AWS EventBridge规则在Terraform部署期间不触发步骤功能

Question

我有一些Terraform代码来部署触发步骤功能的CloudWatch/EventBridge规则。我希望规则在每2分钟后每2分钟触发步骤函数，如下面的代码：

resource "aws_iam_role" "cw_sfn_role" {
  name               = "cw_sfn_role"
  assume_role_policy = data.aws_iam_policy_document.sfn_trigger_policy.json
}

data "aws_iam_policy_document" "sfn_trigger_policy" {
  statement {
    actions = [
      "sts:AssumeRole"
    ]

    principals {
      type = "Service"
      identifiers = ["states.amazonaws.com",
      "events.amazonaws.com"]
    }


  }
}

resource "aws_cloudwatch_event_rule" "step_function_trigger_event_rule" {
  name                = "trigger-step-function"
  description         = "Trigger every 2 min"
  schedule_expression = "rate(2 minutes)"
  is_enabled          = true
}


resource "aws_cloudwatch_event_target" "step_function_target" {
  arn      = aws_sfn_state_machine.sfn_state_machine.arn
  rule     = aws_cloudwatch_event_rule.step_function_trigger_event_rule.name
  role_arn = aws_iam_role.cw_sfn_role.arn
}

从AWS控制台，该规则正确连接到步骤函数，但不会触发它。同样，当我从AWS控制台手动创建规则时，触发步骤函数而没有任何问题。我怀疑问题是来自我的分配策略，或者schedue_expression。我在这里想念什么？

Answer 1

由于您的目标是步骤功能，因此需要允许调用其源（您的情况下的CloudWatch事件）。

这类似于Lambda的Invoke许可，以允许任何源触发它。

您为CloudWatch事件指定的角色必须包括以下权限

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
             "Action": [ "states:StartExecution" ],
            "Resource": [ "arn:aws:states:*:*:stateMachine:*" ]
        }
     ]
}