使用GitHub Actions预生产测试失败：Lambda角色参数报错求助

问题场景 #

在GitHub Actions工作流中部署前测试Lambda函数，测试任务执行时始终报--role参数缺失错误，但代码中已明确指定了角色ARN。

原工作流代码 #

test:
  runs-on: ubuntu-latest
  needs: upload
  steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1
      - name: Create test function  
        run: |  
          aws lambda create-function \
            --function-name test-function \
            --runtime python3.8 \  
            --code S3Bucket=my-github-action-89675,S3Key=${{ github.sha }}.zip \  
            --handler lambda_function.lambda_handler \
            --role arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/lamda-github-action-role
      - name: Wait 30 seconds  
        run: sleep 30  
      - name: Destroy test function  
        if: ${{ always() }}  
        run: aws lambda delete-function --function-name test-function

报错信息 #

usage: aws [options] <command> <subcommand> [<subcommand> ...] [parameters]
To see help text, you can run:

  aws help
  aws <command> help
  aws <command> <subcommand> help

aws: error: the following arguments are required: --role

Error: Process completed with exit code 252.

问题原因 #

代码中aws lambda create-function命令的每行末尾反斜杠后面存在多余空格，导致Shell无法正确识别行延续，后续的--role参数被当成了独立命令，原命令自然缺失了必填的--role参数。

另外注意角色名称拼写：lamda-github-action-role少了字母b，应为lambda-github-action-role，虽然这不是当前报错的直接原因，但会导致后续角色无法找到。

修复方案 #

1. 移除所有反斜杠后面的多余空格，确保反斜杠是行的最后一个字符
2. 修正角色名称的拼写错误

修复后的工作流代码 #

test:
  runs-on: ubuntu-latest
  needs: upload
  steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1
      - name: Create test function  
        run: |  
          aws lambda create-function \
            --function-name test-function \
            --runtime python3.8 \
            --code S3Bucket=my-github-action-89675,S3Key=${{ github.sha }}.zip \
            --handler lambda_function.lambda_handler \
            --role arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/lambda-github-action-role
      - name: Wait 30 seconds  
        run: sleep 30  
      - name: Destroy test function  
        if: ${{ always() }}  
        run: aws lambda delete-function --function-name test-function

额外检查点 #

• 确认GitHub仓库的AWS_ACCOUNT_ID密钥已正确配置，值不为空，否则会生成不完整的角色ARN
• 确保用于配置AWS凭证的Access Key拥有足够权限：需要lambda:CreateFunction、lambda:DeleteFunction权限，同时必须拥有iam:PassRole权限来传递指定的Lambda角色
• 验证Lambda角色本身已附加基本的Lambda执行权限策略（比如AWSLambdaBasicExecutionRole）

内容的提问来源于stack exchange，提问作者zizora