通过CDK为Lambda添加InvokeLambda自调用权限失败排查

我尝试使用lambda-warmer NPM包，它需要lambda:InvokeFunction权限。我通过CDK添加了权限但未生效，相关代码如下：

添加权限的函数 #

function addActionPermissionToLambda(
    stack: Stack,
    lambdaFunction: IFunction,
    inlinePolicyName: ResourcesNames,
    resources: string[],
    actions: string[],
): void {
    const addedPolicy = new PolicyStatement({ actions, resources });

    // since adding a policy overrides basic actions/permissions. we need to add those. also called "AWSLambdaBasicExecutionRole".
    const logActions = new PolicyStatement(
        {
        actions: [
            "logs:CreateLogGroup",
            "logs:PutLogEvents",
            "logs:CreateLogStream"
        ],
        resources: ["*"]
        });

    lambdaFunction.role.attachInlinePolicy(new Policy(stack, buildConstructorId(stack, inlinePolicyName), {
        statements: [addedPolicy, logActions],
    }));
}

调用权限添加函数的代码 #

function addInvokeLambdaPermissionToLambda(
    stack: Stack,
    lambdaFunction: IFunction,
    name: ResourcesNames
) {
    addActionPermissionToLambda(stack, lambdaFunction, name, ["*"], ["Lambda:InvokeLambda"]);
}

实际使用代码 #

...const { lambdaFunction, version } = createLambda(
    stack,
    ResourcesNames.ContentManager,
    ResourcesNames.ContentManagerRole,
    "lambdas/contentManager"
);

addInvokeLambdaPermissionToLambda(stack, lambdaFunction, ResourcesNames.ContentManagerInvokeLambda);

我在Lambda的权限标签页中已看到Lambda:InvokeLambda权限（资源为所有资源），但调用时仍报错：

2023-09-13T14:26:03.839Z 5693bfff-5875-450c-a46f-fd2b079cb0ae ERROR Invoke Error
{
"errorType": "AccessDeniedException",
"errorMessage": "User: arn:aws:sts::625618361194:assumed-role/GsharimBackendStack-featu-GsharimBackendStackfeatu-1E62H8T2TSCXO/9604bdfbe04cbac6fb2dc6c98c9fdfde is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:eu-west-1:625618361194:function:9604bdfbe04cbac6fb2dc6c98c9fdfde because no identity-based policy allows the lambda:InvokeFunction action",
"name": "AccessDeniedException",
"$fault": "client",
"$metadata": {
"httpStatusCode": 403,
"requestId": "b08af667-4a78-44e2-b545-4bf8e23c31d4",
"attempts": 1,
"totalRetryDelay": 0
},
}

明明已配置对应权限，为何仍出现该错误？

核心原因：IAM动作名称错误 #

错误日志明确指出需要lambda:InvokeFunction权限，但你代码中配置的是Lambda:InvokeLambda——两个关键错误：

1. AWS IAM动作名称要求全小写开头，Lambda不符合规范，必须写成lambda
2. 正确的Lambda调用动作名称是InvokeFunction，而非InvokeLambda

这导致你配置的权限完全不匹配AWS的要求，控制台显示的权限只是你写入的错误值，实际无法生效。

修正代码 #

修改addInvokeLambdaPermissionToLambda函数中的动作参数，替换为正确的权限动作：

function addInvokeLambdaPermissionToLambda(
    stack: Stack,
    lambdaFunction: IFunction,
    name: ResourcesNames
) {
    addActionPermissionToLambda(stack, lambdaFunction, name, ["*"], ["lambda:InvokeFunction"]);
}

额外验证步骤 #

如果修正后仍有问题，可检查：

• 登录IAM控制台，查看Lambda关联角色的内联策略，确认策略中确实包含lambda:InvokeFunction动作和正确的资源范围（你用了["*"]，这部分无需调整）
• 确认lambda-warmer调用的目标Lambda ARN属于你配置的资源范围（此处为所有资源，无需额外验证）

内容的提问来源于stack exchange，提问作者itay H