Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(lambda): add grantInvokeLatestVersion to grant invoke only to latest function version #29856

Open
wants to merge 19 commits into
base: main
Choose a base branch
from
Open

feat(lambda): add grantInvokeLatestVersion to grant invoke only to latest function version #29856

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
4d90557
add grantInvokeV2
roger-zhangg Apr 16, 2024
a2ca2f2
add readme
roger-zhangg Apr 16, 2024
287ccc5
Merge branch 'main' into grant_invoke_v2
roger-zhangg Apr 16, 2024
1052cf1
Merge branch 'grant_invoke_v2' of github.com:roger-zhangg/aws-cdk int…
roger-zhangg Apr 16, 2024
aa9d4ca
add integ test
roger-zhangg Apr 16, 2024
fc612e3
change to grantinvoke
roger-zhangg Apr 18, 2024
3aa8b6f
Merge branch 'main' into grant_invoke_v2
roger-zhangg Apr 18, 2024
679e6a6
lint
roger-zhangg Apr 18, 2024
0857f65
typo
roger-zhangg Apr 18, 2024
34d1506
add fn
roger-zhangg Apr 18, 2024
a502cd0
test
roger-zhangg Apr 18, 2024
5e5e6c9
add grantInvokeLatestVersion
roger-zhangg May 3, 2024
c734032
add grantInvokeLatestVersion
roger-zhangg May 3, 2024
74130bb
Merge branch 'main' into grant_invoke_v2
roger-zhangg May 3, 2024
f4b873f
fix lint
roger-zhangg May 3, 2024
a7b2b36
fix integ
roger-zhangg May 3, 2024
cd2f33b
Merge branch 'main' into grant_invoke_v2
roger-zhangg May 6, 2024
2e60174
revert to original snapshot
roger-zhangg May 6, 2024
36ee9a9
fix integ test
roger-zhangg May 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...ws-cdk-testing/framework-integ/test/aws-lambda/test/integ.permissions.js.snapshot/cdk.out
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion ...cdk-testing/framework-integ/test/aws-lambda/test/integ.permissions.js.snapshot/integ.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions ...k-integ/test/aws-lambda/test/integ.permissions.js.snapshot/lambda-permissions.assets.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

28 changes: 28 additions & 0 deletions ...integ/test/aws-lambda/test/integ.permissions.js.snapshot/lambda-permissions.template.json
View file
Open in desktop
Expand Up @@ -78,6 +78,34 @@
"PrincipalOrgID": "o-xxxxxxxxxx"
}
},
"MyLambdaInvokeZoBUDhNic8W9iwOX3PUHW4PxLYxcNvgQd0I750ZVGfQ48B59B4A": {
"Type": "AWS::Lambda::Permission",
"Properties": {
"Action": "lambda:InvokeFunction",
"FunctionName": {
"Fn::GetAtt": [
"MyLambdaCCE802FB",
"Arn"
]
},
"Principal": "*",
"PrincipalOrgID": "o-yyyyyyyyyy2"
}
},
"MyLambdaInvokefy1YgRC9j8kJQBgyNsNsleYXOlPp4RTnXEx2NNmcs4CE101ED": {
"Type": "AWS::Lambda::Permission",
"Properties": {
"Action": "lambda:InvokeFunction",
"FunctionName": {
"Fn::GetAtt": [
"MyLambdaCCE802FB",
"Arn"
]
},
"Principal": "*",
"PrincipalOrgID": "o-xxxxxxxxxx2"
}
},
"MyLambdaFunctionUrlC2055677": {
"Type": "AWS::Lambda::Url",
"Properties": {
Expand Down
25 changes: 14 additions & 11 deletions ...-testing/framework-integ/test/aws-lambda/test/integ.permissions.js.snapshot/manifest.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

126 changes: 85 additions & 41 deletions ...-cdk-testing/framework-integ/test/aws-lambda/test/integ.permissions.js.snapshot/tree.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.permissions.ts
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration feels a bit lackluster here, we're only testing that the policy is synthetically correct, not that the grants work as expected

Adding integration assertions to check that the functions are invokable with the provided examples would be ideal, either with AwsApiCalls, or by adding an API Gateway to integrate the Lambdas and running HttpApiCalls

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do agree only testing synthetically is kind of wired, but doing AwsApiCalls seems to be testing against Lambda/IAM rather than testing CDK. So I just followed the previous test behavior

Expand Up @@ -17,6 +17,10 @@ fn.grantInvoke(new iam.AnyPrincipal().inOrganization('o-yyyyyyyyyy'));

fn.grantInvoke(new iam.OrganizationPrincipal('o-xxxxxxxxxx'));

fn.grantInvokeV2(new iam.AnyPrincipal().inOrganization('o-yyyyyyyyyy2'));

fn.grantInvokeV2(new iam.OrganizationPrincipal('o-xxxxxxxxxx2'));

const fnUrl = fn.addFunctionUrl();
const role = new iam.Role(stack, 'MyRole', {
assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
Expand Down
3 changes: 3 additions & 0 deletions packages/aws-cdk-lib/aws-cloudfront/lib/experimental/edge-function.ts
View file
Open in desktop
Expand Up @@ -119,6 +119,9 @@ export class EdgeFunction extends Resource implements lambda.IVersion {
public grantInvoke(identity: iam.IGrantable): iam.Grant {
return this.lambda.grantInvoke(identity);
}
public grantInvokeV2(identity: iam.IGrantable, grantVersionAccess?: boolean): iam.Grant {
return this.lambda.grantInvokeV2(identity, grantVersionAccess);
}
public grantInvokeUrl(identity: iam.IGrantable): iam.Grant {
return this.lambda.grantInvokeUrl(identity);
}
Expand Down