AWS Step Function执行Lambda时CleanUpOnError步骤遇AccessDeniedException

执行Step Function调用Lambda时触发如下权限错误：

"errorType": "AccessDeniedException",
"errorMessage": "User: arn:aws:sts::14161:assumed-role/serverlessrepo-Functi-cleanerRole/serverlessrepo-=Function-p-cleaner is not authorized to perform: lambda:functionname on resource: arn:aws:lambda:function:functionname because no identity-based policy allows the lambda:functionname action"

相关CloudFormation资源定义：

Resources:
  FunctionExecutionRole: # Execution role for function
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: [
                "sts:AssumeRole",
                "lambda:InvokeAsync",
                "lambda:InvokeFunction"
            ]
            Resource: "*"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambda_FullAccess
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
        - arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess 
      Tags: 
        - Key: Application
          Value: !Sub '${ApplicationTag}'
  Function1:
    Type: AWS::Serverless::Function # Find or Create alias lambda function
    Properties:
      PackageType: Image
      ImageConfig:
        Command:
        - function1.lambda_handler
      ImageUri: 
      AutoPublishAlias: live # This property enables lambda function versioning. 
      Role: !GetAtt FindOrCreateAliasExecutionRole.Arn
      Tags: 
        Application: !Sub '${ApplicationTag}'  

自身无权限修改IAM角色、策略及权限，寻求解决办法。

由于无法修改调用方（Step Function使用的serverlessrepo-Functi-cleanerRole）的身份策略，可通过给目标Lambda添加资源级权限策略放行调用：

手动配置方式 #

找到ARN为arn:aws:lambda:function:functionname的目标Lambda，添加以下资源策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::14161:role/serverlessrepo-Functi-cleanerRole"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:function:functionname"
    }
  ]
}

CloudFormation配置方式 #

如果目标Lambda通过CloudFormation管理，可在Function1的Properties中新增Permissions字段：

Function1:
  Type: AWS::Serverless::Function
  Properties:
    # 保留原有属性
    Permissions:
      - FunctionName: !Ref Function1
        Action: lambda:InvokeFunction
        Principal: "arn:aws:iam::14161:role/serverlessrepo-Functi-cleanerRole"

注：需确保你拥有lambda:AddPermission权限来完成以上操作。

内容的提问来源于stack exchange，提问作者Tanu