若要檢查函式的以資源為基礎的政策,請使用 get-policy
命令。
aws lambda get-policy \
--function-name my-function \
--output text
您應該會看到下列輸出:
{"Version":"2012-10-17","Id":"default","Statement":[{"Sid":"sns","Effect":"Allow","Principal":{"Service":"s3.amazonaws.com"},"Action":"lambda:InvokeFunction","Resource":"arn:aws:lambda:us-east-2:123456789012:function:my-function","Condition":{"ArnLike":{"AWS:SourceArn":"arn:aws:sns:us-east-2:123456789012:lambda*"}}}]} 7c681fc9-b791-4e91-acdf-eb847fdaa0f0
針對版本和別名,在函式名稱的後方附加版本編號或別名。
aws lambda get-policy --function-name my-function:PROD
若要將許可從函式中移除,請使用 remove-permission
。
aws lambda remove-permission \
--function-name example \
--statement-id sns
使用 get-layer-version-policy
指令檢視層級上的許可。
aws lambda get-layer-version-policy \
--layer-name my-layer \
--version-number 3 \
--output text
您應該會看到下列輸出:
b0cd9796-d4eb-4564-939f-de7fe0b42236 {"Sid":"engineering-org","Effect":"Allow","Principal":"*","Action":"lambda:GetLayerVersion","Resource":"arn:aws:lambda:us-west-2:123456789012:layer:my-layer:3","Condition":{"StringEquals":{"aws:PrincipalOrgID":"o-t194hfs8cz"}}}"
使用 remove-layer-version-permission
以從策略中移除陳述式。
aws lambda remove-layer-version-permission --layer-name my-layer --version-number 3 --statement-id engineering-org