By continuing you indicate that you have read and agree to our Terms of service and Privacy policy
By continuing you indicate that you have read and agree to our Terms of service and Privacy policy
Popular New Releases in Web Services
0.75.2 | |
Release v1.46.0-pre2 | |
Release v2.0.2 | |
修复 沙箱 提权问题 |
| json-server |
| fastapi 0.75.2 |
| grpc Release v1.46.0-pre2 |
| beego Release v2.0.2 |
| yapi 修复 沙箱 提权问题 |
Popular Libraries in Web Services
Trending New libraries in Web Services
Top Authors in Web Services
1
74 Libraries
36551
2
68 Libraries
5760
3
62 Libraries
7019
4
54 Libraries
499
5
53 Libraries
496
6
51 Libraries
6560
7
48 Libraries
24620
8
46 Libraries
2982
9
43 Libraries
1972
10
42 Libraries
64677
1
74 Libraries
36551
2
68 Libraries
5760
3
62 Libraries
7019
4
54 Libraries
499
5
53 Libraries
496
6
51 Libraries
6560
7
48 Libraries
24620
8
46 Libraries
2982
9
43 Libraries
1972
10
42 Libraries
64677
Trending Kits in Web Services
Trending Discussions on Web Services
QUESTION
Deploy AWS Lambda with function URL via Cloudformation
Asked 2022-Apr-09 at 08:35Since a few days, AWS Lambdas can be exposed as web services directly without an API Gateway.
This works fine when setting up through the UI console, but I can’t seem to get it done with Cloudformation, because the resource policy is not attached with AuthType: NONE. And without the policy, I get "message": "Forbidden" from AWS when trying to access the Lambda through the function url.
My Lambda is the following:
1exports.handler = async event => {
2 return {
3 statusCode: 200,
4 body: JSON.stringify("Hello World")
5 }
6}
7and here’s the CFN template:
1exports.handler = async event => {
2 return {
3 statusCode: 200,
4 body: JSON.stringify("Hello World")
5 }
6}
7AWSTemplateFormatVersion: "2010-09-09"
8
9Parameters:
10 stackName:
11 Type: String
12 lambdaFile:
13 Type: String
14 lambdaBucket:
15 Type: String
16
17Resources:
18 lambdaRole:
19 Type: "AWS::IAM::Role"
20 Properties:
21 AssumeRolePolicyDocument:
22 Version: "2012-10-17"
23 Statement:
24 - Action:
25 - "sts:AssumeRole"
26 Effect: "Allow"
27 Principal:
28 Service:
29 - "lambda.amazonaws.com"
30 Policies:
31 - PolicyDocument:
32 Version: "2012-10-17"
33 Statement:
34 - Action:
35 - "logs:CreateLogGroup"
36 - "logs:CreateLogStream"
37 - "logs:PutLogEvents"
38 Effect: "Allow"
39 Resource:
40 - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${stackName}:*"
41 PolicyName: "lambda"
42
43 runtimeLambdaFunction:
44 Type: "AWS::Lambda::Function"
45 Properties:
46 Code:
47 S3Bucket: !Ref lambdaBucket
48 S3Key: !Ref lambdaFile
49 Environment:
50 Variables:
51 NODE_ENV: production
52 FunctionName: !Sub "${stackName}-runtime"
53 Handler: runtime.handler
54 MemorySize: 128
55 Role: !GetAtt lambdaRole.Arn
56 Runtime: "nodejs14.x"
57 Timeout: 5
58
59 lambdaLogGroup:
60 Type: "AWS::Logs::LogGroup"
61 Properties:
62 LogGroupName: !Sub "/aws/${stackName}"
63 RetentionInDays: 30
64
65 runtimeLambdaUrl:
66 Type: "AWS::Lambda::Url"
67 Properties:
68 AuthType: NONE
69 TargetFunctionArn: !Ref runtimeLambdaFunction
70
71Outputs:
72 runtimeLambdaUrl:
73 Value: !GetAtt runtimeLambdaUrl.FunctionUrl
74
75The interesting thing is that I can add the policy through the UI console, and then it works.
Here’s the initial config screen for the function URL right after CFN deployment:
This is what I see when pushing the “Edit” button:
After clicking “Save”, I get the following (note the blue box):
Also, when I go into “Edit” mode again, I now see the following:
After that, the function can be accessed via its URL.
I tried to add the policy into my CFN stack, either standalone as AWS::IAM::Policy, but then it is not a resource-based policy or as an additional action on the lambdaRole. But in either case, I can’t add a Principal and the policy doesn’t have an effect.
Does anybody know how I can make a pure Clouformation deployment for a Lambda with a function URL? Or is this a bug in Cloudformation and/or Lambda?
ANSWER
Answered 2022-Apr-09 at 08:35Your template is missing AWS::Lambda::Permission, thus its does not work. You already know what the permissions should be based on AWS console inspection, so you have to recreate those permissions using AWS::Lambda::Permission. This allows you to specify FunctionUrlAuthType.
Community Discussions contain sources that include Stack Exchange Network
QUESTION
Deploy AWS Lambda with function URL via Cloudformation
Asked 2022-Apr-09 at 08:35Since a few days, AWS Lambdas can be exposed as web services directly without an API Gateway.
This works fine when setting up through the UI console, but I can’t seem to get it done with Cloudformation, because the resource policy is not attached with AuthType: NONE. And without the policy, I get "message": "Forbidden" from AWS when trying to access the Lambda through the function url.
My Lambda is the following:
1exports.handler = async event => {
2 return {
3 statusCode: 200,
4 body: JSON.stringify("Hello World")
5 }
6}
7and here’s the CFN template:
1exports.handler = async event => {
2 return {
3 statusCode: 200,
4 body: JSON.stringify("Hello World")
5 }
6}
7AWSTemplateFormatVersion: "2010-09-09"
8
9Parameters:
10 stackName:
11 Type: String
12 lambdaFile:
13 Type: String
14 lambdaBucket:
15 Type: String
16
17Resources:
18 lambdaRole:
19 Type: "AWS::IAM::Role"
20 Properties:
21 AssumeRolePolicyDocument:
22 Version: "2012-10-17"
23 Statement:
24 - Action:
25 - "sts:AssumeRole"
26 Effect: "Allow"
27 Principal:
28 Service:
29 - "lambda.amazonaws.com"
30 Policies:
31 - PolicyDocument:
32 Version: "2012-10-17"
33 Statement:
34 - