我正在尝试从 VPC 内部的 lambda 函数访问 VPC 外部的运动流。目前,当执行写入 kinesis 流的代码时,它将挂起,然后超时。当我将 lambda 从 VPC 中取出时,写入流的代码工作正常。但我需要访问 VPC 内的资源,然后写入流。有人知道怎么修这个东西吗?
这是我在 VPC 中的函数
functions:
handleChanges:
handler: functions/handlers.handleChanges
timeout: 10
package:
include:
- functions/utils/**
events:
- http:
method: POST
path: "/"
integration: lambda
vpc:
securityGroupIds:
- ${file(./private.yml):variables.securityGroup}
subnetIds:
- ${file(./private.yml):variables.subnetID}
这是我的政策
iamRoleStatements:
- Effect: "Allow"
Action:
- "kinesis:PutRecord"
- "kinesis:GetRecords"
- "kinesis:GetShardIterator"
- "kinesis:DescribeStream"
- "kinesis:ListStreams"
Resource:
Fn::GetAtt:
- KinesisStream
- Arn
- Effect: "Allow"
Action:
- "cognito-idp:AdminGetUser"
Resource: "*"
- Effect: "Allow"
Action:
- "logs:CreateLogGroup"
- "logs:CreateLogStream"
- "logs:PutLogEvents"
- "ec2:CreateNetworkInterface"
- "ec2:DescribeNetworkInterfaces"
- "ec2:DeleteNetworkInterface"
Resource: "*"
最后这是我的运动流资源
KinesisStream:
Type: AWS::Kinesis::Stream
Properties:
Name: ${self:provider.environment.STREAM_NAME}
ShardCount: 1
唯一的解决方案是添加一个NAT网关 http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-gateway.html (or NAT实例 http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_NAT_Instance.html) 到您的 VPC,以便驻留在您的私有子网中的 Lambda 函数等资源将能够访问 VPC 外部的资源。
本文内容由网友自发贡献,版权归原作者所有,本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容,请联系:hwhale#tublm.com(使用前将#替换为@)