AWS Serverless中Schedule触发器部署未授权错误排查求助

问题描述 #

在Lambda函数中通过Schedule属性创建触发器，已配置AWS全权限，但部署CloudFormation堆栈时仍遇到未授权错误。相关SAM代码如下：

ErecruitDBToS3LambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${Environment}-${Application}-db-s3-store-${EntityName}-event
      Description: A Lambda function that read updated data from eRecruit DB into S3Bucket.
      Runtime: nodejs14.x
      Timeout: 60
      MemorySize: 128
      Handler: !Sub src/handlers/${EntityName}/eRecruitDBS3.eventHandler
      Layers:
        - !Ref ACFLayer
      Policies:
        - AWSLambdaRole
        - AWSLambdaExecute
        - AWSLambdaBasicExecutionRole
        - AmazonS3FullAccess
        - AWSLambdaVPCAccessExecutionRole
        - AmazonEventBridgeFullAccess
        - SSMParameterReadPolicy:
            ParameterName: 'acf/*'
        - DynamoDBCrudPolicy:
            TableName: "*"
        - Statement:
            Effect: "Allow"
            Action: "events:*"
            Resource: "arn:aws:events:*:*:*"
      Environment:
        Variables:
          ConnectorName: !Ref ConnectorName
          EntityName: !Ref EntityName
          ErecruitTable: !Ref ErecruitEngagementDefinitionTable
          LogLevel: !Ref LogLevel
          S3BucketName: !Ref S3BucketName
          ErecruitDBSSMPath: !Ref ErecruitDBSSMPath
      VpcConfig:
        SecurityGroupIds:
          - sg-042efcebb92b0573d
        SubnetIds:
          - subnet-0a3a8e3a5465d1fce
          - subnet-016b565821a02dd54
          - subnet-01c21fa0b46e76b1a
      Tags:
        Environment: !Ref Environment
        Application: !Ref Application
        Owner: !Ref Owner
        OwnerContact: !Ref OwnerContact
        CodePath: !Ref CodePath
      Events: !Ref CWSchedule
        
  CWSchedule:
    Type: Schedule
    Properties:
      Schedule: 'rate(5 minutes)'
      Name: TestSchedule
      Description: test schedule
      Enabled: false

  ErecruitDBToS3LambdaFunctionPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt ErecruitDBToS3LambdaFunction.Arn
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com

调试解决方案 #

• 定位具体错误操作：打开CloudFormation控制台，查看堆栈部署的事件日志，找到触发未授权错误的具体API操作（比如events:PutRule、lambda:AddPermission），这是最直接的排查方向。

• 修正部署角色权限：部署堆栈的IAM角色/用户需要具备创建EventBridge规则、配置Lambda权限的权限，需添加以下权限语句：

  {
    "Effect": "Allow",
    "Action": [
      "events:PutRule",
      "events:PutTargets",
      "lambda:AddPermission"
    ],
    "Resource": "*"
  }
  

• 修复Schedule资源配置：SAM模板中单独的Schedule类型不规范，应改为AWS::Events::Rule，并添加Target关联Lambda，同时修正Lambda权限的SourceArn限制：

  CWSchedule:
    Type: AWS::Events::Rule
    Properties:
      ScheduleExpression: 'rate(5 minutes)'
      Name: TestSchedule
      Description: test schedule
      State: DISABLED
      Targets:
        - Arn: !GetAtt ErecruitDBToS3LambdaFunction.Arn
          Id: "LambdaTarget"
  
  ErecruitDBToS3LambdaFunctionPermission:
    Type: AWS::Lambda::Permission
    DependsOn:
      - ErecruitDBToS3LambdaFunction
      - CWSchedule
    Properties:
      FunctionName: !GetAtt ErecruitDBToS3LambdaFunction.Arn
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      SourceArn: !GetAtt CWSchedule.Arn
  

• 简化Lambda权限策略：当前Policies包含重复权限（如AWSLambdaRole、AWSLambdaExecute、AWSLambdaBasicExecutionRole功能重叠），保留必要权限即可，避免潜在冲突：

  Policies:
    - AWSLambdaBasicExecutionRole
    - AmazonS3FullAccess
    - AWSLambdaVPCAccessExecutionRole
    - AmazonEventBridgeFullAccess
    - SSMParameterReadPolicy:
        ParameterName: 'acf/*'
    - DynamoDBCrudPolicy:
        TableName: "*"
  

• 调整SAM Events配置方式：推荐直接在Lambda的Events字段内嵌Schedule触发器，无需单独定义Rule和Permission，SAM会自动创建所需资源和权限：

  ErecruitDBToS3LambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      # 其他属性...
      Events:
        CWSchedule:
          Type: Schedule
          Properties:
            Schedule: 'rate(5 minutes)'
            Name: TestSchedule
            Description: test schedule
            Enabled: false
  

内容的提问来源于stack exchange，提问作者mani kandan