跨账户Lambda触发器的SQS队列配置问题排查

问题描述 #

尝试将AWS账户111111111111下的SQS队列sqs-lambda-demo配置为另一个AWS账户2222222222下Lambda函数test-print的触发器时，遇到权限类错误。怀疑可能的原因：

• 当前用于控制台操作的IAM角色无权限配置Lambda触发器
• SQS权限策略或Lambda执行角色缺失必要权限

现有权限策略 #

SQS队列权限策略

{
  "Version": "2008-10-17",
  "Id": "arn:aws:sqs:eu-west-1:111111111111:crossaccount-sqs/SQSDefaultPolicy",
  "Statement": [
    {
      "Sid": "AllowedSQSPermissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::2222222222:role/service-role/test-print-role-vb8smvxi"
      },
      "Action": [
        "SQS:ReceiveMessage",
        "SQS:DeleteMessage",
        "SQS:GetQueueAttributes"
      ],
      "Resource": "arn:aws:sqs:eu-west-1:111111111111:sqs-lambda-demo"
    }
  ]
}

Lambda执行角色权限策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sqs:DeleteMessage",
                "sqs:ChangeMessageVisibility",
                "sqs:ReceiveMessage",
                "sqs:GetQueueAttributes",
                "logs:CreateLogGroup"
            ],
            "Resource": [
                "arn:aws:sqs:eu-west-1:111111111111:sqs-lambda-demo",
                "arn:aws:logs:eu-west-1:2222222222:*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:eu-west-1:2222222222:log-group:/aws/lambda/test-print:*"
        },
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": [
                "lambda:CreateEventSourceMapping"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

修复步骤 #

1. 检查控制台操作角色权限 #

确保你当前操作AWS控制台所用的IAM角色拥有以下权限：

• lambda:CreateEventSourceMapping：创建触发器与Lambda的映射关系
• sqs:GetQueueAttributes：读取SQS队列属性以完成配置
• sqs:SetQueueAttributes（可选）：若需要通过控制台修改SQS策略则需添加

给该角色附加如下权限策略片段：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "lambda:CreateEventSourceMapping",
                "sqs:GetQueueAttributes",
                "sqs:SetQueueAttributes"
            ],
            "Resource": [
                "arn:aws:lambda:eu-west-1:2222222222:function:test-print",
                "arn:aws:sqs:eu-west-1:111111111111:sqs-lambda-demo"
            ]
        }
    ]
}

2. 补充SQS队列权限策略 #

当前SQS策略仅授权了Lambda执行角色的消息操作权限，但AWS Lambda服务本身需要权限轮询跨账户SQS队列，需添加Lambda服务主体的授权：
修改后的SQS权限策略：

{
  "Version": "2008-10-17",
  "Id": "arn:aws:sqs:eu-west-1:111111111111:crossaccount-sqs/SQSDefaultPolicy",
  "Statement": [
    {
      "Sid": "AllowedSQSPermissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::2222222222:role/service-role/test-print-role-vb8smvxi"
      },
      "Action": [
        "SQS:ReceiveMessage",
        "SQS:DeleteMessage",
        "SQS:GetQueueAttributes"
      ],
      "Resource": "arn:aws:sqs:eu-west-1:111111111111:sqs-lambda-demo"
    },
    {
      "Sid": "AllowLambdaServicePoll",
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sqs:ReceiveMessage",
      "Resource": "arn:aws:sqs:eu-west-1:111111111111:sqs-lambda-demo",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:lambda:eu-west-1:2222222222:function:test-print"
        }
      }
    }
  ]
}

3. 验证Lambda执行角色信任关系 #

确保Lambda执行角色的信任策略允许Lambda服务承担该角色（默认配置通常已包含，若缺失需添加）：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

4. 确认跨账户访问配置 #

在SQS所在账户（111111111111）中，确保已通过SQS策略明确授权Lambda所在账户（2222222222）的相关实体访问，步骤2的配置已覆盖此需求。

内容的提问来源于stack exchange，提问作者user2519653