无法执行 lambda 函数确保您已授予 CloudWatch Logs 执行您的函数的权限

如何解决无法执行 lambda 函数确保您已授予 CloudWatch Logs 执行您的函数的权限

我想根据日志组中的事件触发 lambda 函数。这是我的 cdk

    const glueLogGroup = new LogGroup(this,'LogGroup',{
        logGroupName: '/aws-glue/crawlers'
    });
    const lambdaFunction = new lambda.Function(this,'crawlerStatusMonitorFunction',{
        runtime: lambda.Runtime.NODEJS_12_X,handler: 'index.handler',code: lambda.Code.fromInline('exports.handler = (event,context,callback) => {\n' +
            '  // Todo implement\n' +
            '  callback(null,\'Hello from Lambda\');\n' +
            '};')
    });

    const lambdaPolicy = new PolicyStatement({
        effect: Effect.ALLOW,resources: ['*'],actions: ['*']
    });
    lambdaFunction.addToRolePolicy(lambdaPolicy);
   
    new lambda.CfnPermission(this,'resourcePolicyForLambdaFunction',{
        action: 'lambda:InvokeFunction',principal: 'logs.us-east-1.amazonaws.com',functionName: lambdaFunction.functionName,sourceArn: `${glueLogGroup.logGroupArn}:*`,sourceAccount: accountId.valueAsstring
    });
    glueLogGroup.addSubscriptionFilter('lambda',{
        destination: new eventTargets.LambdaFunction(lambdaFunction),filterPattern: FilterPattern.allEvents()
    });

这是上面cdk生成的cloudformation中lambda的资源策略：

"resourcePolicyForLambdaFunction": {
  "Type": "AWS::Lambda::Permission","Properties": {
    "Action": "lambda:InvokeFunction","FunctionName": {
      "Ref": "crawlerStatusMonitorFunction78ACA584"
    },"Principal": "logs.us-east-1.amazonaws.com","SourceAccount": {
      "Ref": "accountId"
    },"SourceArn": {
      "Fn::Join": [
        "",[
          {
            "Fn::GetAtt": [
              "LogGroupF5B46931","Arn"
            ]
          },":*"
        ]
      ]
    }
  }
}

每当我尝试从 cloudformation 创建堆栈时，我都会收到此错误。

无法执行 lambda 函数。确保您已授予 CloudWatch Logs 执行您的函数的权限