When an event source such as Object Storage Service (OSS) needs to invoke your function, you must grant it permission to do so. In Function Compute, permissions are managed at the trigger level: each trigger holds a RAM role, and that role is granted the permissions the event source needs to call your function. The same RAM role can be reused across multiple triggers.
This topic walks through granting OSS the permissions to trigger function execution using an OSS event trigger. The same steps apply to other trigger types — select the trigger type that matches your event source.
When you create a trigger for the first time, the Function Compute console prompts you to authorize with a single click. This topic covers the full manual configuration so you understand what is being authorized and can replicate it for additional triggers.
How it works
When a file is uploaded to an OSS bucket, OSS calls Function Compute on your behalf. To allow this, you attach the system policy AliyunOSSEventNotificationRolePolicy to a RAM role assigned to the trigger. This policy grants OSS event sources the permissions to trigger Function Compute execution.
Prerequisites
Before you begin, ensure that you have:
A Function Compute function to trigger
An OSS bucket where object uploads will fire the trigger
Create an OSS trigger with the required permissions
Log on to the Function Compute console. In the left-side navigation pane, click Functions.
In the top navigation bar, select a region. On the Functions page, click the function you want to configure.
On the function details page, click the Configurations tab. In the left-side navigation pane, click Triggers, then click Create Trigger.
In the Create Trigger panel, configure the following parameters and click OK. If the trigger fails to create, the most common cause is that the object prefix starts with
/— remove the leading slash.ImportantThe object prefix cannot start with a forward slash (
/). A trigger with a prefix starting with/never fires.If this is the first time you are creating a trigger of this type, a dialog box appears after you click OK. Click Authorize Now to complete the authorization.
Parameter Description Example Trigger type The type of the trigger. Select OSS. OSS Name The name of the trigger. oss-trigger Version or Alias The version or alias of the service. The default value is LATEST. To use a different version or alias, select it from the Version or Alias drop-down list on the function details page. See Manage versions and Manage aliases. LATEST Bucket Name The OSS bucket that fires the trigger. Select from the drop-down list. testbucket Object Prefix The object key prefix to match. Configure both a prefix and a suffix to avoid recursive loop costs. If multiple triggers on the same bucket share an event type, their prefix-suffix combinations must be unique. See Rules for triggering native OSS triggers. source Object suffix The object key suffix to match. We recommend that you configure prefix and suffix to avoid extra costs that are generated by nested loops. If you specify the same event type for different triggers of a bucket, the prefix or suffix cannot be the same. For more information, see Triggering rules. png Trigger Event The OSS event type that fires the trigger. Select one or more from the drop-down list. See OSS events. oss:ObjectCreated:PutObject Role Name The RAM role assigned to the trigger. Select AliyunOSSEventNotificationRole to use the system policy AliyunOSSEventNotificationRolePolicy, which grants OSS event sources the permissions to trigger Function Compute execution.AliyunOSSEventNotificationRole
What's next
After the trigger is created, test it by uploading an object to the OSS bucket that matches the configured prefix and suffix. Check Function Compute logs to confirm the function was invoked.