Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(lambda): add grantInvokeLatestVersion to grant invoke only to latest function version #29856

Merged
merged 26 commits into from
Jul 2, 2024
Merged
Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
4d90557
add grantInvokeV2
roger-zhangg Apr 16, 2024
a2ca2f2
add readme
roger-zhangg Apr 16, 2024
287ccc5
Merge branch 'main' into grant_invoke_v2
roger-zhangg Apr 16, 2024
1052cf1
Merge branch 'grant_invoke_v2' of github.com:roger-zhangg/aws-cdk int…
roger-zhangg Apr 16, 2024
aa9d4ca
add integ test
roger-zhangg Apr 16, 2024
fc612e3
change to grantinvoke
roger-zhangg Apr 18, 2024
3aa8b6f
Merge branch 'main' into grant_invoke_v2
roger-zhangg Apr 18, 2024
679e6a6
lint
roger-zhangg Apr 18, 2024
0857f65
typo
roger-zhangg Apr 18, 2024
34d1506
add fn
roger-zhangg Apr 18, 2024
a502cd0
test
roger-zhangg Apr 18, 2024
5e5e6c9
add grantInvokeLatestVersion
roger-zhangg May 3, 2024
c734032
add grantInvokeLatestVersion
roger-zhangg May 3, 2024
74130bb
Merge branch 'main' into grant_invoke_v2
roger-zhangg May 3, 2024
f4b873f
fix lint
roger-zhangg May 3, 2024
a7b2b36
fix integ
roger-zhangg May 3, 2024
cd2f33b
Merge branch 'main' into grant_invoke_v2
roger-zhangg May 6, 2024
2e60174
revert to original snapshot
roger-zhangg May 6, 2024
36ee9a9
fix integ test
roger-zhangg May 6, 2024
6b4a5eb
Merge branch 'main' into grant_invoke_v2
roger-zhangg May 29, 2024
aa3cd0e
Merge branch 'main' into grant_invoke_v2
roger-zhangg Jun 25, 2024
7501abd
address comments
roger-zhangg Jun 26, 2024
734aae6
add desc
roger-zhangg Jun 26, 2024
15e3e8e
Merge branch 'main' into grant_invoke_v2
roger-zhangg Jun 26, 2024
e332150
Merge branch 'main' into grant_invoke_v2
roger-zhangg Jul 1, 2024
f84e77c
Merge branch 'main' into grant_invoke_v2
mergify[bot] Jul 2, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,34 @@
"PrincipalOrgID": "o-xxxxxxxxxx"
}
},
"MyLambdaInvokeZoBUDhNic8W9iwOX3PUHW4PxLYxcNvgQd0I750ZVGfQ48B59B4A": {
"Type": "AWS::Lambda::Permission",
"Properties": {
"Action": "lambda:InvokeFunction",
"FunctionName": {
"Fn::GetAtt": [
"MyLambdaCCE802FB",
"Arn"
]
},
"Principal": "*",
"PrincipalOrgID": "o-yyyyyyyyyy2"
}
},
"MyLambdaInvokefy1YgRC9j8kJQBgyNsNsleYXOlPp4RTnXEx2NNmcs4CE101ED": {
"Type": "AWS::Lambda::Permission",
"Properties": {
"Action": "lambda:InvokeFunction",
"FunctionName": {
"Fn::GetAtt": [
"MyLambdaCCE802FB",
"Arn"
]
},
"Principal": "*",
"PrincipalOrgID": "o-xxxxxxxxxx2"
}
},
"MyLambdaFunctionUrlC2055677": {
"Type": "AWS::Lambda::Url",
"Properties": {
Expand Down

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The integration feels a bit lackluster here, we're only testing that the policy is synthetically correct, not that the grants work as expected

Adding integration assertions to check that the functions are invokable with the provided examples would be ideal, either with AwsApiCalls, or by adding an API Gateway to integrate the Lambdas and running HttpApiCalls

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do agree only testing synthetically is kind of wired, but doing AwsApiCalls seems to be testing against Lambda/IAM rather than testing CDK. So I just followed the previous test behavior

Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ fn.grantInvoke(new iam.AnyPrincipal().inOrganization('o-yyyyyyyyyy'));

fn.grantInvoke(new iam.OrganizationPrincipal('o-xxxxxxxxxx'));

fn.grantInvokeV2(new iam.AnyPrincipal().inOrganization('o-yyyyyyyyyy2'));

fn.grantInvokeV2(new iam.OrganizationPrincipal('o-xxxxxxxxxx2'));

const fnUrl = fn.addFunctionUrl();
const role = new iam.Role(stack, 'MyRole', {
assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,9 @@ export class EdgeFunction extends Resource implements lambda.IVersion {
public grantInvoke(identity: iam.IGrantable): iam.Grant {
return this.lambda.grantInvoke(identity);
}
public grantInvokeV2(identity: iam.IGrantable, grantVersionAccess?: boolean): iam.Grant {
return this.lambda.grantInvokeV2(identity, grantVersionAccess);
}
public grantInvokeUrl(identity: iam.IGrantable): iam.Grant {
return this.lambda.grantInvokeUrl(identity);
}
Expand Down
Loading
Loading