如何编写含S3、Lambda、SNS的AWS CloudFormation模板？

核心调整点 #

• 修复原模板DataRetriver的拼写错误
• 移除DataRetriever的S3触发配置（该函数定位是主动拉取外部文件写入S3，不需要被S3事件触发），新增S3存储桶写入权限给该函数
• 新增SNS主题资源，配置S3存储桶的对象新增事件直接推送至SNS主题
• 修改DataTransformer的触发源为SNS主题，移除原有S3触发配置
• 补齐S3向SNS推送消息、SNS调用Lambda的对应权限

AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Globals:
  Function:
    MemorySize: 128
    Timeout: 15

Resources:
  # S3 Bucket
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      # 配置S3对象新增事件推送至SNS主题
      NotificationConfiguration:
        TopicConfigurations:
          - Event: 's3:ObjectCreated:*'
            Topic: !Ref S3EventTopic

  # SNS主题：接收S3新增对象事件
  S3EventTopic:
    Type: AWS::SNS::Topic

  # SNS主题策略：允许S3存储桶向主题推送消息
  S3ToSNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - !Ref S3EventTopic
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action: sns:Publish
            Resource: !Ref S3EventTopic
            Condition:
              ArnEquals:
                aws:SourceArn: !GetAtt S3Bucket.Arn

  # DataRetriever函数：拉取外部文件写入S3，无事件触发（可按需配置定时触发或其他触发方式）
  DataRetriever:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: lambda.handler
      Description: Function to pull external files and write to S3
      Runtime: nodejs12.x # 建议替换为当前官方支持的版本如nodejs18.x，nodejs12已停止维护
      Policies:
        # 给函数授予S3存储桶写入权限
        - S3WritePolicy:
            BucketName: !Ref S3Bucket

  # DataTransformer函数：被SNS主题触发，处理S3新增对象
  DataTransformer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Handler: lambda.handler
      Description: Process S3 new object events from SNS
      Runtime: nodejs12.x # 同样建议升级运行时版本
      Events:
        SNSTrigger:
          Type: SNS
          Properties:
            Topic: !Ref S3EventTopic

  # SNS调用DataTransformer的权限（SAM框架会自动生成该权限，无需手动配置也可正常运行）
  DataTransformerPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: 'lambda:InvokeFunction'
      FunctionName: !Ref DataTransformer
      Principal: sns.amazonaws.com
      SourceArn: !Ref S3EventTopic

可选补充配置 #

如果需要给DataRetriever添加定时触发规则，比如每小时自动拉取一次外部文件，可在DataRetriever的Properties下添加Events配置：

Events:
  ScheduledTrigger:
    Type: Schedule
    Properties:
      Schedule: 'rate(1 hour)'

内容的提问来源于stack exchange，提问作者Mario Garcia