Cognito Post Confirmation触发Lambda函数失败问题求助

我通过AWS Amplify将用户注册信息同步到Cognito用户池，新用户能正常在Cognito中显示。我创建了Lambda函数用于将Cognito用户详情同步到DynamoDB，并将该Lambda设置为Cognito用户池的Post Confirmation触发器，但用户数据始终无法同步到DynamoDB。单独测试Lambda函数运行正常，推测问题出在Cognito、Amplify配置或者角色权限上，我已为Lambda角色配置了全Cognito访问权限。

我的Lambda函数 #

var aws = require('aws-sdk');
var ddb = new aws.DynamoDB({apiVersion: '2012-10-08'});

exports.handler = async (event, context) => {
    console.log(event);

    let date = new Date();

    const tableName = process.env.TABLE_NAME;
    const region = process.env.REGION;
  
    
    console.log("table=" + tableName + " -- region=" + region);

    aws.config.update({region: region});
    

    // If the required parameters are present, proceed
    if (event.request.userAttributes.sub) {

        // -- Write data to DDB
        let ddbParams = {
            Item: {
                'sub': {S: event.request.userAttributes.sub},
                'given_name': {S: event.request.userAttributes.given_name},
                'family_name': {S: event.request.userAttributes.family_name},
                'email': {S: event.request.userAttributes.email},
                'email_verified': {S: event.request.userAttributes.email_verified},
                'teamName': {S: event.request.userAttributes.teamName},
                'ifManager': {S: event.request.userAttributes.if_you_are_a_manager},
                'createdAt': {S: date.toISOString()},
            },
            TableName: tableName
        };
        console.log(ddbParams)

        // Call DynamoDB
        try {
            await ddb.putItem(ddbParams).promise()
            console.log("Success");
        } catch (err) {
            console.log("Error", err);
        }

        console.log("Success: Everything executed correctly");
        context.done(null, event);

    } else {
        // Nothing to do, the user's email ID is unknown
        console.log("Error: Nothing was written to DDB or SQS");
        context.done(null, event);
    }
};

我的Amplify文件 #

import { Amplify } from 'aws-amplify';

import { Authenticator } from '@aws-amplify/ui-react';
import '@aws-amplify/ui-react/styles.css';

import awsExports from './amplifyConfig';
Amplify.configure(awsExports);
const formFields = {
    signUp: {
      username: {
        order:1,
        labelHidden: false,
        label:'Email:',
        placeholder: 'Enter your email',
        isRequired: true,
      },
      given_name: {
        order: 2,
        label: 'First name:',
        placeholder: 'Enter your first name',
        isRequired: true,
  
      },
      family_name: {
        order: 3,
        label: 'Last name:',
        placeholder: 'Enter your last name',
        isRequired: true,
      },
      'custom:teamName':{
        order:4,
        label: 'Team name:',
        placeholder: 'Enter your team name',
        isRequired: true,
      },
      'custom:if_you_are_a_manager':{
        order:5,
        label: 'Are you a manager (Yes/No)?',
        placeholder: 'Please type Yes or No',
        isRequired: true,
      },
      password: {
        order: 6
      },
      confirm_password: {
        order: 7
      }
    },
  
  }
export default function AmplifyAuth() {
  return (
    <Authenticator formFields={formFields}>
      {({ signOut, user }) => (
        <main>
          <h1>Hello {user.attributes.given_name}</h1>
          <button onClick={signOut}>Sign out</button>
        </main>
      )}
    </Authenticator>
  );
}

1. 修正Lambda角色权限 #

你为Lambda配置了全Cognito权限，但Lambda需要的是DynamoDB写入权限。检查Lambda执行角色的权限策略，确保包含dynamodb:PutItem动作，目标为你的DynamoDB表ARN：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "dynamodb:PutItem",
            "Resource": "arn:aws:dynamodb:你的区域:你的账号ID:table/你的表名"
        }
    ]
}

2. 修正自定义属性引用 #

Amplify表单中自定义属性带custom:前缀，但Lambda中引用时遗漏了该前缀，导致无法获取值。修改Lambda中的属性引用：

// 原代码
'teamName': {S: event.request.userAttributes.teamName},
'ifManager': {S: event.request.userAttributes.if_you_are_a_manager},

// 修改后
'teamName': {S: event.request.userAttributes['custom:teamName']},
'ifManager': {S: event.request.userAttributes['custom:if_you_are_a_manager']},

3. 验证Cognito触发器配置 #

• 确认Cognito用户池的Post Confirmation触发器类型为Post Confirmation - Confirm Sign Up
• 检查触发器关联的Lambda函数是否正确，且Lambda与Cognito用户池处于同一区域

4. 验证Lambda环境变量 #

确认Lambda的TABLE_NAME和REGION环境变量已正确设置，对应你的DynamoDB表名和区域。可通过Lambda日志中的table=xxx -- region=xxx输出验证。

5. 修正异步函数与context.done的冲突 #

你的Lambda是async函数，同时使用context.done会导致函数提前结束，DynamoDB请求可能未完成。移除context.done，直接返回event：

// 替换原有的context.done(null, event);
return event;

内容的提问来源于stack exchange，提问作者ukzjhfz