Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(aws-lambda): CloudWatch event rule permissions (#558)
Lambda permissions granted when it was added as an event rule target did not include "SourceArn" as required. This allowed any event rule to trigger the function, and also did not show as a trigger in the AWS Lambda console. Added a integration test to verify. BREAKING CHANGE To fix this, we needed to modify `IEventRuleTarget` to pass the ARN of the rule and a unique ID to the registered target in order to allow it to specify the Source ARN. This required fixing all existing event rule targets (which, so far would return a role to be assumed by CWE, so the source ARN was not required). Fixes #555
- Loading branch information
Elad Ben-Israel
committed
Aug 14, 2018
1 parent
0efe25b
commit 327f5e1
Showing
11 changed files
with
235 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
132 changes: 132 additions & 0 deletions
132
packages/@aws-cdk/aws-lambda/test/integ.events.expected.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,132 @@ | ||
| { | ||
| "Resources": { | ||
| "MyFuncServiceRole54065130": { | ||
| "Type": "AWS::IAM::Role", | ||
| "Properties": { | ||
| "AssumeRolePolicyDocument": { | ||
| "Statement": [ | ||
| { | ||
| "Action": "sts:AssumeRole", | ||
| "Effect": "Allow", | ||
| "Principal": { | ||
| "Service": "lambda.amazonaws.com" | ||
| } | ||
| } | ||
| ], | ||
| "Version": "2012-10-17" | ||
| }, | ||
| "ManagedPolicyArns": [ | ||
| { | ||
| "Fn::Join": [ | ||
| "", | ||
| [ | ||
| "arn", | ||
| ":", | ||
| { | ||
| "Ref": "AWS::Partition" | ||
| }, | ||
| ":", | ||
| "iam", | ||
| ":", | ||
| "", | ||
| ":", | ||
| "aws", | ||
| ":", | ||
| "policy", | ||
| "/", | ||
| "service-role/AWSLambdaBasicExecutionRole" | ||
| ] | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "MyFunc8A243A2C": { | ||
| "Type": "AWS::Lambda::Function", | ||
| "Properties": { | ||
| "Code": { | ||
| "ZipFile": "exports.handler = function handler(event, _context, callback) {\n console.log(JSON.stringify(event, undefined, 2));\n return callback();\n}" | ||
| }, | ||
| "Handler": "index.handler", | ||
| "Role": { | ||
| "Fn::GetAtt": [ | ||
| "MyFuncServiceRole54065130", | ||
| "Arn" | ||
| ] | ||
| }, | ||
| "Runtime": "nodejs6.10" | ||
| }, | ||
| "DependsOn": [ | ||
| "MyFuncServiceRole54065130" | ||
| ] | ||
| }, | ||
| "MyFuncAllowEventRulelambdaeventsTimer0E6AB6D8E3B334A3": { | ||
| "Type": "AWS::Lambda::Permission", | ||
| "Properties": { | ||
| "Action": "lambda:InvokeFunction", | ||
| "FunctionName": { | ||
| "Ref": "MyFunc8A243A2C" | ||
| }, | ||
| "Principal": "events.amazonaws.com", | ||
| "SourceArn": { | ||
| "Fn::GetAtt": [ | ||
| "TimerBF6F831F", | ||
| "Arn" | ||
| ] | ||
| } | ||
| } | ||
| }, | ||
| "MyFuncAllowEventRulelambdaeventsTimer27F866A1E0669C645": { | ||
| "Type": "AWS::Lambda::Permission", | ||
| "Properties": { | ||
| "Action": "lambda:InvokeFunction", | ||
| "FunctionName": { | ||
| "Ref": "MyFunc8A243A2C" | ||
| }, | ||
| "Principal": "events.amazonaws.com", | ||
| "SourceArn": { | ||
| "Fn::GetAtt": [ | ||
| "Timer2B6F162E9", | ||
| "Arn" | ||
| ] | ||
| } | ||
| } | ||
| }, | ||
| "TimerBF6F831F": { | ||
| "Type": "AWS::Events::Rule", | ||
| "Properties": { | ||
| "ScheduleExpression": "rate(1 minute)", | ||
| "State": "ENABLED", | ||
| "Targets": [ | ||
| { | ||
| "Arn": { | ||
| "Fn::GetAtt": [ | ||
| "MyFunc8A243A2C", | ||
| "Arn" | ||
| ] | ||
| }, | ||
| "Id": "MyFunc" | ||
| } | ||
| ] | ||
| } | ||
| }, | ||
| "Timer2B6F162E9": { | ||
| "Type": "AWS::Events::Rule", | ||
| "Properties": { | ||
| "ScheduleExpression": "rate(2 minutes)", | ||
| "State": "ENABLED", | ||
| "Targets": [ | ||
| { | ||
| "Arn": { | ||
| "Fn::GetAtt": [ | ||
| "MyFunc8A243A2C", | ||
| "Arn" | ||
| ] | ||
| }, | ||
| "Id": "MyFunc" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| import events = require('@aws-cdk/aws-events'); | ||
| import cdk = require('@aws-cdk/cdk'); | ||
| import lambda = require('../lib'); | ||
|
|
||
| const app = new cdk.App(process.argv); | ||
|
|
||
| const stack = new cdk.Stack(app, 'lambda-events'); | ||
|
|
||
| const fn = new lambda.Function(stack, 'MyFunc', { | ||
| runtime: lambda.Runtime.NodeJS610, | ||
| handler: 'index.handler', | ||
| code: lambda.Code.inline(`exports.handler = ${handler.toString()}`) | ||
| }); | ||
|
|
||
| const timer = new events.EventRule(stack, 'Timer', { scheduleExpression: 'rate(1 minute)' }); | ||
| timer.addTarget(fn); | ||
|
|
||
| const timer2 = new events.EventRule(stack, 'Timer2', { scheduleExpression: 'rate(2 minutes)' }); | ||
| timer2.addTarget(fn); | ||
|
|
||
| process.stdout.write(app.run()); | ||
|
|
||
| // tslint:disable:no-console | ||
| function handler(event: any, _context: any, callback: any) { | ||
| console.log(JSON.stringify(event, undefined, 2)); | ||
| return callback(); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -123,4 +123,4 @@ | |
| ] | ||
| } | ||
| } | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.