(aws_lambda): execution role example uses wrong service principal

[andrewgoss]

https://docs.aws.amazon.com/cdk/api/latest/docs/aws-lambda-readme.html
https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-lambda/README.md

In the readme, the following code snippet is provided as an example of creating your own execution role for the lambda function:

import * as iam from '@aws-cdk/aws-iam';
const myRole = new iam.Role(this, 'My Role', {
  assumedBy: new iam.ServicePrincipal('sns.amazonaws.com'),
});
const fn = new Function(this, 'MyFunction', {
  runtime: Runtime.NODEJS_12_X,
  handler: 'index.handler',
  code: Code.fromAsset(path.join(__dirname, 'lambda-handler')),
  role: myRole // user-provided role
});

myRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"));
myRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaVPCAccessExecutionRole")); // only required if your function lives in a VPC

I thought that the service principal should be lambda.amazonaws.com and not sns

I can attempt to create a PR for this, though I have never done that for such a project.

---

This is a 📕 documentation issue

[indrora]

Following up: This is correct. The AWS Lambda docs explicitly call this out. The appropriate service principal is lambda.amazonaws.com, not sns.

[peterwoodworth]

This has been updated, closing

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.