(aws-lambda): Allow referencing lambda container image by digest

[mrvisser]

At the moment it appears DockerImageCode.fromEcr type can only accept a tag as a reference to a container version. I think it would be helpful to also be able to reference a digest instead of a tag.

Use Case

Deploying a Lambda on a moving tag requires intervention outside the CDK to force the lambda to update its digest. In my workflow, I deploy a new container to latest, and get a digest from that update. I would like to just specify that digest in my lambda container to then force it to update to the latest version.

Proposed Solution

Taking into consideration how this issue was resolved: #5082 . Maybe we should have the ability to create a DockerImageCode instance from the full Repository URI, so we can say repository.repositoryUriForDigest in addition to repository.repositoryUriForTag.

Another option is to add a digest property in the options for DockerImageCode.fromEcr, however then that opens an invalid state, where you can specify both a tag and digest.

One other thought, in line with this comment: #5082 (comment), is to overload the tag property for digest, and check if it starts with sha256:.

Other

Resource handler returned message: "Source image 393233896464.dkr.ecr.us-east-2.amazonaws.com/my-image:@sha256:783e6c546ca12437893a8651759f93a642a55d368a238f04bf625859c3bdb25a is not valid. Provide a valid source image. (Service: Lambda, Status
Code: 400, Request ID: 2982d3fc-3741-4a5c-ae6b-e3d7f3b6b076, Extended Request ID: null)" (RequestToken: 3c72609b-e1fa-e34c-f15e-02134f8405d4, HandlerErrorCode: InvalidRequest)

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[nija-at]

Thanks for filing this issue.

The EcrImageCode will need to be updated to use repositoryUriForDigest() here -

aws-cdk/packages/@aws-cdk/aws-lambda/lib/code.ts

Line 460 in 929d6ae

imageUri: this.repository.repositoryUriForTag(this.props?.tag ?? 'latest'),

and EcrImageCodeProps will need to be updated to accept a digest. property.

Marking as a feature request.

[mrvisser]

For the specific use-case, you can also do this after you've deployed an updated image to ECR, and it forces the lambda to update its image reference to the latest digest:

aws lambda update-function-code \
  --function-name <function name> \
  --image-uri "$ECR_URL/my-image:prod"

In this scenario there are no stack updates to to the lambda container's digest necessary.

[adrian-baker]

A hacky-feeling workaround for this (using the Java SDK) is to concat the digest manually to the repository, and pass a blank tag (null doesn't work because it results in :latest being added).

DockerImageCode.fromEcr(Repository.fromRepositoryArn(this, "unused",
        "arn:aws:ecr:ap-southeast-2:11111111:repository/my-repo@sha256:570f120..."),
    EcrImageCodeProps.builder().tag("").build());

[huonw]

In #19799, I generalised the change from #13299 (fixes #5082) and used it in most places, including lambda.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.