使用Terraform创建AWS SQS/Lambda/CloudWatch后无法正确关联的问题

我帮你梳理下几个关键的遗漏配置，这正是你的SQS消息无法触发Lambda的核心原因：

1. CloudWatch Event Pattern 匹配规则错误 #

你的aws_cloudwatch_event_rule里的事件模式太宽泛，既没匹配到正确的SQS消息事件类型，也没指定目标队列。实际上，SQS的消息发送事件对应的detail-type是**"Amazon SQS Message Sent"**，而且必须指定你要监控的队列ARN，否则会匹配所有SQS相关事件（比如队列创建、删除），而非消息新增事件。

修正后的事件模式：

event_pattern = <<PATTERN
{
  "source": ["aws.sqs"],
  "detail-type": ["Amazon SQS Message Sent"],
  "detail": {
    "queueArn": ["${aws_sqs_queue.sqs-test.arn}"]
  }
}
PATTERN

2. 缺少Lambda权限允许CloudWatch Events触发它 #

你创建了CloudWatch Event Target，但没有给CloudWatch Events服务授权调用Lambda的权限。这是最容易忽略的一步——必须通过aws_lambda_permission资源明确允许events.amazonaws.com作为触发器调用你的Lambda函数。

添加这个权限资源：

resource "aws_lambda_permission" "cloudwatch_events_lambda" {
  statement_id  = "AllowCloudWatchEventsToInvokeLambda"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lambda-test.function_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.console-cl-test.arn
}

3. （可选但推荐）用IAM角色代替硬编码的SQS密钥 #

你的Lambda环境变量里配置了SQS_KEY和SQS_SECRET，这既不安全也没必要。可以给Lambda的IAM角色添加SQS访问权限，让Lambda通过角色直接访问队列，无需硬编码密钥。

给Lambda角色添加权限策略：

resource "aws_iam_role_policy_attachment" "lambda_sqs_access" {
  role       = aws_iam_role.iam_for_lambda.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSQSFullAccess" # 也可以配置更精细的队列专属权限
}

之后就可以从Lambda环境变量中移除SQS_KEY和SQS_SECRET了。

完整修正后的Terraform代码 #

provider "aws" { 
  region = var.REGION 
}

# SQS队列
resource "aws_sqs_queue" "sqs-test" {
  name                      = "sqs-test"
  delay_seconds             = 0
  max_message_size          = 262144
  message_retention_seconds = 345600
  receive_wait_time_seconds = 10
}

# Lambda用IAM角色
resource "aws_iam_role" "iam_for_lambda" {
  name = "iam_for_lambda"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

# 给Lambda添加SQS访问权限（可选）
resource "aws_iam_role_policy_attachment" "lambda_sqs_access" {
  role       = aws_iam_role.iam_for_lambda.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSQSFullAccess"
}

# Lambda函数
resource "aws_lambda_function" "lambda-test" {
  filename      = "test.zip"
  function_name = "lambda-test"
  role          = aws_iam_role.iam_for_lambda.arn
  handler       = "main"
  runtime       = "go1.x"

  environment {
    variables = {
      TESTING_QUEUE = aws_sqs_queue.sqs-test.id
    }
  }
}

# CloudWatch事件规则：匹配SQS消息发送事件
resource "aws_cloudwatch_event_rule" "console-cl-test" {
  name        = "capture-cl-sqs-test"
  description = "Captures SQS message sent events for test queue"

  event_pattern = <<PATTERN
{
  "source": ["aws.sqs"],
  "detail-type": ["Amazon SQS Message Sent"],
  "detail": {
    "queueArn": ["${aws_sqs_queue.sqs-test.arn}"]
  }
}
PATTERN
}

# CloudWatch事件目标：指向Lambda
resource "aws_cloudwatch_event_target" "lambda-tr-test" {
  rule      = aws_cloudwatch_event_rule.console-cl-test.name
  target_id = "lambda-test"
  arn       = aws_lambda_function.lambda-test.arn
}

# 授权CloudWatch Events调用Lambda
resource "aws_lambda_permission" "cloudwatch_events_lambda" {
  statement_id  = "AllowCloudWatchEventsToInvokeLambda"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lambda-test.function_name
  principal     = "events.amazonaws.com"
  source_arn    = aws_cloudwatch_event_rule.console-cl-test.arn
}

内容的提问来源于stack exchange，提问作者Rafee