如何获取AWS::ApiGateway::Method的ARN用于Lambda权限配置

AWS::ApiGateway::Method资源确实不支持通过Fn::GetAtt获取ARN，无法直接引用方法资源填充Lambda Permission的SourceArn字段。不过可以用Fn::Sub实现比!Join更简洁的ARN拼接，通过变量替换直接生成目标ARN。

针对你的模板，修改lambdaAPermission和lambdaBPermission的SourceArn字段如下：

修改后的Lambda权限资源配置 #

"lambdaAPermission": {
  "Type": "AWS::Lambda::Permission",
  "Properties": {
    "Action": "lambda:InvokeFunction",
    "FunctionName": {
      "Fn::Sub": "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:lambdaA-${Environment}"
    },
    "Principal": "apigateway.amazonaws.com",
    "SourceArn": {
      "Fn::Sub": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${APIGatewayRestAPI}/${Environment}/POST/lambdaA-${Environment}"
    }
  },
  "DependsOn": ["APIGatewayDeployment"]
},
"lambdaBPermission": {
  "Type": "AWS::Lambda::Permission",
  "Properties": {
    "Action": "lambda:InvokeFunction",
    "FunctionName": {
      "Fn::Sub": "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:lambdaB-${Environment}"
    },
    "Principal": "apigateway.amazonaws.com",
    "SourceArn": {
      "Fn::Sub": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${APIGatewayRestAPI}/${Environment}/POST/lambdaB-${Environment}"
    }
  },
  "DependsOn": ["APIGatewayDeployment"]
}

说明 #

• Fn::Sub会自动替换模板中的内置变量与自定义参数，直接生成符合格式的ARN，写法比!Join更直观紧凑。
• ARN遵循格式：arn:aws:execute-api:<区域>:<账号ID>:<API ID>/<阶段>/<HTTP方法>/<资源路径>，其中：
  • <API ID>通过${APIGatewayRestAPI}引用RestApi资源
  • <阶段>直接使用${Environment}参数（与Deployment的StageName一致）
  • <资源路径>对应你定义的lambdaAResource/lambdaBResource的PathPart值

内容的提问来源于stack exchange，提问作者shrijay