AWS IAM角色的变量可以授予Lambda功能的权限
我试图弄清楚是否可以设计一个AWS IAM角色，该角色将根据调用资源的名称动态地授予资源许可。例如，我目前具有授予lambda函数权限创建和写入CloudWatch日志的角色，看起来像这样：
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CWLog",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/MyLambdaFunction*"
}
}
我想知道是否有一种方法可以替换字符串 mylambdafunction for 使用一些 $ {aws：nameofthelambdafunction} 变量调用lambda函数，这样我就可以拥有一个通用策略，允许函数仅写入其特定的CW日志组，我可以将其附加到不同的lambda角色 - 资源语句看起来像：“资源”：“ ARN：AWS：logs：*：*：log-group：/aws/lambda/$ {aws：namefthelambdafunction}*”
是这样吗？
I am trying to figure out if it is possible to design an AWS IAM role that would dynamically grant permission to resource based on the name of the calling resource. For example I currently have a role that grants a Lambda function permission to create and write CloudWatch logs, which looks like this:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CWLog",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/MyLambdaFunction*"
}
}
I am wondering if there is a way to substitute the string MyLambdaFunction for the name of the calling Lambda function using some ${aws:NameOfTheLambdaFunction} variable, so that I can have a generic policy allowing functions to write only to their specific CW log groups that I can attach to different Lambda roles - with the resource statement looking like: "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/${aws:NameOfTheLambdaFunction}*"
Is something like this possible?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您是指调用lambda函数的名称。
不幸的是，此策略变量当前不存在，因此这是不可能的。
You're referring to an IAM policy variable which provides you the name of the calling Lambda function.
Unfortunately, this policy variable does not currently exist and so this isn't possible.