaPermission
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: lambda:InvokeFunction
                Resource: !GetAtt EventTriggeredLambda.Arn

关键说明 #

• Lambda的DeadLetterConfig仅作用于异步调用场景，同步调用失败不会触发DLQ。
• EventBridge的RetryPolicy控制规则层面的重试次数和事件留存时间，与Lambda自身的异步重试是独立的两层重试逻辑。
• 必须确保Lambda拥有向DLQ发送消息的权限，EventBridge拥有调用Lambda的权限，否则会出现权限错误导致事件丢失。

内容的提问来源于stack exchange，提问作者john