Support lifted inline policies in NodeJS lambda.CallbackFunction (#2553)

- Support lifted inline policies in NodeJS `lambda.CallbackFunction` by @gsuess, originally in #2505
- Fix configuration issues in e2e test

---------

Co-authored-by: Garik Suess <garic.suess@gmail.com>
Co-authored-by: Ian Wahbe <ian@wahbe.com>

examples/callbackfunction/index.ts

@@ -16,34 +16,51 @@ import * as pulumi from "@pulumi/pulumi";
 import * as aws from "@pulumi/aws";
 
 const config = new pulumi.Config("aws");
-const providerOpts = { provider: new aws.Provider("prov", { region: <aws.Region>config.require("envRegion") }) };
+const provider = new aws.Provider("prov", {
+    region: <aws.Region>config.require("envRegion")
+})
 
 const role = new aws.iam.Role("role", {
     assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "lambda.amazonaws.com" }),
-}, providerOpts);
+}, { provider });
+
+const policy = new aws.iam.Policy("policy", {
+    policy: {
+        Version: "2012-10-17",
+        Statement: [{
+            Action: ["s3:ListBucket"],
+            Effect: "Allow",
+            Resource: "arn:aws:s3:::*",
+        }],
+    }
+}, { provider });
 
 const functions = [
     new aws.lambda.CallbackFunction("a", {
         callback: async () => ({ success: true }),
-    }, providerOpts),
+    }, { provider }),
     new aws.lambda.CallbackFunction("b", {
         role: role,
         callback: async () => ({ success: true }),
-    }, providerOpts),
+    }, { provider }),
     new aws.lambda.CallbackFunction("c", {
         role: role.arn,
         callback: async () => ({ success: true }),
-    }, providerOpts),
+    }, { provider }),
     new aws.lambda.CallbackFunction("d", {
         policies: [aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole],
         callback: async () => ({ success: true }),
-    }, providerOpts),
+    }, { provider }),
     new aws.lambda.CallbackFunction("e", {
         callbackFactory: () => {
             const ret = { success: true };
             return async () => ret;
         },
-    }, providerOpts),
+    }, { provider }),
+    new aws.lambda.CallbackFunction("f", {
+        policies: { one: policy.arn },
+        callback: async () => ({ success: true }),
+    }, { provider }),
 ];
 
 export const arns = functions.map(f => f.arn);

examples/callbackfunction/package.json

@@ -7,9 +7,9 @@
     },
     "dependencies": {
         "@pulumi/pulumi": "^3.0.0",
-        "@pulumi/aws": "^5.0.0"
+        "@pulumi/aws": "^6.0.0"
     },
     "devDependencies": {
-        "@types/node": "^8.0.0"
+        "@types/node": "^18.0.0"
     }
 }

sdk/nodejs/lambda/lambdaMixins.ts

@@ -191,8 +191,37 @@ export type BaseCallbackFunctionArgs = utils.Overwrite<FunctionArgs, {
      * A list of IAM policy ARNs to attach to the Function.  Will be used if [role] is not provide.
      * If neither [role] nor [policies] is provided, a default policy of [iam.AWSLambda_FullAccess]
      * will be used instead.
+     *
+     * This can be either an array of ARNs or an object whose values are ARNs. In the latter case, the
+     * keys of the object are the names of the policies. These names are used to uniquely identify the
+     * policy attachment to create a URN. This object format can be useful when you have lifted policy ARNs that you
+     * want to attach. It doesn't matter what the keys are, as long as they are unique for each CallbackFunction.
+     *
+     * Example for object notation:
+     *
+     * ```typescript
+     * const lambda = new aws.lambda.CallbackFunction("my-function", {
+     *   // ... other arguments ...
+     *   policies: {
+     *     "my-policy": myPolicy.arn,
+     *     "other-policy": otherPolicy.arn,
+     *   }
+     * });
+     * ```
+     *
+     * Example for array notation:
+     *
+     * (this will not work if the policy ARNs are lifted, or an output from another resource)
+     *
+     * ```typescript
+     * const lambda = new aws.lambda.CallbackFunction("my-function", {
+     *  // ... other arguments ...
+     *  policies: [aws.iam.managedPolicies.S3FullAccess, aws.iam.managedPolicies.IAMFullAccess],
+     * });
+     * ```
      */
-    policies?: arn.ARN[];
+
+    policies?: Record<string, pulumi.Input<arn.ARN>> | arn.ARN[];
 
     /**
      * The Lambda runtime to use.  If not provided, will default to [NodeJS8d10Runtime]
@@ -329,13 +358,17 @@ export class CallbackFunction<E, R> extends LambdaFunction {
             }
 
             if (args.policies) {
-                for (const policy of args.policies) {
+                const policies: [string, pulumi.Input<arn.ARN>][] = Array.isArray(args.policies)
+                    ? args.policies.map(arn => [utils.sha1hash(arn), arn])
+                    : Object.entries(args.policies);
+
+                for (const [key, policyArn] of policies) {
                     // RolePolicyAttachment objects don't have a physical identity, and create/deletes are processed
                     // structurally based on the `role` and `policyArn`.  So we need to make sure our Pulumi name matches the
                     // structural identity by using a name that includes the role name and policyArn.
-                    const attachment = new iam.RolePolicyAttachment(`${name}-${utils.sha1hash(policy)}`, {
+                    const attachment = new iam.RolePolicyAttachment(`${name}-${key}`, {
                         role: role,
-                        policyArn: policy,
+                        policyArn,
                     }, opts);
                 }
             }