在AWS Lambda中调用Google Cloud API遇cygrpc导入错误求助

我正尝试在AWS Lambda函数中使用Google SDK，但Google的文档与API执行逻辑十分晦涩。已为Lambda函数添加Google-Resource-manager和Google-cloud包作为层，参考官方文档尝试从父文件夹列出已有项目，步骤如下：

• 从存储在Secret Manager中的服务账号JSON生成令牌；
• 列出项目。

我的Lambda函数代码如下：

import json,os
from datetime import date
import boto3, requests
from google.oauth2 import service_account
#from oauth2client.service_account import ServiceAccountCredentials


def lambda_handler(event, context):
    # TODO implement
    
    credentails = get_secret("mysecret")
    print(credentails)
    print(credentails['type'])
    json_acct_info = {
        "type":credentails["type"],
        "project_id":credentails["project_id"],
        "private_key_id":credentails["private_key_id"],
        "private_key":credentails["private_key"],
        "client_email":credentails["client_email"],
        "client_id":credentails["client_id"],
        "auth_uri":credentails["auth_uri"],
        "token_uri":credentails["token_uri"],
        "auth_provider_x509_cert_url":credentails["auth_provider_x509_cert_url"],
        "client_x509_cert_url":credentails["client_x509_cert_url"],
        "universe_domain":credentails["universe_domain"],
        "type":credentails["type"],
    }
    
    json_acct_info = json.dumps(json_acct_info)
    
    print(json_acct_info)
    try:
        
        SCOPES = ['https://www.googleapis.com/auth/cloud-platform']
        gcredentials = service_account.Credentials.from_service_account_info(json_acct_info,scopes=SCOPES)
        print(gcredentials)
        return {"responseCode":200,"message":gcredentials}
    except Exception as err:
        raise err



def get_secret(secret_name):
    print("inside get_secret",secret_name)
    region_name = "us-west-2"

    # Create a Secrets Manager client
    session = boto3.session.Session()
    client = session.client(
        service_name='secretsmanager',
        region_name=region_name
    )
    try:
        get_secret_value_response = client.get_secret_value(
            SecretId=secret_name
        )
    except Exception as err:
        raise err
    else:
        return json.loads(get_secret_value_response['SecretString'])

执行Lambda时出现以下错误，不确定是代码存在问题还是附加的层配置有误：

{
  "errorMessage": "Unable to import module 'gcp_get_assignment_role_data': cannot import name 'cygrpc' from 'grpc._cython' (/opt/python/grpc/_cython/__init__.py)",
  "errorType": "Runtime.ImportModuleError",
  "requestId": "8fc3cabe-9aa2-442d-aaaf-3c9c7222577e",
  "stackTrace": []
}

问题分析与解决方法 #

1. cygrpc导入错误的根源 #

这个错误是Lambda运行环境与构建Google SDK层的环境不匹配导致的。gRPC的cygrpc是编译后的二进制文件，依赖特定系统架构和操作系统，若在本地（如macOS/Windows）构建层，上传到Lambda的Linux环境会出现兼容性问题。

2. 正确构建Lambda层的方法 #

需在与Lambda兼容的环境中构建依赖包：

• 使用Amazon Linux 2的Docker容器安装依赖，确保二进制文件适配Lambda运行环境
• 或直接在Lambda的Cloud9环境中构建层

具体步骤：

• 创建空目录gcp-layers，进入后创建python子目录
• 在兼容环境中执行：pip install google-cloud-resource-manager google-auth -t python/
• 压缩python目录为zip包，上传作为Lambda层

3. 代码中的小问题修正 #

代码存在两处可优化点：

• json_acct_info无需用json.dumps()转成字符串，from_service_account_info直接接受字典类型，转字符串会导致认证失败
• 重复设置了"type":credentails["type"]，可删除重复项

修正后的核心代码片段：

# 去除重复字段，直接使用字典
json_acct_info = {
    "type":credentails["type"],
    "project_id":credentails["project_id"],
    "private_key_id":credentails["private_key_id"],
    "private_key":credentails["private_key"],
    "client_email":credentails["client_email"],
    "client_id":credentails["client_id"],
    "auth_uri":credentails["auth_uri"],
    "token_uri":credentails["token_uri"],
    "auth_provider_x509_cert_url":credentails["auth_provider_x509_cert_url"],
    "client_x509_cert_url":credentails["client_x509_cert_url"],
    "universe_domain":credentails["universe_domain"],
}

# 直接传入字典，无需转JSON字符串
gcredentials = service_account.Credentials.from_service_account_info(json_acct_info, scopes=SCOPES)

4. 后续测试 #

替换现有层为正确构建的版本，用修正后的代码测试，即可解决导入错误与潜在认证问题，之后就能调用Google Resource Manager API列出项目。

内容的提问来源于stack exchange，提问作者K P