Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(lambda): failed to add permission to an imported lambda from another account #11369

Merged
merged 6 commits into from
Nov 16, 2020

Conversation

nija-at
Copy link
Contributor

@nija-at nija-at commented Nov 9, 2020

Originally, when a function was imported into an account agnostic stack,
it was assumed that the function was from a different account and hence
its permission cannot be modified.

A subsequent change - 99111f7 - changed
this behaviour to its opposite. When an account agnostic stack was
encountered in the context of an imported function, it was assumed that
the function was part of the same account.
This has caused customers to report regressions - #11278, #11141.

This change reverts this behaviour back to its original assumption, with
the additional ability to configure this explicitly by the user if
needed for an advanced use case.

fixes #11141


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

…her account

Originally, when a function was imported into an account agnostic stack,
it was assumed that the function was from a different account and hence
its permission cannot be modified.

A subsequent change - 99111f7 - changed
this behaviour to its opposite. When an account agnostic stack was
encountered in the context of an imported function, it was assumed that
the function was part of the same account.
This has caused customers to report regressions - #11278, #11141.

This change reverts this behaviour back to its original assumption, with
the additional ability to configure this explicitly by the user if
needed for an advanced use case.

fixes #11141
@nija-at nija-at requested review from eladb, njlynch and a team November 9, 2020 12:41
@nija-at nija-at self-assigned this Nov 9, 2020
@gitpod-io
Copy link

gitpod-io bot commented Nov 9, 2020

Copy link
Contributor

@njlynch njlynch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like the error message in grantInvoke should be updated to reflect this, as we're going to break (other) existing customers with this revert.

Also wouldn't mind a second set of eyes here.

packages/@aws-cdk/aws-lambda/lib/function-base.ts Outdated Show resolved Hide resolved
@nija-at nija-at requested a review from a team November 16, 2020 10:06
@nija-at nija-at requested a review from eladb November 16, 2020 11:29
@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
  • Commit ID: f7681b7
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify
Copy link
Contributor

mergify bot commented Nov 16, 2020

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@mergify mergify bot merged commit 715a030 into master Nov 16, 2020
@mergify mergify bot deleted the nija-at/imported-perms branch November 16, 2020 11:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
contribution/core This is a PR that came from AWS.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[lambda] CDK tries to add permission to an imported lambda in another account
5 participants