Support custom role setting for custom resources

[gordianberger]

This is a Bug Report

Description

• What went wrong?

We use our own role which is specified at the provider level. This role is used for every lambda. Since we added the Eventbridge event to a Lambda it fails to try to create a custom role (which it should not do since we use our predefined one).

I looked at the generated Cloudformation JSON and noticed that it is trying to create a Lambda using the handler (eventBridge/handler.handler) from custom resources. Additionally, it is creating a new role for this lambda called "IamRoleCustomResourcesLambdaExecution". For every other Lambda, it is using our predefined Role so I think this is wrong.

• What did you expect should have happened?

Custom-resources lambda should use the default role we specified.

• What was the config you used?

provider:
  role: our ARN
​
functions:
​
  # Log from event bus
  LogEvent:
    handler: lambda.handler
    events:
      - eventBridge:
          eventBus: custom-saas-events
          pattern:
            source:
              - saas.external

• What stacktrace or error message from your provider did you see?

Similar or dependent issues:

Additional Data

• Serverless Framework Version you're using: Framework Core: 1.50.0
• Operating System: windows
• Stack Trace:
• Provider Error messages:

[medikoo]

@gordianberger thanks for that report.

Since we added the Eventbridge event to a Lambda it fails to try to create a custom role (which it should not do since we use our predefined one).

Why exactly it fails? Relying on custom resources is expected to work seamlessly with custom role setting

Custom-resources lambda should use the default role we specified.

Custom resource lambdas have very specific permission requirements, and those are in most cases very different from ones needed by service lambdas. I think it wouldn't be nice if we would automatically assume that same role should be used for those and regular lambdas.

Still I think a worthwhile improvement would be to support a customResourceRole setting, through which you may state that existing, externally maintained, role should be used. Having that you may assign same ARN here as to role setting.

What do you think?

[gordianberger]

@medikoo Thanks for the quick response.

Agreed. I understand a little bit more about custom resources now, so I also think that it is a better practice to have two roles.

Also, a small setup still can share the role so I like this approach.

[olafur-palsson]

Hello, I'm interested in solving this issue, can anyone point me in the right direction?

[medikoo]

@olafur-palsson here's a place where we create a dedicated role internally:

serverless/lib/plugins/aws/customResources/index.js

Line 86 in 91ae8bc

let customResourceRole = Resources[customResourcesRoleLogicalId];

Still, as I think of it, allowing to provide custom role for that, is a bit controversial, as what polices are required may vary across versions (even minor updates), while role as provided by user will have to unconditionally support all of them for successful stack deployment

Do you have a valid use case for that?

[hanikesn]

See #6492 (comment)

This is a real issue in enterprise enviroments where role creation might be restricted. E.g. by requiring a naming convention, permission boundary or just completely for developers.

Allowing a custom role here would let people work around that issue. Even it that requires a bit more effort.