CDK：如何为从基类实例化的Lambda添加托管策略？

尝试为从自定义SlackNotificationLambda类实例化的Lambda添加托管策略，遇到如下错误：

Property 'role' does not exist on type 'SlackNotificationLambda'.

基类代码 #

export class SlackNotificationLambda extends cdk.Stack {
    public readonly lambda: NodejsFunction;
    constructor(scope: cdk.App, id: string, props?: LambdaProps) {
        super(scope, id, props);

        this.lambda = new NodejsFunction(this, 'slack-notification-lambda', {
            memorySize: 1024,
            timeout: cdk.Duration.seconds(10),
            runtime: lambda.Runtime.NODEJS_16_X,
            handler: 'main',
            entry: path.join(__dirname, props.lambdaPath)
        });

   }
}

实例创建文件代码 #

import { SlackNotificationLambda } from '../lib/pipeline-slack-notifications-lambda'

const pipelineApprovalHandler = new SlackNotificationLambda(app, 'slack-approval-handler', {
    lambdaPath: '../slack-notifications-lambda/src/approval-handler.ts'
})
pipelineApprovalHandler.role?.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AWSCodePipelineApproverAccess'))

解决方案 #

错误原因很明确：SlackNotificationLambda是继承自cdk.Stack的栈类，本身并没有role属性。Lambda的执行角色属于栈内封装的lambda实例（即NodejsFunction对象）。

只需修改实例创建代码，通过栈实例的lambda属性访问真正的Lambda函数对象，再获取其role添加托管策略：

import { SlackNotificationLambda } from '../lib/pipeline-slack-notifications-lambda'

const pipelineApprovalHandler = new SlackNotificationLambda(app, 'slack-approval-handler', {
    lambdaPath: '../slack-notifications-lambda/src/approval-handler.ts'
})
// 修改为访问lambda属性下的role
pipelineApprovalHandler.lambda.role?.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AWSCodePipelineApproverAccess'))

内容的提问来源于stack exchange，提问作者Jatin Mehrotra