feat(lambda): add cloudwatch lambda insights arm support

packages/@aws-cdk/aws-lambda/README.md

@@ -411,6 +411,19 @@ new lambda.Function(this, 'MyFunction', {
 });
 ```
 
+If you are deploying an ARM_64 Lambda Function, you must specify a
+Lambda Insights Version >= `1_0_119_0`.
+
+```ts
+new lambda.Function(this, 'MyFunction', {
+  runtime: lambda.Runtime.NODEJS_12_X,
+  handler: 'index.handler',
+  architecture: lambda.Architecture.ARM_64,
+  code: lambda.Code.fromAsset(path.join(__dirname, 'lambda-handler')),
+  insightsVersion: lambda.LambdaInsightsVersion.VERSION_1_0_119_0,
+});
+```
+
 ## Event Rule Target
 
 You can use an AWS Lambda function as a target for an Amazon CloudWatch event

packages/@aws-cdk/aws-lambda/lib/function-base.ts

@@ -3,6 +3,7 @@ import * as ec2 from '@aws-cdk/aws-ec2';
 import * as iam from '@aws-cdk/aws-iam';
 import { ArnFormat, ConstructNode, IResource, Resource, Token } from '@aws-cdk/core';
 import { AliasOptions } from './alias';
+import { Architecture } from './architecture';
 import { EventInvokeConfig, EventInvokeConfigOptions } from './event-invoke-config';
 import { IEventSource } from './event-source';
 import { EventSourceMapping, EventSourceMappingOptions } from './event-source-mapping';
@@ -56,6 +57,11 @@ export interface IFunction extends IResource, ec2.IConnectable, iam.IGrantable {
    */
   readonly permissionsNode: ConstructNode;
 
+  /**
+   * The system architectures compatible with this lambda function.
+   */
+  readonly architecture?: Architecture;
+
   /**
    * Adds an event source that maps to this AWS Lambda function.
    * @param id construct ID

packages/@aws-cdk/aws-lambda/lib/function.ts

@@ -600,6 +600,8 @@ export class Function extends FunctionBase {
   private readonly currentVersionOptions?: VersionOptions;
   private _currentVersion?: Version;
 
+  private _architecture?: Architecture;
+
   constructor(scope: Construct, id: string, props: FunctionProps) {
     super(scope, id, {
       physicalName: props.functionName,
@@ -683,7 +685,7 @@ export class Function extends FunctionBase {
     if (props.architectures && props.architectures.length > 1) {
       throw new Error('Only one architecture must be specified.');
     }
-    const architecture = props.architecture ?? (props.architectures && props.architectures[0]);
+    this._architecture = props.architecture ?? (props.architectures && props.architectures[0]);
 
     const resource: CfnFunction = new CfnFunction(this, 'Resource', {
       functionName: this.physicalName,
@@ -717,7 +719,7 @@ export class Function extends FunctionBase {
       kmsKeyArn: props.environmentEncryption?.keyArn,
       fileSystemConfigs,
       codeSigningConfigArn: props.codeSigningConfig?.codeSigningConfigArn,
-      architectures: architecture ? [architecture.name] : undefined,
+      architectures: this._architecture ? [this._architecture.name] : undefined,
     });
 
     resource.node.addDependency(this.role);
@@ -935,7 +937,7 @@ Environment variables can be marked for removal when used in Lambda@Edge by sett
     if (props.runtime !== Runtime.FROM_IMAGE) {
       // Layers cannot be added to Lambda container images. The image should have the insights agent installed.
       // See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Lambda-Insights-Getting-Started-docker.html
-      this.addLayers(LayerVersion.fromLayerVersionArn(this, 'LambdaInsightsLayer', props.insightsVersion.layerVersionArn));
+      this.addLayers(LayerVersion.fromLayerVersionArn(this, 'LambdaInsightsLayer', props.insightsVersion._bind(this, this).arn));
     }
     this.role?.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('CloudWatchLambdaInsightsExecutionRolePolicy'));
   }

packages/@aws-cdk/aws-lambda/lib/lambda-insights.ts

@@ -1,9 +1,18 @@
 import { Aws, CfnMapping, Fn, IResolveContext, Lazy, Stack, Token } from '@aws-cdk/core';
 import { FactName, RegionInfo } from '@aws-cdk/region-info';
+import { Construct } from 'constructs';
+import { Architecture } from './architecture';
+import { IFunction } from './function-base';
+
 
 // This is the name of the mapping that will be added to the CloudFormation template, if a stack is region agnostic
 const DEFAULT_MAPPING_PREFIX = 'LambdaInsightsVersions';
 
+interface InsightsBindConfig {
+  readonly arn: string;
+
+}
+
 // To add new versions, update fact-tables.ts `CLOUDWATCH_LAMBDA_INSIGHTS_ARNS` and create a new `public static readonly VERSION_A_B_C_D`
 
 /**
@@ -31,6 +40,11 @@ export abstract class LambdaInsightsVersion {
    */
   public static readonly VERSION_1_0_98_0 = LambdaInsightsVersion.fromInsightsVersion('1.0.98.0');
 
+  /**
+   * Version 1.0.119.0
+   */
+  public static readonly VERSION_1_0_119_0 = LambdaInsightsVersion.fromInsightsVersion('1.0.119.0');
+
   /**
    * Use the insights extension associated with the provided ARN. Make sure the ARN is associated
    * with same region as your function
@@ -40,23 +54,35 @@ export abstract class LambdaInsightsVersion {
   public static fromInsightVersionArn(arn: string): LambdaInsightsVersion {
