AWS Python CDK v2 CI/CD流水线中Lambda权限授予失败问题排查

本地环境使用AWS CDK的sqs_queue.grant_consume_messages(lambda_function)代码可以正常为Lambda函数授予SQS消费权限，但切换到CI/CD流水线后，流水线执行成功，权限授予操作无报错却实际失败，后续为Lambda添加事件源时也因权限不足报错。

相关代码 #

权限授予代码 #

sqs_queue.grant_consume_messages(lambda_function)

app.py（CI/CD入口代码） #

import aws_cdk as cdk
from lib.pipeline_stack import BackToOriginPipelineStack

app = cdk.App()
BackToOriginPipelineStack(app, 'BackToOriginPipelineStack')

app.synth()

流水线栈代码 #

from constructs import Construct
from aws_cdk import (
    Stack,
    aws_codecommit as codecommit,
    pipelines as pipelines,
)
from .pipeline_stage import BackToOriginPipelineStage

class BackToOriginPipelineStack(Stack):
    
    def __init__(self, scope: Construct, id: str, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)
        
        repo = codecommit.Repository(
            self, 'BackToOriginRepo',
            repository_name='BackToOriginPipeRepo'
        )
        
        pipeline = pipelines.CodePipeline(
            self, 'Pipeline',
            synth=pipelines.ShellStep(
                'Synth',
                input=pipelines.CodePipelineSource.code_commit(repo, 'master'),
                commands=[
                    'npm install -g aws-cdk',
                    'pip install -r requirements.txt',
                    'cdk synth',
                ]
            )
        )
        
        deploy = BackToOriginPipelineStage(self, 'Deploy')
        deploy_stage = pipeline.add_stage(deploy)

阶段栈代码 #

from constructs import Construct
from aws_cdk import (
    Stage
)
from .back_to_origin_stack import BackToOriginStack

class BackToOriginPipelineStage(Stage):
    
    def __init__(self, scope: Construct, id: str, **kwargs):
        super().__init__(scope, id, **kwargs)
        
        service = BackToOriginStack(self, 'BackToOriginService')

解决方法 #

通过为CodePipeline指定自定义角色并赋予IAM全权限，问题已解决。修改后的流水线栈代码如下：

from constructs import Construct
from aws_cdk import (
    Stack,
    aws_codecommit as codecommit,
    pipelines as pipelines,
    aws_iam as iam, # 新增iam模块导入
)
from .pipeline_stage import BackToOriginPipelineStage

class BackToOriginPipelineStack(Stack):
    
    def __init__(self, scope: Construct, id: str, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)
        
        repo = codecommit.Repository(
            self, 'BackToOriginRepo',
            repository_name='BackToOriginPipeRepo'
        )
        
        # 创建自定义CodePipeline角色
        pipeline_role = iam.Role(
            self, 'CodePipelineRole',
            assumed_by=iam.ServicePrincipal('codepipeline.amazonaws.com'),
        )
        pipeline_role.add_managed_policy(iam.ManagedPolicy.from_aws_managed_policy_name(
                "IAMFullAccess"
            ))
        
        pipeline = pipelines.CodePipeline(
            self, 'Pipeline',
            synth=pipelines.ShellStep(
                'Synth',
                input=pipelines.CodePipelineSource.code_commit(repo, 'master'),
                commands=[
                    'npm install -g aws-cdk',
                    'pip install -r requirements.txt',
                    'cdk synth',
                ]
            ),
            role=pipeline_role, # 指定自定义角色
        )
        
        deploy = BackToOriginPipelineStage(self, 'Deploy')
        deploy_stage = pipeline.add_stage(deploy)

内容的提问来源于stack exchange，提问作者chen cheng