发生错误：IamRoleLambdaExecution - 角色的最大策略大小超过 10240 字节

Question

在 serverless.yml 中使用 serverless-plugin-split-stacks 并收到此错误

发生错误：IamRoleLambdaExecution - 角色 Vkonnect-dev-ap-south-1-lambdaRole 的最大策略大小超过 10240 字节（服务：AmazonIdentityManagement；状态代码：409；错误代码：LimitExceeded；请求 ID：51920d55-4b81 -4b6c-99f1-d9f0ba087cc2；代理：空）。

当我使用serverless-plugin-custom-roles 时出现此错误

CloudFormation 模板无效：资源之间的循环依赖：[GenerateOtpDocLambdaPermissionApiGateway, DoctorUnderscorelistLambdaPermissionApiGateway .......]

serverless.yml

service: Vkonnect #Name of your App

provider:
  name: aws
  runtime: nodejs14.x # Node JS version
  memorySize: 128
  timeout: 10
  stage: dev
  region: ap-south-1 # AWS region
  deploymentBucket:
    name: vkonnectlayers
  # iamRoleStatements:
  #   - Effect: "Allow"
  #     Action:
  #       - "s3:*"
  #     Resource:
  # NOTE you can't refer to the LogicalID of S3Bucket, otherwise
  # there will be a circular reference in CloudFormation
  iamRoleStatements:
    - Effect: "Allow"
      Action:
        - "cloudformation:*"
        - "codecommit:*"
        - "apigateway:*"
        - "execute-api:Invoke"
        - "execute-api:ManageConnections"
        - "cloudformation:DescribeStacks"
        - "cloudformation:ListStackResources"
        - "cloudwatch:ListMetrics"
        - "cloudwatch:GetMetricData"
        - "ec2:DescribeSecurityGroups"
        - "ec2:DescribeSubnets"
        - "ec2:DescribeVpcs"
        - "kms:ListAliases"
        - "iam:GetPolicy"
        - "iam:GetPolicyVersion"
        - "iam:GetRole"
        - "iam:GetRolePolicy"
        - "iam:ListAttachedRolePolicies"
        - "iam:ListRolePolicies"
        - "iam:ListRoles"
        - "lambda:*"
        - "logs:DescribeLogGroups"
        - "states:DescribeStateMachine"
        - "states:ListStateMachines"
        - "tag:GetResources"
        - "xray:GetTraceSummaries"
        - "xray:BatchGetTraces"
      Resource:
        - "*"
        - "arn:aws:apigateway:*::/*"
        - "arn:aws:events:*:*:rule/codecommit*"
        - "arn:aws:logs:*:*:log-group:/aws/lambda/*"

plugins:
  - serverless-offline
  - serverless-layers
  - serverless-plugin-split-stacks
  - serverless-plugin-custom-roles
  # - serverless-nested-stack
package:
  individually: true
  exclude:
    - ./**

custom:
  splitStacks:
    perFunction: false
    perType: false
    perGroupFunction: true
    nestedStackCount: 5
  serverless-layers: # All Layers
    - moment:
        name: moment
        excludeDevDependencies: false
        individually: true
        dependenciesPath: ./layers/moment-layer/package.json
        package:
          patterns:
            - /**
            - "!node_modules/**"

Answer 1

先创建

IAM 角色

在您的 aws 帐户中，可以完全访问您想要的服务，然后执行以下操作

serverless.yaml

provider:
  name: aws
  runtime: nodejs14.x
  memorySize: 128
  timeout: 5
  stage: prod
  region: us-east-1 # AWS region
  versionFunctions: false
  deploymentBucket:
    name: XXXXXX
  iam:
    role: arn:aws:iam::XXXXXX:role/full   //your role arn
plugins:
  - serverless-offline
  - serverless-layers
  - serverless-plugin-split-stacks
package:
  individually: true
  exclude:
    - ./**

Answer 2

对于策略大小限制错误：

AWS 对策略大小有限制。查看这篇文章以供参考：https://aws.amazon.com/premiumsupport/knowledge-center/iam-increase-policy-size/

对于循环依赖错误：

查看此 AWS 博客：https://aws.amazon.com/blogs/infrastructure-and-automation/handling-circular-dependency-errors-in-aws-cloudformation/

Answer 3

AWS 对少数资源（如 IAM、S3 等）设置了限制。资源不应超过设置的任何限制。您可以向 AWS Support 提交请求以提高限制。

在此之前，您可以前往 AWS 中的service quota 了解 AWS 资源的限制。基于此，您可以拨打电话向 AWS 提交请求或按照上述文档减小大小。