如何在Terraform中配置S3桶触发AWS Lambda函数

在你现有的main.tf基础上，新增以下3部分配置即可实现需求：

1. 补充Lambda执行角色的权限配置 #

原有IAM角色仅配置了Lambda服务的信任关系，还需要添加权限让Lambda可以操作S3对象、输出日志到CloudWatch：

resource "aws_iam_role_policy" "lambda_s3_access" {
  name = "lambda_s3_access"
  role = aws_iam_role.iam_for_lambda.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      # 允许Lambda读写S3桶资源
      {
        Action = [
          "s3:GetObject",
          "s3:PutObject"
        ]
        Effect   = "Allow"
        Resource = "${aws_s3_bucket.b.arn}/*"
      },
      # 允许Lambda输出运行日志到CloudWatch
      {
        Action = [
          "logs:CreateLogGroup",
          "logs:CreateLogStream",
          "logs:PutLogEvents"
        ]
        Effect   = "Allow"
        Resource = "arn:aws:logs:*:*:*"
      }
    ]
  })
}

2. 配置Lambda调用权限 #

添加资源策略允许S3服务触发你的Lambda函数：

resource "aws_lambda_permission" "allow_s3_trigger" {
  statement_id  = "AllowS3Invoke"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.hasher_lambda.function_name
  principal     = "s3.amazonaws.com"
  source_arn    = aws_s3_bucket.b.arn
}

3. 配置S3桶的触发通知 #

指定S3桶的事件类型、过滤规则，绑定到目标Lambda函数：

resource "aws_s3_bucket_notification" "bucket_trigger_lambda" {
  bucket = aws_s3_bucket.b.id

  lambda_function {
    lambda_function_arn = aws_lambda_function.hasher_lambda.arn
    # 配置触发事件，示例为所有对象创建事件，可按需调整为s3:ObjectDeleted:*等其他事件
    events = ["s3:ObjectCreated:*"]
    # 可选配置：按前缀/后缀过滤触发对象，比如只触发上传到input/目录下的png文件
    # filter_prefix = "input/"
    # filter_suffix = ".png"
  }

  # 依赖声明，确保S3调用Lambda的权限先创建完成，避免报错
  depends_on = [aws_lambda_permission.allow_s3_trigger]
}

注意事项 #

• 如果需要调整触发条件，修改events、filter_prefix、filter_suffix参数即可
• 配置完成后执行terraform apply即可生效

内容的提问来源于stack exchange，提问作者Kelvin A. Vasquez