无法配置AWS SNS触发Lambda函数，求排查CloudFormation模板问题

你的CloudFormation模板里缺少SNS主题到Lambda函数的订阅资源，这就是Lambda触发器页面提示找不到订阅的核心原因。InvokeLambdaPermission仅用于赋予SNS调用Lambda的权限，并未建立两者之间的触发关联，必须通过AWS::SNS::Subscription资源来创建这个订阅关系。

修复步骤 #

在模板的Resources部分添加以下订阅资源：

LambdaSnsSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Protocol: lambda
      Endpoint: !Ref S3SyncLambdaFunction
      TopicArn: !Ref AdtTopic

完整修改后的Resources部分示例 #

Resources:

  S3SyncLambdaFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: app.lambda_handler
      MemorySize: 512
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/${LambdaRoleName}"
      Code:
        S3Bucket: !FindInMap
          - EnvironmentMap
          - !Ref AipEnv
          - TeamBucket
        S3Key: !Sub >-
          ${ServiceName}/lambda/s3sync/${ServiceVersion}/lambda-function.zip
      FunctionName: !Sub >-
          aip-s3sync-${AipEnv}-${ServiceName}-${ServiceVersion}
      Runtime: python3.9
      Timeout: 300
      Environment:
        Variables:
          TEAM_BUCKET: !FindInMap
            - EnvironmentMap
            - !Ref AipEnv
            - TeamBucket
      Tags:
        - Key: Billing
          Value: !FindInMap
            - EnvironmentMap
            - !Ref AipEnv
            - BillingTag
        - Key: COST_CENTER
          Value: !FindInMap
            - EnvironmentMap
            - !Ref AipEnv
            - CostCenterTag
        - Key: APP_ID
          Value: !FindInMap
            - EnvironmentMap
            - !Ref AipEnv
            - ApplicationId
        - Key: Description
          Value: !Ref DescriptionTag

  AdtTopic:
    Type: 'AWS::SNS::Topic'
    Properties:
      TopicName: !Sub "aip-${AipEnv}-${ServiceName}-NewAdtSNS"
      KmsMasterKeyId: alias/SNS
      Tags:
        - Key: Billing
          Value: !FindInMap
            - EnvironmentMap
            - !Ref AipEnv
            - BillingTag
        - Key: COST_CENTER
          Value: !FindInMap
            - EnvironmentMap
            - !Ref AipEnv
            - CostCenterTag
        - Key: APP_ID
          Value: !FindInMap
            - EnvironmentMap
            - !Ref AipEnv
            - ApplicationId
        - Key: Description
          Value: !Ref DescriptionTag

  AdtTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: AdtTopicPolicy
        Version: '2012-10-17'
        Statement:
          - Sid: Allow-S3-id
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: sns:Publish
            Resource: !Ref AdtTopic
            Condition:
                StringEquals:
                  aws:SourceAccount: !Ref SourceAccountId
                ArnLike:
                  aws:SourceArn: !Sub "arn:aws:s3:*:*:${SourceS3Bucket}"
      Topics:
        - !Ref AdtTopic

  InvokeLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref S3SyncLambdaFunction
      Principal: sns.amazonaws.com
      SourceArn: !Ref AdtTopic

  # 新增的SNS订阅资源，建立Lambda与SNS的触发关联
  LambdaSnsSubscription:
    Type: AWS::SNS::Subscription
    Properties:
      Protocol: lambda
      Endpoint: !Ref S3SyncLambdaFunction
      TopicArn: !Ref AdtTopic

关键说明 #

• Protocol: lambda：指定订阅协议为Lambda，告知SNS将消息发送至Lambda函数
• Endpoint：通过!Ref引用模板中的Lambda资源，自动填充其ARN
• TopicArn：通过!Ref引用模板中的SNS主题资源，自动填充其ARN

添加该资源后重新部署CloudFormation堆栈，Lambda的触发器页面即可看到对应的SNS订阅。

内容的提问来源于stack exchange，提问作者Arthur