feat(lambda): efs filesystems

packages/@aws-cdk/aws-efs/lib/access-point.ts

@@ -139,6 +139,11 @@ export class AccessPoint extends Resource implements IAccessPoint {
    */
   public readonly accessPointId: string;
 
+  /**
+   * The filesystem of the access point
+   */
+  public readonly fileSystem: IFileSystem;
+
   constructor(scope: Construct, id: string, props: AccessPointProps) {
     super(scope, id);
 
@@ -165,5 +170,6 @@ export class AccessPoint extends Resource implements IAccessPoint {
       resource: 'access-point',
       resourceName: this.accessPointId,
     });
+    this.fileSystem = props.fileSystem;
   }
 }

packages/@aws-cdk/aws-efs/lib/efs-file-system.ts

@@ -1,6 +1,6 @@
 import * as ec2 from '@aws-cdk/aws-ec2';
 import * as kms from '@aws-cdk/aws-kms';
-import { Construct, IResource, RemovalPolicy, Resource, Size, Tag } from '@aws-cdk/core';
+import { ConcreteDependable, Construct, IDependable, IResource, RemovalPolicy, Resource, Size, Tag } from '@aws-cdk/core';
 import { AccessPoint, AccessPointOptions } from './access-point';
 import { CfnFileSystem, CfnMountTarget } from './efs.generated';
 
@@ -83,6 +83,12 @@ export interface IFileSystem extends ec2.IConnectable, IResource {
    * @attribute
    */
   readonly fileSystemId: string;
+
+  /**
+   * Dependable that can be depended upon to ensure the mount targets of the filesystem are ready
+   */
+  readonly mountTargetsAvailable: IDependable;
+
 }
 
 /**
@@ -205,6 +211,7 @@ export class FileSystem extends Resource implements IFileSystem {
         securityGroups: [attrs.securityGroup],
         defaultPort: ec2.Port.tcp(FileSystem.DEFAULT_PORT),
       });
+      public readonly mountTargetsAvailable = new ConcreteDependable();
     }
 
     return new Import(scope, id);
@@ -225,6 +232,10 @@ export class FileSystem extends Resource implements IFileSystem {
    */
   public readonly fileSystemId: string;
 
+  public readonly mountTargetsAvailable: IDependable;
+
+  private readonly _mountTargetsAvailable = new ConcreteDependable();
+
   /**
    * Constructor for creating a new EFS FileSystem.
    */
@@ -263,15 +274,18 @@ export class FileSystem extends Resource implements IFileSystem {
 
     // We now have to create the mount target for each of the mentioned subnet
     let mountTargetCount = 0;
+    this.mountTargetsAvailable = [];
     subnets.subnetIds.forEach((subnetId: string) => {
-      new CfnMountTarget(this,
+      const mountTarget = new CfnMountTarget(this,
         'EfsMountTarget' + (++mountTargetCount),
         {
           fileSystemId: this.fileSystemId,
           securityGroups: Array.of(securityGroup.securityGroupId),
           subnetId,
         });
+      this._mountTargetsAvailable.add(mountTarget);
     });
+    this.mountTargetsAvailable = this._mountTargetsAvailable;
   }
 
   /**

packages/@aws-cdk/aws-lambda/README.md

@@ -277,6 +277,48 @@ correct log retention period (never expire, by default).
 *Further note* that, if the log group already exists and the `logRetention` is not set, the custom resource will reset
 the log retention to never expire even if it was configured with a different value.
 
