LocalStack调用Terraform部署的Lambda函数持续返回sts.AssumeRole 200并超时

在LocalStack环境中调用Terraform部署的Lambda函数时，Docker容器持续输出sts.AssumeRole => 200日志，最终调用超时，收到错误提示：

Read timeout on endpoint URL: "http://localhost:4566/2015-03-31/functions/test-dev-test-app/invocations"

预期能收到Lambda返回的{'statusCode': 200, 'body': 'Request Succeeded.'}。

容器日志 #

2023-07-19 10:42:35 localstack_main  | 2023-07-19T02:42:35.522  INFO --- [   asgi_gw_5] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:36 localstack_main  | 2023-07-19T02:42:36.526  INFO --- [   asgi_gw_4] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:37 localstack_main  | 2023-07-19T02:42:37.523  INFO --- [   asgi_gw_1] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:38 localstack_main  | 2023-07-19T02:42:38.523  INFO --- [   asgi_gw_5] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:39 localstack_main  | 2023-07-19T02:42:39.524  INFO --- [   asgi_gw_4] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:40 localstack_main  | 2023-07-19T02:42:40.524  INFO --- [   asgi_gw_1] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:41 localstack_main  | 2023-07-19T02:42:41.525  INFO --- [   asgi_gw_5] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:42 localstack_main  | 2023-07-19T02:42:42.525  INFO --- [   asgi_gw_4] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:43 localstack_main  | 2023-07-19T02:42:43.525  INFO --- [   asgi_gw_1] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:44 localstack_main  | 2023-07-19T02:42:44.526  INFO --- [   asgi_gw_4] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:45 localstack_main  | 2023-07-19T02:42:45.527  INFO --- [   asgi_gw_1] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:46 localstack_main  | 2023-07-19T02:42:46.527  INFO --- [   asgi_gw_5] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:47 localstack_main  | 2023-07-19T02:42:47.528  INFO --- [   asgi_gw_4] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:48 localstack_main  | 2023-07-19T02:42:48.528  INFO --- [   asgi_gw_1] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:49 localstack_main  | 2023-07-19T02:42:49.529  INFO --- [   asgi_gw_5] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:50 localstack_main  | 2023-07-19T02:42:50.530  INFO --- [   asgi_gw_4] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:51 localstack_main  | 2023-07-19T02:42:51.530  INFO --- [   asgi_gw_1] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:52 localstack_main  | 2023-07-19T02:42:52.530  INFO --- [   asgi_gw_5] localstack.request.aws     : AWS sts.AssumeRole => 200
2023-07-19 10:42:53 localstack_main  | 2023-07-19T02:42:53.531  INFO --- [   asgi_gw_4] localstack.request.aws     : AWS sts.AssumeRole => 200

Lambda函数代码 #

SUCCESS = {'statusCode': 200, 'body': 'Request Succeeded.'}

def lambda_handler(event, context):          
    print(str(event))
    return SUCCESS

Lambda调用命令 #

aws --endpoint-url=http://localhost:4566 lambda invoke --function-name test-dev-test-app --payload '{}' response.json

Docker Compose启动命令 #

docker compose up

Docker Compose配置文件 #

version: "3.8"

services:
  localstack:
    container_name: "${LOCALSTACK_DOCKER_NAME-localstack_main}"
    image: localstack/localstack
    ports:
      - "127.0.0.1:4566:4566"            # LocalStack Gateway
      - "127.0.0.1:4510-4559:4510-4559"  # external services port range
    environment:
      - DEBUG=${DEBUG-}
      - DOCKER_HOST=unix:///var/run/docker.sock
      - AWS_DEFAULT_REGION = ap-southeast-1
      - SERVICES=lambda,s3,cloudformation,sts,apigateway,iam,route53,dynamodb
    volumes:
      - "${LOCALSTACK_VOLUME_DIR:-./volume}:/var/lib/localstack"
      - "/var/run/docker.sock:/var/run/docker.sock"

排查与解决步骤 #

• 修正环境变量格式：Docker Compose中AWS_DEFAULT_REGION = ap-southeast-1存在多余空格，环境变量赋值不能包含空格，改为AWS_DEFAULT_REGION=ap-southeast-1，否则LocalStack无法正确识别区域，引发角色假设循环。
• 验证Lambda执行角色配置：检查Terraform部署的Lambda执行角色，确保信任策略允许Lambda服务扮演该角色，且权限配置合理，避免LocalStack反复尝试AssumeRole操作。
• 启用DEBUG日志：设置DEBUG=1环境变量，查看LocalStack详细日志，定位AssumeRole请求的发起方及潜在错误。
• 检查Docker网络连通性：确认LocalStack容器可正常访问挂载的/var/run/docker.sock，Lambda执行依赖启动临时容器，网络或权限问题会导致调用超时。
• 升级LocalStack版本：旧版本可能存在Lambda调用时的AssumeRole循环bug，切换至localstack/localstack:latest镜像尝试解决。

内容的提问来源于stack exchange，提问作者Benjamin Tan Ch'ing Jui