0

I have the following code running in Lambda that is triggered by an SNS message containing the status ID of a CreateAccount function. When run locally it works fine, but when triggered in a Lambda the CloudWatch logs show nothing.

var AWS = require("aws-sdk");
var sns = new AWS.SNS();
var organizations = new AWS.Organizations({region: 'us-east-1'});

exports.handler = (event, context, callback) => {

    var message = event.Records[0].Sns.Message;
    console.log("From sns:", message);

    var obj = JSON.parse(message);
        var name = obj.name;
        console.log("Name :", obj.name);
        var email = obj.email;
        console.log("Email :", obj.email);
        var budget = obj.budget;
        console.log("Budget :", obj.budget);
        var awsaccount = obj.awsaccount;
        console.log("Account Name :", obj.awsaccount);
        var adminaccount = obj.adminaccount;
        console.log("Admin account name :", obj.adminaccount);
        var adminpassword = obj.adminpassword;
        console.log("Admin password :", obj.adminpassword);
        var accStatusId = obj.statusid;
        //var accStatusId = (accStatusId.replace(/\"/g, ""));
        console.log("Status ID :", obj.statusid);

        context.succeed(message);

        // Fetch status of account creation and account ID
        var AccStatusParams = {
            CreateAccountRequestId: accStatusId
        };
        checkStatus(AccStatusParams);

};

function checkStatus(AccStatusParams){

  organizations.describeCreateAccountStatus(AccStatusParams, function(err, data) {
    if (err) console.log(err, err.stack);
    else { console.log(data);
      console.log("Account = ", JSON.stringify(data.CreateAccountStatus.AccountId));
      console.log("Status = ", JSON.stringify(data.CreateAccountStatus.State));
    }
  });
}
John Rotenstein
  • 241,921
  • 22
  • 380
  • 470
Peter Moles
  • 1
  • 1
  • Do policies of the involving role allow calling lambda? Like the action `"lambda:InvokeFunction"`. See [this](https://stackoverflow.com/a/39696839/4636715) for a full example. – vahdet Jul 20 '18 at 17:02
  • Yes, InvokeFunction action is allowed, and when the SNS triggers the invocation is shown on the monitoring tab of the Lambda console. Also, the console.logs are seen in CloudWatch, with the exception of the last two within the 'describeCreateAccoutStatus' function. I have even added console.logs in the 'checkStatus' function, outside of 'describeCreateAccoutStatus' and see these in CloudWatch. – Peter Moles Jul 21 '18 at 08:58
  • Reading the API documentation the function I'm using states "This operation can be called only from the organization's master account", could this be the reason no data is being returned? The Lambda function has permissions to Organization, but how does it scope itself to the master account? – Peter Moles Jul 21 '18 at 09:44

0 Answers0