+### FileSystem Access
+
+You can configure a function to mount an Amazon Elastic File System (Amazon EFS) to a
+directory in your runtime environment with the `filesystems` property. To access Amaozn EFS
+from lambda function, the Amazon EFS access point will be required. 
+
+The following sample allows the lambda function to mount the Amazon EFS access point to `/mnt/msg` in the runtime environment and access the filesystem with the POSIX identity defined in `posixUser`.
+
+```ts
+// create a new Amaozn EFS filesystem
+const fileSystem = new efs.FileSystem(stack, 'Efs', { vpc });
+
+// create a new access point from the filesystem
+const accessPoint = fileSystem.addAccessPoint('AccessPoint', {
+  // set /export/lambda as the root of the access point
+  path: '/export/lambda',
+  // as /export/lambda does not exist in a new efs filesystem, the efs will create the directory with the following createAcl
+  createAcl: {
+    ownerUid: '1001',
+    ownerGid: '1001',
+    permissions: '750',
+  },
+  // enforce the POSIX identity so lambda function will access with this identity
+  posixUser: {
+    uid: '1001',
+    gid: '1001',
+  },
+});
+
+const fn = new lambda.Function(stack, 'MyLambda', {
+  code,
+  handler,
+  runtime,
+  vpc,
+  filesystems: [
+    // mount the access point to /mnt/msg in the lambda runtime enironment
+    lambda.FileSystem.fromEfsAccessPoint(accessPoint, '/mnt/msg'),
+  ],
+});
+```
+
+
 ### Singleton Function
 
 The `SingletonFunction` construct is a way to guarantee that a lambda function will be guaranteed to be part of the stack,

packages/@aws-cdk/aws-lambda/lib/filesystem.ts

@@ -0,0 +1,68 @@
+import { Connections } from '@aws-cdk/aws-ec2';
+import * as efs from '@aws-cdk/aws-efs';
+import { IDependable } from '@aws-cdk/core';
+
+/**
+ * FileSystem configurations for the Lambda function
+ * @experimental
+ */
+export interface FileSystemConfig {
+  /**
+   * mount path in the lambda runtime environment
+   */
+  readonly localMountPath: string;
+
+  /**
+   * ARN of the access point
+   */
+  readonly arn: string;
+
+  /**
+   * array of IDependable that lambda function depends on
+   *
+   * @default - no dependency
+   */
+  readonly dependency?: IDependable[]
+
+  /**
+   * connections object used to allow ingress traffic from lambda function
+   *
+   * @default - no connections required to add extra ingress rules for Lambda function
+   */
+  readonly connections?: Connections;
+
+  /**
+   * additional managed policies required for the lambda function
+   *
+   * @default - no additional policies required
+   */
+  readonly managedPolicies?: string[]
+}
+
+/**
+ * Represents the filesystem for the Lambda function
+ * @experimental
+ */
+export class FileSystem {
+  /**
+   * mount the filesystem from Amazon EFS
+   * @param ap the Amazon EFS access point
+   * @param mountPath the target path in the lambda runtime environment
+   */
+  public static fromEfsAccessPoint(ap: efs.AccessPoint, mountPath: string): FileSystem {
+    return new FileSystem({
+      localMountPath: mountPath,
+      arn: ap.accessPointArn,
+      dependency: [ ap.fileSystem.mountTargetsAvailable ],
+      connections: ap.fileSystem.connections,
+      managedPolicies: [
+        'AmazonElasticFileSystemClientFullAccess',
+      ],
+    });
+  }
+
+  /**
+   * @param config the FileSystem configurations for the Lambda function
+   */
+  protected constructor(public readonly config: FileSystemConfig) { }
+}

packages/@aws-cdk/aws-lambda/lib/function.ts

@@ -7,6 +7,7 @@ import { CfnResource, Construct, Duration, Fn, Lazy, Stack } from '@aws-cdk/core
 import { Code, CodeConfig } from './code';
 import { EventInvokeConfigOptions } from './event-invoke-config';
 import { IEventSource } from './event-source';
+import { FileSystem } from './filesystem';
 import { FunctionAttributes, FunctionBase, IFunction } from './function-base';
 import { calculateFunctionHash, trimFromStart } from './function-hash';
 import { Version, VersionOptions } from './lambda-version';
@@ -274,6 +275,13 @@ export interface FunctionProps extends FunctionOptions {
    * the handler.
    */
   readonly handler: string;
+
+  /**
+   * The filesystem configuration for the lambda function
+   *
+   * @default - will not mount any filesystem
+   */
+  readonly filesystems?: FileSystem[];
 }
 
 /**
@@ -460,6 +468,8 @@ export class Function extends FunctionBase {
 
   protected readonly canCreatePermissions = true;
 
+  protected readonly filesystems: FileSystem[] = [];
+
   private readonly layers: ILayerVersion[] = [];
 
   private _logGroup?: logs.ILogGroup;
@@ -489,6 +499,21 @@ export class Function extends FunctionBase {
       managedPolicies.push(iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole'));
     }
 
+    // add additonal managed policies when necessary
+    if (props.filesystems) {
+      const pushedPolicy: string[] = [];
+      for (const fs of props.filesystems) {
+        if (fs.config.managedPolicies) {
+          fs.config.managedPolicies.forEach(p => {
+            if (pushedPolicy.indexOf(p) === -1) {
+              managedPolicies.push(iam.ManagedPolicy.fromAwsManagedPolicyName(p));
+              pushedPolicy.push(p);
+            }
+          });
+        }
+      }
+    }
+
     this.role = props.role || new iam.Role(this, 'ServiceRole', {
       assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
       managedPolicies,
@@ -570,6 +595,26 @@ export class Function extends FunctionBase {
     }
 
     this.currentVersionOptions = props.currentVersionOptions;
+
+    if (props.filesystems) {
+      // max 1 filesystem allowed
+      if (props.filesystems.length > 1) {
+        throw new Error('max 1 filesystem allowed');
+      }
+
+      for (const fs of props.filesystems) {
+        // add dependency when necessary
+        if (fs.config.dependency) {
+          this.node.addDependency(...fs.config.dependency);
+        }
+      }
+
+      resource.addPropertyOverride('FileSystemConfigs',
+        props.filesystems.map(fs => ({
+          LocalMountPath: fs.config.localMountPath,
+          Arn: fs.config.arn,
+        })));
+    }
   }
 
   /**
@@ -701,7 +746,7 @@ export class Function extends FunctionBase {
     // sort environment so the hash of the function used to create
     // `currentVersion` is not affected by key order (this is how lambda does
     // it).
-    const variables: { [key: string]: string } = { };
+    const variables: { [key: string]: string } = {};
     for (const key of Object.keys(this.environment).sort()) {
       variables[key] = this.environment[key];
     }
@@ -745,6 +790,15 @@ export class Function extends FunctionBase {
 
     this._connections = new ec2.Connections({ securityGroups });
 
+    if (props.filesystems) {
+      for (const fs of props.filesystems) {
+        // add an ingress rule from the filesystem security group to allow ingress traffic from the lambda function
+        if (fs.config.connections) {
+          fs.config.connections.allowDefaultPortFrom(this);
+        }
+      }
+    }
+
     // Pick subnets, make sure they're not Public. Routing through an IGW
     // won't work because the ENIs don't get a Public IP.
     // Why are we not simply forcing vpcSubnets? Because you might still be choosing
@@ -841,4 +895,4 @@ export function verifyCodeConfig(code: CodeConfig, runtime: Runtime) {
   if (code.inlineCode && !runtime.supportsInlineCode) {
     throw new Error(`Inline source not allowed for ${runtime.name}`);
   }
-}
+}

packages/@aws-cdk/aws-lambda/lib/index.ts

@@ -6,6 +6,7 @@ export * from './layers';
 export * from './permission';
 export * from './runtime';
 export * from './code';
+export * from './filesystem';
 export * from './lambda-version';
 export * from './singleton-lambda';
 export * from './event-source';

packages/@aws-cdk/aws-lambda/package.json

@@ -85,6 +85,7 @@
   "dependencies": {
     "@aws-cdk/aws-cloudwatch": "0.0.0",
     "@aws-cdk/aws-ec2": "0.0.0",
+    "@aws-cdk/aws-efs": "0.0.0",
     "@aws-cdk/aws-events": "0.0.0",
     "@aws-cdk/aws-iam": "0.0.0",
     "@aws-cdk/aws-logs": "0.0.0",
@@ -99,6 +100,7 @@
   "peerDependencies": {
     "@aws-cdk/aws-cloudwatch": "0.0.0",
     "@aws-cdk/aws-ec2": "0.0.0",
+    "@aws-cdk/aws-efs": "0.0.0",
     "@aws-cdk/aws-events": "0.0.0",
     "@aws-cdk/aws-iam": "0.0.0",
     "@aws-cdk/aws-logs": "0.0.0",