AWS Event Scheduler未触发Lambda函数问题排查求助

参考AWS官方博客，使用AWS Event Scheduler（而非事件触发器，因其支持带时区的Cron表达式）实现RDS实例的定时自动启停。事件已成功创建且按计划时间触发，但未调用目标Lambda函数，无法定位问题原因。相关Terraform配置如下：

Event Bridge 配置 #

resource "aws_scheduler_schedule" "lambda-trigger-rule" {
  description = "Eventbridge schedule to trigger lambda that stops/starts RDS"
  flexible_time_window {
    mode = "OFF"
  }
  schedule_expression          = var.schedule_expression
  schedule_expression_timezone = "Europe/Amsterdam"
  target {
    arn      = var.lambda_function_arn
    role_arn = var.iam_role_arn
  }
}

Lambda 配置 #

locals {
  name                   = var.rds_shutdown ? "rds-shutdown" : "rds-start"
  lambda_output_path_dir = var.rds_shutdown ? "/tmp/tfartifacts_stp" : "/tmp/tfartifacts_strt"
}

data "aws_region" "current" {}


resource "null_resource" "install_dependencies" {
  provisioner "local-exec" {
    command = "mkdir -p ${local.lambda_output_path_dir} && cp -r ${path.module}/python/${local.name} ${local.lambda_output_path_dir}/python"
  }
  triggers = {
    always_run = timestamp()
  }
}

data "archive_file" "zip_the_python_code" {
  type        = "zip"
  source_dir  = "${local.lambda_output_path_dir}/python"
  output_path = "${local.lambda_output_path_dir}/${local.name}.zip"
  depends_on  = [null_resource.install_dependencies]
}

resource "aws_lambda_function" "this" {
  filename         = data.archive_file.zip_the_python_code.output_path
  source_code_hash = data.archive_file.zip_the_python_code.output_base64sha256
  function_name    = local.name
  role             = var.lambda_stop_start_role_arn
  handler          = "lambda_function.lambda_handler"
  runtime          = "python3.9"
  timeout          = 180
  vpc_config {
    subnet_ids         = var.subnet_ids
    security_group_ids = var.security_group_ids
  }
  environment {
    variables = {
      "REGION" = data.aws_region.current.name
      "KEY"    = "Auto-Start-Shutdown"
      "VALUE"  = true
    }
  }
}

IAM 角色配置 #

resource "aws_iam_role" "scheduler_role" {
  name                 = "scheduler_role_to_trigger_lambda"
  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/AdministratorAccessPermissionBoundary"
  assume_role_policy   = jsonencode({
    "Version" = "2012-10-17"
    "Statement" : [
      {
        "Effect" : "Allow",
        "Principal" : {
          "Service" : "scheduler.amazonaws.com"
        },
        "Action" : "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_policy" "lambda_invoke_policy" {
  name        = "lambda_invoke_policy"
  description = "Permissions required by scheduler to invoke lambda function"
  policy      = jsonencode({
    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Action" : [
          "lambda:Invoke"
        ],
        "Effect" : "Allow",
        "Resource" : "*"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "scheduler_lambda_invoke_policy_attachment" {
  role       = aws_iam_role.scheduler_role.name
  policy_arn = aws_iam_policy.lambda_invoke_policy.arn
}

事件已按计划时间触发，但从未调用Lambda函数，如何解决该问题？

• 修正IAM权限动作：AWS Event Scheduler调用Lambda需要的是lambda:InvokeFunction动作，而非配置中的lambda:Invoke。同时建议限定资源到具体Lambda ARN，提升安全性：

  resource "aws_iam_policy" "lambda_invoke_policy" {
    name        = "lambda_invoke_policy"
    description = "Permissions required by scheduler to invoke lambda function"
    policy      = jsonencode({
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Action" : [
            "lambda:InvokeFunction"
          ],
          "Effect" : "Allow",
          "Resource" : var.lambda_function_arn
        }
      ]
    })
  }
  

• 检查权限边界限制：确认AdministratorAccessPermissionBoundary策略允许scheduler.amazonaws.com执行lambda:InvokeFunction动作，权限边界会覆盖角色附加的策略，若受限则无法执行调用。
• 验证Lambda VPC配置：Lambda配置了VPC的话，需确保子网有访问Lambda服务的能力——若需公网访问要配置NAT网关，内网访问则需配置Lambda的VPC端点；同时安全组要允许对应出站流量。
• 核对变量引用正确性：确认var.iam_role_arn确实指向创建的scheduler_role的ARN，避免变量引用错误导致角色权限不匹配。
• 查看CloudWatch日志：在CloudWatch中搜索Event Scheduler的执行日志，查找具体错误信息（如权限拒绝、目标ARN无效等），精准定位失败原因。

内容的提问来源于stack exchange，提问作者mmkk18