     class InsightsArn extends LambdaInsightsVersion {
       public readonly layerVersionArn = arn;
+      public _bind(_scope: Construct, _function: IFunction): InsightsBindConfig {
+        return { arn };
+      }
     }
     return new InsightsArn();
   }
 
   // Use the verison to build the object. Not meant to be called by the user -- user should use e.g. VERSION_1_0_54_0
   private static fromInsightsVersion(insightsVersion: string): LambdaInsightsVersion {
 
-    // Check if insights version is valid. This should only happen if one of the public static readonly versions are set incorrectly
-    const versionExists = RegionInfo.regions.some(regionInfo => regionInfo.cloudwatchLambdaInsightsArn(insightsVersion));
-    if (!versionExists) {
-      throw new Error(`Insights version ${insightsVersion} does not exist.`);
-    }
-
     class InsightsVersion extends LambdaInsightsVersion {
       public readonly layerVersionArn = Lazy.uncachedString({
         produce: (context) => getVersionArn(context, insightsVersion),
       });
+
+      public _bind(_scope: Construct, _function: IFunction): InsightsBindConfig {
+        const arch = _function.architecture?.name ?? Architecture.X86_64.name;
+        // Check if insights version is valid. This should only happen if one of the public static readonly versions are set incorrectly
+        // or if the version is not available for the Lambda Architecture
+        const versionExists = RegionInfo.regions.some(regionInfo => regionInfo.cloudwatchLambdaInsightsArn(insightsVersion, arch));
+        if (!versionExists) {
+          throw new Error(`Insights version ${insightsVersion} does not exist.`);
+        }
+        return {
+          arn: Lazy.uncachedString({
+            produce: (context) => getVersionArn(context, insightsVersion, arch),
+          }),
+        };
+      }
     }
     return new InsightsVersion();
   }
@@ -65,6 +91,13 @@ export abstract class LambdaInsightsVersion {
    * The arn of the Lambda Insights extension
    */
   public readonly layerVersionArn: string = '';
+
+  /**
+   * Returns the arn of the Lambda Insights extension based on the
+   * Lambda architecture
+   * @internal
+   */
+  public abstract _bind(_scope: Construct, _function: IFunction): InsightsBindConfig;
 }
 
 /**
@@ -73,14 +106,15 @@ export abstract class LambdaInsightsVersion {
  *
  * This function is run on CDK synthesis.
  */
-function getVersionArn(context: IResolveContext, insightsVersion: string): string {
+function getVersionArn(context: IResolveContext, insightsVersion: string, architecture?: string): string {
 
   const scopeStack = Stack.of(context.scope);
   const region = scopeStack.region;
+  const arch = architecture ?? Architecture.X86_64.name;
 
   // Region is defined, look up the arn, or throw an error if the version isn't supported by a region
   if (region !== undefined && !Token.isUnresolved(region)) {
-    const arn = RegionInfo.get(region).cloudwatchLambdaInsightsArn(insightsVersion);
+    const arn = RegionInfo.get(region).cloudwatchLambdaInsightsArn(insightsVersion, arch);
     if (arn === undefined) {
       throw new Error(`Insights version ${insightsVersion} is not supported in region ${region}`);
     }
@@ -116,19 +150,33 @@ function getVersionArn(context: IResolveContext, insightsVersion: string): strin
    * -- {'arn': 'arn3'},
    * - us-east-2
    * -- {'arn': 'arn4'}
+   * LambdaInsightsVersions101190arm64 // a separate mapping version 1.0.119.0 arm64
+   * - us-east-1
+   * -- {'arn': 'arn3'},
+   * - us-east-2
+   * -- {'arn': 'arn4'}
    */
 
-  const mapName = DEFAULT_MAPPING_PREFIX + insightsVersion.split('.').join('');
+  let mapName = DEFAULT_MAPPING_PREFIX + insightsVersion.split('.').join('');
+  // if the architecture is arm64 then append that to the end of the name
+  // this is so that we can have a separate mapping for x86 vs arm in scenarios
+  // where we have Lambda functions with both architectures in the same stack
+  if (arch === Architecture.ARM_64.name) {
+    mapName += arch;
+  }
   const mapping: { [k1: string]: { [k2: string]: any } } = {};
-  const region2arns = RegionInfo.regionMap(FactName.cloudwatchLambdaInsightsVersion(insightsVersion));
+  const region2arns = RegionInfo.regionMap(FactName.cloudwatchLambdaInsightsVersion(insightsVersion, arch));
   for (const [reg, arn] of Object.entries(region2arns)) {
     mapping[reg] = { arn };
   }
 
   // Only create a given mapping once. If another version of insights is used elsewhere, that mapping will also exist
   if (!scopeStack.node.tryFindChild(mapName)) {
-    new CfnMapping(scopeStack, mapName, { mapping });
+    // need to call findInMap here if we are going to set lazy=true, otherwise
+    // we get the informLazyUse info message
+    const map = new CfnMapping(scopeStack, mapName, { mapping, lazy: true });
+    return map.findInMap(Aws.REGION, 'arn');
   }
   // The ARN will be looked up at deployment time from the mapping we created
   return Fn.findInMap(mapName, Aws.REGION, 'arn');
-}
+}