-
Notifications
You must be signed in to change notification settings - Fork 3.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
lambda policy size exceeds limit when used with multiple RestApi methods #5774
Comments
I've re-purposed the issue title to define what the issue. While your suggestion to fix this does make it more flexible, it wouldn't be the right customer experience for a CDK user. Looking to understand this a little more - Could you provide the number of APIGateway methods that use the same lambda function? It would be useful if you can also get the generated policy from the CloudFormation template and put it on the issue. Do you know which of these limits - https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html - are you specifically encountering? |
Closing this issue since there hasn't been a response in a while. Feel free to reopen. |
@nija-at "it wouldn't be the right customer experience for a CDK user." Why do you think this? Also it is the resource based policy which has limit of 2,048. The problem is that LambdaIntegration calls the lambda function addPermission everytime for a new Method. The policy gets filled up quite quickly and then the stack fails stating that the policy size is too big. The solution is to create a variation of the LambdaIntegration class that does the binding but does not add a individual method policy for each API method but rather just give the whole API (any resource + method) access to the Lambda.
|
@rehanvdm Is it possible to make the same trick with |
@andrew-terekhov I guess there is, you need to override the parent function. I'm not familiar with how to do that in python. but, I'm sure there is a way. |
@AmitBaranes Thank you for the response! |
I'm getting burned by this as well :/ |
Does not work anymore since the Method signature changed, refer to the newly opened ticket addressing this and the new solution here: #9327 (comment) |
I have published a serverlessland pattern that can be used as a workaround meanwhile - https://serverlessland.com/patterns/apigw-lambda-wildcard-resourcebasedpolicy-cdk The solution replaces all other would-be created policy for each new integration with a wildcard resource-based policy. |
This worked smashingly for me, with one caveat. Since I had already hit the limit, CDK wouldn't deploy the fix since it would try to create the wildcard policy before removing the specific policies and that would cross the policy length threshold. I had to first comment out a number of Thanks! 🥳 |
short description:
Override Lambda Permission manually when creating a new API Gateway method.
Use Case
Recently I faced this issue when pointing multiple API Gateways methods to specific lambda :
The final policy size (XXX) is bigger than the limit (20480)
The feature allows users to bypass automatic permission creation (sort of "manual mode") to avoid this limitation.
I noticed that when using
LambdaIntegration
class the bind function adds permissions automatically to the lambda function based on the method URL.My workaround was overriding the bind function with my own class ( see this post - https://stackoverflow.com/questions/59713522/cdk-override-bind-when-using-lambdaintegration?noredirect=1#comment105588249_59713522) and implement my own logic.
This feature can give more flexibility to the end-user and could give more control about the lambda permissions.
This is a 🚀 Feature Request
The text was updated successfully, but these errors were encountered: