Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(lambda): add removalPolicy option to LayerVersionPermission #30578

Closed

Conversation

lewesche
Copy link

@lewesche lewesche commented Jun 17, 2024

Issue # (if applicable)

Closes #30686.

Reason for this change

My use case involves publishing a lambda layer consumed by a library. Users may be on different library versions, meaning they may be on different layer versions. These users need to be able to access the layer from different accounts across my organization.

At first I added resource permissions to the layer by calling ILayerVersion.addPermission(). However I noticed that when new layers were published, old layers lost their resource permissions. I confirmed this with the cli: aws lambda get-layer-version-policy --layer-name ... --version-number ....

Looking at the I was able to fix the behavior by manually constructing the CfnLayerVersionPermission instead of using the top level addPermission() function:

    const orgPermission = new CfnLayerVersionPermission(this, "qualtricsOrgPermissionAmd64", {
      action: 'lambda:GetLayerVersion',
      layerVersionArn: lambdaLayer.layerVersionArn,
      principal: '*',
      organizationId: constants.ORG_ID,
    });
    orgPermission.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);

This added "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" to the cloud formation template (according to this documentation, both are required). That fixed my issue but it's an ugly solution that was difficult to come up with. I'd like to be able to use addPermission()

Description of changes

I changed LayerVersionPermission to take a optional RemovalPolicy.

Description of how you validated changes

Easy to validate with unit tests

Checklist


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@github-actions github-actions bot added p2 beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK labels Jun 17, 2024
@aws-cdk-automation aws-cdk-automation requested a review from a team June 17, 2024 23:20
Copy link
Collaborator

@aws-cdk-automation aws-cdk-automation left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

@lewesche lewesche changed the title feat(aws-lambda): add removalPolicy option to LayerVersionPermission feat(lambda): add removalPolicy option to LayerVersionPermission Jun 17, 2024
@lewesche
Copy link
Author

I'd like to request a Exemption Request or Clarification Request on the integration tests - I'm having trouble getting those to run and generate a new snapshot.

If I could get help with those, or a excemption since this change is pretty simple, that'd be great :) Thanks!

@aws-cdk-automation aws-cdk-automation added pr/reviewer-clarification-requested The contributor has requested clarification on feedback, a failing build, or a failing PR Linter run pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. labels Jun 21, 2024
@github-actions github-actions bot added the feature-request A feature should be added or improved. label Jun 26, 2024
@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 786668c
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@aws-cdk-automation aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Jun 26, 2024
@aws-cdk-automation
Copy link
Collaborator

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. To keep this PR from being closed, please continue work on it. If not, it will automatically be closed in a week.

@aws-cdk-automation
Copy link
Collaborator

This PR has been deemed to be abandoned, and will be automatically closed. Please create a new PR for these changes if you think this decision has been made in error.

@aws-cdk-automation aws-cdk-automation added the closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. label Jul 16, 2024
@aws-cdk-automation
Copy link
Collaborator

The pull request linter fails with the following errors:

❌ Features must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

✅ A exemption request has been requested. Please wait for a maintainer's review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK closed-for-staleness This issue was automatically closed because it hadn't received any attention in a while. feature-request A feature should be added or improved. p2 pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. pr/reviewer-clarification-requested The contributor has requested clarification on feedback, a failing build, or a failing PR Linter run pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

lambda: add removalPolicy option to LayerVersionPermission
3 participants