Skip to content

Commit 1ecb947

Browse files
committed
Add resource-based permissions support for Lambda aliases
this commit adds support for managing Lambda resource based permissions directly on aliases. Now users can declaratively define, update, and remove permissions for Lambda functions accessed through aliases. The implementation leverages the AWS::Lambda `AddPermission` and `RemovePermission` APIs to synchronize the desired permissions state defined in the CRD with the actual alias permisions in AWS.
1 parent 731aff1 commit 1ecb947

18 files changed

+747
-95
lines changed
Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
ack_generate_info:
2-
build_date: "2025-02-20T18:13:42Z"
3-
build_hash: a326346bd3a6973254d247c9ab2dc76790c36241
2+
build_date: "2025-03-25T01:17:53Z"
3+
build_hash: 3722729cebe6d3c03c7e442655ef0846f91566a2
44
go_version: go1.24.0
5-
version: v0.43.2
6-
api_directory_checksum: 086df7708184fcedddb2910d4980cdff3bf9de8f
5+
version: v0.43.2-7-g3722729
6+
api_directory_checksum: b37edb8bba9d3847d4bdf1e842b7a597821c8c37
77
api_version: v1alpha1
88
aws_sdk_go_version: v1.32.6
99
generator_config_info:
10-
file_checksum: 7e92f95044b114e8b39e4b28ea82afbdc992a3cb
10+
file_checksum: 724cd3123b18f9c38b661085bdb33aaae1ac0b14
1111
original_file_name: generator.yaml
1212
last_modification:
1313
reason: API generation

apis/v1alpha1/alias.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

apis/v1alpha1/generator.yaml

Lines changed: 37 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -7,65 +7,67 @@ ignore:
77
# FunctionUrlConfig
88
# LayerVersion
99
field_paths:
10-
- CreateCodeSigningConfigInput.Tags
11-
- CreateEventSourceMappingInput.DocumentDBEventSourceConfig
12-
- CreateEventSourceMappingInput.KMSKeyArn
13-
- CreateEventSourceMappingInput.MetricsConfig
14-
- CreateEventSourceMappingInput.ProvisionedPollerConfig
15-
- CreateEventSourceMappingInput.Tags
16-
- CreateEventSourceMappingOutput.FilterCriteriaError
17-
- CreateEventSourceMappingOutput.DocumentDBEventSourceConfig
18-
- CreateEventSourceMappingOutput.KMSKeyArn
19-
- CreateEventSourceMappingOutput.MetricsConfig
20-
- CreateEventSourceMappingOutput.ProvisionedPollerConfig
21-
- FunctionCode.SourceKMSKeyArn
22-
- CreateFunctionInput.LoggingConfig
23-
- CreateFunctionOutput.RuntimeVersionConfig
24-
- CreateFunctionOutput.LoggingConfig
25-
- CreateFunctionUrlConfigInput.InvokeMode
26-
- CreateFunctionUrlConfigOutput.InvokeMode
27-
- PublishVersionOutput.LoggingConfig
28-
- PublishVersionOutput.RuntimeVersionConfig
29-
- VpcConfig.Ipv6AllowedForDualStack
10+
- CreateCodeSigningConfigInput.Tags
11+
- CreateEventSourceMappingInput.DocumentDBEventSourceConfig
12+
- CreateEventSourceMappingInput.KMSKeyArn
13+
- CreateEventSourceMappingInput.MetricsConfig
14+
- CreateEventSourceMappingInput.ProvisionedPollerConfig
15+
- CreateEventSourceMappingInput.Tags
16+
- CreateEventSourceMappingOutput.FilterCriteriaError
17+
- CreateEventSourceMappingOutput.DocumentDBEventSourceConfig
18+
- CreateEventSourceMappingOutput.KMSKeyArn
19+
- CreateEventSourceMappingOutput.MetricsConfig
20+
- CreateEventSourceMappingOutput.ProvisionedPollerConfig
21+
- FunctionCode.SourceKMSKeyArn
22+
- CreateFunctionInput.LoggingConfig
23+
- CreateFunctionOutput.RuntimeVersionConfig
24+
- CreateFunctionOutput.LoggingConfig
25+
- CreateFunctionUrlConfigInput.InvokeMode
26+
- CreateFunctionUrlConfigOutput.InvokeMode
27+
- PublishVersionOutput.LoggingConfig
28+
- PublishVersionOutput.RuntimeVersionConfig
29+
- VpcConfig.Ipv6AllowedForDualStack
30+
- AddPermissionInput.FunctionName # We grab this from the Alias resource
31+
- AddPermissionInput.Qualifier # We grab this from the Alias resource
3032
operations:
3133
GetFunction:
3234
output_wrapper_field_path: Configuration
3335
PublishLayerVersion:
3436
operation_type:
3537
- Create
3638
- Update
37-
resource_name:
39+
resource_name:
3840
- LayerVersion
3941
PublishVersion:
4042
operation_type:
4143
- Create
42-
resource_name:
44+
resource_name:
4345
- Version
4446
GetFunctionConfiguration:
4547
operation_type:
4648
- ReadOne
47-
resource_name:
49+
resource_name:
4850
- Version
4951
DeleteFunction:
5052
operation_type:
5153
- Delete
52-
resource_name:
54+
resource_name:
5355
- Version
5456
- Function
5557
resources:
5658
Function:
5759
synced:
5860
when:
5961
- path: Status.State
60-
in: [ "Active" ]
62+
in: ["Active"]
6163
fields:
6264
Code.SHA256:
6365
type: string
6466
compare:
6567
is_ignored: true
6668
set:
67-
- ignore: "to"
68-
method: Create
69+
- ignore: "to"
70+
method: Create
6971
Code.S3Bucket:
7072
references:
7173
resource: Bucket
@@ -161,7 +163,14 @@ resources:
161163
from:
162164
operation: PutProvisionedConcurrencyConfig
163165
path: .
166+
Permissions:
167+
custom_field:
168+
list_of: AddPermissionInput
169+
compare:
170+
is_ignored: true
164171
hooks:
172+
delta_pre_compare:
173+
code: customPreCompare(delta, a, b)
165174
sdk_update_pre_build_request:
166175
template_path: hooks/alias/sdk_update_pre_build_request.go.tpl
167176
sdk_read_one_post_set_output:
@@ -288,4 +297,4 @@ resources:
288297
Qualifier: Version
289298
GetFunctionConfiguration:
290299
input_fields:
291-
Qualifier: Version
300+
Qualifier: Version

