Amazon Textract 函数 StartExpenseAnalysisCommand 中的NotificationChannel 如何工作？ AmazonTextract 无法将消息发布到 SNS

Question

下午好，

我正在使用此服务StartExpenseAnalysisCommand，其中有一个我感兴趣的参数，称为NotificationChannel，我在其中传递我的TopicArn（SNS），所以基本上我的功能如下：

   const command = new StartExpenseAnalysisCommand({
      DocumentLocation: {
        S3Object: {
          Bucket: fileObj.s3.bucket.name,
          Name: fileObj.s3.object.key,
        },
      },
      NotificationChannel: {
        SNSTopicArn: process.env.SNS_TOPIC_ARN,
        RoleArn: process.env.ROLE_ARN,
      },
    });
    const response = await textractClient.send(command);

解释我想做什么：

• 我有一个启动 StartExpenseAnalysisCommand 的 Lambda 函数。完成后，它应该发布到我在NotificationChannel中使用JobID创建的SNSTopicArn。
• 这将发布到发送 JobId 的 SNS，并触发我的第二个 Lambda 函数，该函数将接收事件并使用 GetExpenseAnalysisCommand 提取数据。

我面临的问题是，当我处理第一个函数时它永远不会触发。我已经确认它收到了 JobId，也确认了它已订阅，但它从未发布它。

我还尝试从 aws 控制台手动发布消息，它起作用了，它触发了 lambda 函数，所以问题可能出在NotificationChannel上。

这是我的 serverless.yml，我还定义了它所需的权限，即 sns:Publish 和 lambda:InvokeFunction:

provider:
  name: aws
  runtime: nodejs18.x
  memorySize: 128
  region: ${env:AWS_REGION}
  stage: ${opt:stage,'dev'}
  environment:
    # APP
    APP_STAGE: ${env:APP_STAGE}
    APP_SERVICE_NAME: ${env:APP_SERVICE_NAME}
    AWS_SQS_QUEUE_URL: !Ref MySQSQueue
    AWS_ACCOUNT_ID: ${env:AWS_ACCOUNT_ID}
    DEVELOPMENT_PATH: ${env:DEVELOPMENT_PATH}
    EXCHANGE_RATE_API: ${env:EXCHANGE_RATE_API}
    MESSAGING_QUEUE: ${env:MESSAGING_QUEUE}
    SNS_TOPIC_ARN: ${env:SNS_TOPIC_ARN}
    ROLE_ARN: ${env:ROLE_ARN}
    # SNS_TOPIC_ARN: !GetAtt AmazonTextractMyTopicName.TopicArn
    # ROLE_ARN: arn:aws:iam::${env:AWS_ACCOUNT_ID}:role/${env:APP_SERVICE_NAME}-${env:APP_STAGE}-${env:AWS_REGION}-lambdaRole
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - sqs:SendMessage
            - sqs:ReceiveMessage
            - sqs:DeleteMessage
          Resource: !GetAtt MySQSQueue.Arn
        - Effect: Allow
          Action:
            - textract:StartExpenseAnalysis
            - textract:GetExpenseAnalysis
          Resource: "*"
        - Effect: Allow
          Action:
            - s3:GetObject
            - s3:PutObject
          Resource: "*"
        - Effect: Allow
          Action:
            - sns:Publish
          Resource: !GetAtt AmazonTextractMyTopicName.TopicArn
        - Effect: Allow
          Action:
            - lambda:InvokeFunction
          Resource: "*"

functions:
  startExpenseAnalysisJob:
    handler: src/functions/startExpenseAnalysisJob.handler
    timeout: 180
    maximumRetryAttempts: 0
    events:
      - sqs:
          arn: !GetAtt MySQSQueue.Arn
          batchSize: 1
  processExpenseAnalysisJob:
    handler: src/functions/processExpenseAnalysisJob.handler
    events:
      - sns:
          arn: !GetAtt AmazonTextractMyTopicName.TopicArn
          topicName: AmazonTextractMyTopicName-${self:provider.stage}

resources:
  Resources:
    # Official Docs https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-sqs-queues.html
    MySQSQueue:
      Type: AWS::SQS::Queue
      Properties:
        QueueName: SQS-${self:provider.stage}
        VisibilityTimeout: 360

    AmazonTextractMyTopicName:
      Type: AWS::SNS::Topic
      Properties:
        TopicName: AmazonTextractMyTopicName-${self:provider.stage}

custom:
  serverless-offline-sqs:
    autoCreate: true
    apiVersion: "2012-11-05"
    endpoint: http://0.0.0.0:9324
    region: ${self:provider.region}
    accessKeyId: root
    secretAccessKey: root
    skipCacheInvalidation: false

另外，我应该使用我的 SQS 订阅该主题吗？现在，我刚刚拥有第二个 Lambda，其中仅包含 SNS 的触发事件。

Answer 1

我按照本指南解决了问题：docs.aws.amazon.com/textract/latest/dg/api-async-roles.html

我遇到的问题与权限有关，特别是在信任问题部分。

谢谢您，希望这对从事此工作的人有所帮助。