使用Terraform配置Cognito Sync触发Lambda函数遇阻求助

问题本质 #

仅通过aws_lambda_permission给Lambda授权Cognito调用权限是不够的，Terraform官方的aws_cognito_identity_pool资源确实没有直接配置事件触发器的字段，还需要额外给Identity Pool绑定触发器的关联配置才能让控制台显示正常。

可行解决方案 #

方案1：用Terraform的aws_resource调用AWS API配置触发器

通过aws_resource直接调用Cognito的SetIdentityPoolConfiguration API来添加Sync触发器，同时配合Lambda权限配置：

# 配置Lambda允许Cognito Sync调用的权限
resource "aws_lambda_permission" "cognito_sync_permission" {
  statement_id  = "AllowCognitoSyncInvoke"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.your_sync_lambda.function_name
  principal     = "cognito-sync.amazonaws.com"
  source_arn    = aws_cognito_identity_pool.your_identity_pool.arn
}

# 给Identity Pool绑定Sync触发器
resource "aws_resource" "cognito_sync_trigger" {
  type = "AWS::Cognito::IdentityPool"
  name = "cognito-sync-trigger-setup"

  properties = {
    IdentityPoolId = aws_cognito_identity_pool.your_identity_pool.id
    CognitoEvents = {
      "SyncTrigger" = aws_lambda_function.your_sync_lambda.arn
    }
  }

  depends_on = [aws_lambda_permission.cognito_sync_permission]
}

方案2：用local-exec执行AWS CLI命令配置

如果aws_resource方式存在兼容问题，可通过local-exec在Terraform部署时执行CLI命令完成触发器配置：

resource "null_resource" "set_cognito_sync_trigger" {
  depends_on = [aws_lambda_permission.cognito_sync_permission, aws_cognito_identity_pool.your_identity_pool]

  provisioner "local-exec" {
    command = <<EOT
aws cognito-identity set-identity-pool-configuration \
  --identity-pool-id ${aws_cognito_identity_pool.your_identity_pool.id} \
  --cognito-events '{"SyncTrigger": "${aws_lambda_function.your_sync_lambda.arn}"}'
EOT
  }
}

关键注意点 #

• 执行Terraform的账号需要拥有cognito-identity:SetIdentityPoolConfiguration和lambda:AddPermission权限
• 配置完成后刷新Cognito控制台，触发器状态会显示正常
• 由于Cognito Sync属于旧服务，Terraform原生资源支持有限，上述两种方式都是绕开原生限制的有效办法

内容的提问来源于stack exchange，提问作者harishanth raveendren