Sfn finalizer log & eventTrail the target:success map result; add Sfn pin lambda version

[rivernews]

ef44117

b5d71d3

[rivernews]

Same reason in #38, we won't implement success rate. But we can symbolically read from map result just to get the stories count, which is going to equal the stories input length anyway. But it could be a POC of accessing map outputs.

[rivernews]

Also to better support rolling deploy, we should pin lambda version in Sfn: https://dev.to/aws-builders/aws-step-functions-are-active-executions-affected-when-your-state-machine-gets-updated-5dfn

Seems to cause Sfn execution error:

1 validation error detected: Value 'arn:aws:lambda:us-west-2:***:function:media-literacy-dev-story-lambda/28' at 'functionName' failed to satisfy constraint: Member must satisfy regular expression pattern: (arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-\d{1}:)?(\d{12}:)?(function:)?([a-zA-Z0-9-_\.]+)(:(\$LATEST|[a-zA-Z0-9-_]+))? (Service: AWSLambda; Status Code: 400; Error Code: ValidationException; Request ID: 93150322-fa71-4c0b-a653-25232e48685a; Proxy: null)

Is version number already included in lambda_function_arn? Possibly, looking at AWS doc. Watch the FunctionArn already includes version number at the end.

• Nope we see the deployed Sfn definition has "Resource": "arn:aws:lambda:us-west-2:***:function:media-literacy-dev-story-lambda" We may need to look at the TF AWS Lambda module doc.
• Let's try another output property lambda_function_qualified_arn, now the Sfn def shows "Resource": "arn:aws:lambda:us-west-2:**:function:media-literacy-dev-story-lambda:29"... \
• Sfn seems to run with qualified lambda arn, but now a permission error User: arn:aws:sts::368061806057:assumed-role/media-literacy-dev-batch-stories-sfn/XhCRchTWFeYYluPMRgpIuucObgkkFsVB is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-west-2:368061806057:function:media-literacy-dev-story-lambda:29 because no identity-based policy allows the lambda:InvokeFunction action (Service: AWSLambda; Status Code: 403; Error Code: AccessDeniedException; Request ID: b0f196af-b186-4769-8862-9acbf4fc5afb; Proxy: null)
  • Can we keep Sfn pin to qualified arn, but permission we wildcard to allow all versions of that lambda? We can use this AWS doc, following "Example allowing invocation of any qualified ARN": ...:function:myFunction:*". By doing this, we enforce Sfn should always use versioned lambda - we deny unqualified arn which means deny if not specifying version.

[rivernews]

Confirmed Sfn is executing ok now.

[rivernews]

We still need to confirm Sfn finalizer shows the total stories count. This will take some time, up to 13*3 minutes.

[rivernews]

Confirmed!