发生错误：IamRoleLambdaExecution - 角色的最大策略大小超过 10240 字节

Question

在 serverless.yml 中使用无服务器插件拆分堆栈并出现此错误

An error occurred: IamRoleLambdaExecution - Maximum policy size of 10240 bytes exceeded for role Vkonnect-dev-ap-south-1-lambdaRole (Service: AmazonIdentityManagement; Status Code: 409; Error Code: LimitExceeded; Request ID: 51920d55-4b81-4b6c-99f1-d9f0ba087cc2; Proxy: null).

当我使用 serverless-plugin-custom-roles 时出现此错误

The CloudFormation template is invalid: Circular dependency between resources: [GenerateOtpDocLambdaPermissionApiGateway, DoctorUnderscorelistLambdaPermissionApiGateway .......]

serverless.yml

service: Vkonnect #Name of your App

provider:
  name: aws
  runtime: nodejs14.x # Node JS version
  memorySize: 128
  timeout: 10
  stage: dev
  region: ap-south-1 # AWS region
  deploymentBucket:
    name: vkonnectlayers
  # iamRoleStatements:
  #   - Effect: "Allow"
  #     Action:
  #       - "s3:*"
  #     Resource:
  # NOTE you can't refer to the LogicalID of S3Bucket, otherwise
  # there will be a circular reference in CloudFormation
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - "cloudformation:*"
        - "codecommit:*"
        - "apigateway:*"
        - "execute-api:Invoke"
        - "execute-api:ManageConnections"
        - "cloudformation:DescribeStacks"
        - "cloudformation:ListStackResources"
        - "cloudwatch:ListMetrics"
        - "cloudwatch:GetMetricData"
        - "ec2:DescribeSecurityGroups"
        - "ec2:DescribeSubnets"
        - "ec2:DescribeVpcs"
        - "kms:ListAliases"
        - "iam:GetPolicy"
        - "iam:GetPolicyVersion"
        - "iam:GetRole"
        - "iam:GetRolePolicy"
        - "iam:ListAttachedRolePolicies"
        - "iam:ListRolePolicies"
        - "iam:ListRoles"
        - "lambda:*"
        - "logs:DescribeLogGroups"
        - "states:DescribeStateMachine"
        - "states:ListStateMachines"
        - "tag:GetResources"
        - "xray:GetTraceSummaries"
        - "xray:BatchGetTraces"
      Resource:
        - "*"
        - "arn:aws:apigateway:*::/*"
        - "arn:aws:events:*:*:rule/codecommit*"
        - "arn:aws:logs:*:*:log-group:/aws/lambda/*"

plugins:
  - serverless-offline
  - serverless-layers
  - serverless-plugin-split-stacks
  - serverless-plugin-custom-roles
  # - serverless-nested-stack
package:
  individually: true
  exclude:
    - ./**

custom:
  splitStacks:
    perFunction: false
    perType: false
    perGroupFunction: true
    nestedStackCount: 5
  serverless-layers: # All Layers
    - moment:
        name: moment
        excludeDevDependencies: false
        individually: true
        dependenciesPath: ./layers/moment-layer/package.json
        package:
          patterns:
            - /**
            - "!node_modules/**"

Answer 1

策略大小限制错误：

AWS 对策略大小有限制。查看这篇文章以供参考：https://aws.amazon.com/premiumsupport/knowledge-center/iam-increase-policy-size/

对于循环依赖错误：

查看此 AWS 博客：https://aws.amazon.com/blogs/infrastructure-and-automation/handling-circular-dependency-errors-in-aws-cloudformation/

Answer 2

AWS 正在对一些资源（如 IAM、S3 等）设置限制。资源不应超过设置的任何限制。您可以向 AWS Support 提交请求以提高限制。

在此之前，您可以到AWS中的service quota了解AWS资源的限制。在此基础上，您可以打电话向AWS提交请求或按照上述文件缩小尺寸。

Answer 3

首先创建

IAM role

在您的 aws 帐户中，对您想要的服务具有完全访问权限，然后执行以下操作

serverless.yaml

provider:
  name: aws
  runtime: nodejs14.x
  memorySize: 128
  timeout: 5
  stage: prod
  region: us-east-1 # AWS region
  versionFunctions: false
  deploymentBucket:
    name: XXXXXX
  iam:
    role: arn:aws:iam::XXXXXX:role/full   //your role arn
plugins:
  - serverless-offline
  - serverless-layers
  - serverless-plugin-split-stacks
package:
  individually: true
  exclude:
    - ./**

发生错误：IamRoleLambdaExecution - 角色的最大策略大小超过 10240 字节

An error occurred: IamRoleLambdaExecution - Maximum policy size of 10240 bytes exceeded for role

amazon-iam

aws-lambda

serverless-framework

serverless

策略大小限制错误：

对于循环依赖错误：