AWS CLI：函數定義的角色不能被拉姆達假設

Question

AWS CLI版本：

aws --version 
aws-cli/1.11.21 Python/2.7.12 Darwin/15.3.0 botocore/1.4.78 

試圖建立一個lambda函數和得到的錯誤：

An error occurred (InvalidParameterValueException) when calling the CreateFunction operation: The role defined for the function cannot be assumed by Lambda. 

角色創建爲：

aws iam create-role --role-name microrole --assume-role-policy-document file://./trust.json 

trust.json是：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Effect": "Allow", 
     "Principal": { 
     "Service": "lambda.amazonaws.com" 
     }, 
     "Action": "sts:AssumeRole" 
    } 
    ] 
} 

政策被附加爲：

aws iam put-role-policy --policy-document file://./policy.json --role-name microrole --policy-name micropolicy 

policy.json是：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Effect": "Allow", 
     "Action": [ 
     "logs:CreateLogGroup", 
     "logs:CreateLogStream", 
     "logs:PutLogEvents" 
     ], 
     "Resource": "arn:aws:logs:*:*:*" 
    }, 
    { 
     "Effect": "Allow", 
     "Action": [ 
     "apigateway:*" 
     ], 
     "Resource": "arn:aws:apigateway:*::/*" 
    }, 
    { 
     "Effect": "Allow", 
     "Action": [ 
     "execute-api:Invoke" 
     ], 
     "Resource": "arn:aws:execute-api:*:*:*" 
    } 
    ] 
} 

等了截至[1]和[2]提及，但仍錯誤不會消失多分鐘。附加到角色的策略和信任與使用Console創建Lambda函數時創建的默認角色類似。

完整的步驟列於https://github.com/arun-gupta/serverless/tree/master/aws/microservice。

什麼是缺失？

Answer 1

lambda函數創建爲：

aws lambda create-function \ 
--function-name MicroserviceGetAll \ 
--role arn:aws:iam::<act-id>:role/service-role/microRole \ 
--handler org.sample.serverless.aws.couchbase.BucketGetAll \ 
--zip-file fileb:///Users/arungupta/workspaces/serverless/aws/microservice/microservice-http-endpoint/target/microservice-http-endpoint-1.0-SNAPSHOT.jar \ 
--description "Microservice HTTP Endpoint - Get All" \ 
--runtime java8 \ 
--region us-west-1 \ 
--timeout 30 \ 
--memory-size 1024 \ 
--environment Variables={COUCHBASE_HOST=ec2-35-165-83-82.us-west-2.compute.amazonaws.com} \ 
--publish 

正確的命令是：

aws lambda create-function \ 
--function-name MicroserviceGetAll \ 
--role arn:aws:iam::<act-id>:role/microRole \ 
--handler org.sample.serverless.aws.couchbase.BucketGetAll \ 
--zip-file fileb:///Users/arungupta/workspaces/serverless/aws/microservice/microservice-http-endpoint/target/microservice-http-endpoint-1.0-SNAPSHOT.jar \ 
--description "Microservice HTTP Endpoint - Get All" \ 
--runtime java8 \ 
--region us-west-1 \ 
--timeout 30 \ 
--memory-size 1024 \ 
--environment Variables={COUCHBASE_HOST=ec2-35-165-83-82.us-west-2.compute.amazonaws.com} \ 
--publish 

不同的是，角色被錯誤地指定爲role/service-role/microRole代替role/microRole。