添加Lambda权限时触发AccessDeniedException问题求助

遇到的AccessDeniedException错误主要源于配置中的占位符未替换、IAM策略逻辑错误以及权限资源配置不完整，以下是具体修复步骤：

1. 修正Lambda执行角色的信任策略 #

Lambda执行角色仅需要允许lambda.amazonaws.com服务扮演该角色，Secrets Manager调用Lambda不需要通过假设此角色，因此移除多余的信任声明：

resource "aws_iam_role" "secret_rotation_lambda_execution_role" {
  name        = "secret_rotation_lambda_execution_role"
  description = "Execution role for secret rotation lambda"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action    = "sts:AssumeRole"
        Effect    = "Allow"
        Sid       = ""
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })
}

2. 修复IAM Policy中的Lambda调用权限 #

原配置中lambda:InvokeFunction的Resource硬编码为"arn"，需要替换为实际的Lambda函数ARN引用：

resource "aws_iam_policy" "secrets_manager_policy" {
  name        = "secrets_manager_rotation_policy"
  description = "Policy for AWS Secrets Manager to invoke the secret rotation lambda"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow",
        Action   = [
          "secretsmanager:GetSecretValue",
          "secretsmanager:PutSecretValue",
          "secretsmanager:RotateSecret",
          "secretsmanager:UpdateSecret",
          "secretsmanager:DescribeSecret",
          "secretsmanager:UpdateSecretVersionStage",
          "secretsmanager:ListSecretVersionIds"
        ],
        Resource = "*"
      },
      {
        Effect   = "Allow",
        Action   = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ],
        Resource = "*"
      },
      {
        Effect   = "Allow",
        Action   = ["lambda:InvokeFunction"],
        Resource = aws_lambda_function.rotation_lambda.arn
      }
    ]
  })
}

3. 修正Lambda权限配置 #

aws_lambda_permission中的source_arn需要指定允许调用Lambda的Secrets Manager Secret ARN，同时避免硬编码函数名，改用资源引用：

resource "aws_lambda_permission" "allow_rotate_secrets_permission" {
  statement_id  = "AllowExecutionFromSecretsManager"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.rotation_lambda.function_name
  principal     = "secretsmanager.amazonaws.com"
  source_arn    = aws_secretsmanager_secret.secret.arn
}

4. 修复Secrets Manager轮换配置 #

将硬编码的rotation_lambda_arn替换为Lambda函数的ARN引用：

resource "aws_secretsmanager_secret_rotation" "secret" {
  secret_id           = aws_secretsmanager_secret.secret.id
  rotation_lambda_arn = aws_lambda_function.rotation_lambda.arn
  rotation_rules {
    automatically_after_days = 30 
  }
  depends_on = [aws_lambda_permission.allow_rotate_secrets_permission]
}

5. 补充Lambda函数的filename配置 #

原Lambda配置中filename为空，需指定代码包路径（与source_code_hash中的路径保持一致）：

resource "aws_lambda_function" "rotation_lambda" {
    function_name      = "RotationLambda"
    filename           = "zips/file.zip" # 补充代码包路径
    role               = aws_iam_role.secret_rotation_lambda_execution_role.arn
    handler            = "FunctionHandler"
    runtime            = "dotnet6"
    timeout            = 60
    memory_size        = 256
    description        = "Lambda for secret rotation for secrets stored in secrets manager"
    source_code_hash   = filebase64sha256("zips/file.zip")
}

关键错误点总结 #

• 硬编码的"arn"占位符未替换为实际资源ARN，导致权限策略无效
• Lambda执行角色错误添加了Secrets Manager的信任声明，混淆了角色信任与Lambda权限的逻辑
• Lambda函数的filename为空，会导致代码包无法正确上传

内容的提问来源于stack exchange，提问作者Coding_ninja