apis/v1alpha1/types.go

Lines changed: 12 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

apis/v1alpha1/zz_generated.deepcopy.go

Lines changed: 71 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

config/crd/bases/lambda.services.k8s.aws_aliases.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,31 @@ spec:
132132
name:
133133
description: The name of the alias.
134134
type: string
135+
permissions:
136+
description: Permissions configures a set of Lambda permissions to
137+
grant to an alias.
138+
items:
139+
properties:
140+
action:
141+
type: string
142+
eventSourceToken:
143+
type: string
144+
functionURLAuthType:
145+
type: string
146+
principal:
147+
type: string
148+
principalOrgID:
149+
type: string
150+
revisionID:
151+
type: string
152+
sourceARN:
153+
type: string
154+
sourceAccount:
155+
type: string
156+
statementID:
157+
type: string
158+
type: object
159+
type: array
135160
provisionedConcurrencyConfig:
136161
description: |-
137162
Configures provisioned concurrency to a function's alias

documentation.yaml

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ resources:
44
FunctionEventInvokeConfig:
55
prepend: |
66
Configures options for asynchronous invocation on a function.
7-
7+
88
- DestinationConfig
99
A destination for events after they have been sent to a function for processing.
1010
@@ -13,18 +13,20 @@ resources:
1313
Queue - The ARN of a standard SQS queue.
1414
Topic - The ARN of a standard SNS topic.
1515
Event Bus - The ARN of an Amazon EventBridge event bus.
16-
16+
1717
- MaximumEventAgeInSeconds
1818
The maximum age of a request that Lambda sends to a function for processing.
19-
19+
2020
- MaximumRetryAttempts
2121
The maximum number of times to retry when the function returns an error.
2222
Alias:
2323
fields:
24+
Permissions:
25+
prepend: Permissions configures a set of Lambda permissions to grant to an alias.
2426
FunctionEventInvokeConfig:
2527
prepend: |
2628
Configures options for asynchronous invocation on an alias.
27-
29+
2830
- DestinationConfig
2931
A destination for events after they have been sent to a function for processing.
3032
@@ -36,14 +38,14 @@ resources:
3638
3739
- MaximumEventAgeInSeconds
3840
The maximum age of a request that Lambda sends to a function for processing.
39-
41+
4042
- MaximumRetryAttempts
4143
The maximum number of times to retry when the function returns an error.
42-
44+
4345
ProvisionedConcurrencyConfig:
4446
prepend: |
4547
Configures provisioned concurrency to a function's alias
4648
4749
- ProvisionedConcurrentExecutions
4850
The amount of provisioned concurrency to allocate for the version or alias.
49-
Minimum value of 1 is required
51+
Minimum value of 1 is required

0 commit comments

Comments
 (0)