Skip to content

Commit

Permalink
chore: deprecate qualifier parameter for lambda integrations (#19548)
Browse files Browse the repository at this point in the history
‼️ Lambda is changing their authorization strategy. Under this new behavior customer lambda invocations will fail in this scenario:
- the invocation is requested using an IAM Permission with an unqualified ARN as the FunctionName
- the invocation is requested with an unqualified ARN and a Qualifier parameter

The idea is to steer away from invoking lambdas with a Qualifier request parameter altogether, hence the deprecations. Instead, customers should be requesting permissions on qualified ARNs (versions and aliases) if they want to invoke versions/aliases.

See #19464.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
  • Loading branch information
kaizencc authored Mar 25, 2022
1 parent 8c0a4c9 commit 43e8dea
Show file tree
Hide file tree
Showing 3 changed files with 6 additions and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ export interface LambdaInvokeProps extends sfn.TaskStateBaseProps {
* directly as the `lambdaFunction` argument.
*
* @default - Version or alias inherent to the `lambdaFunction` object.
* @deprecated pass a Version or Alias object as lambdaFunction instead
*/
readonly qualifier?: string;

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ export interface RunLambdaTaskProps {
* Version or alias of the function to be invoked
*
* @default - No qualifier
* @deprecated pass a Version or Alias object as lambdaFunction instead
*/
readonly qualifier?: string;
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ import * as lambda from '@aws-cdk/aws-lambda';
import * as sfn from '@aws-cdk/aws-stepfunctions';
import { Stack } from '@aws-cdk/core';
import { LambdaInvocationType, LambdaInvoke } from '../../lib';
import { testDeprecated } from '@aws-cdk/cdk-build-tools';

/* eslint-disable quote-props */

Expand Down Expand Up @@ -66,7 +67,7 @@ describe('LambdaInvoke', () => {
});
});

test('optional settings', () => {
testDeprecated('optional settings', () => {
// WHEN
const task = new LambdaInvoke(stack, 'Task', {
lambdaFunction,
Expand Down Expand Up @@ -163,7 +164,7 @@ describe('LambdaInvoke', () => {
}));
});

test('invoke Lambda function and wait for task token', () => {
testDeprecated('invoke Lambda function and wait for task token', () => {
// GIVEN
const task = new LambdaInvoke(stack, 'Task', {
lambdaFunction,
Expand Down Expand Up @@ -360,7 +361,7 @@ describe('LambdaInvoke', () => {
}).toThrow(/The 'payloadResponseOnly' property cannot be used if 'integrationPattern', 'invocationType', 'clientContext', or 'qualifier' are specified./);
});

test('fails when qualifier used with payloadResponseOnly', () => {
testDeprecated('fails when qualifier used with payloadResponseOnly', () => {
expect(() => {
new LambdaInvoke(stack, 'Task', {
lambdaFunction,
Expand Down

0 comments on commit 43e8dea

Please sign in to comment.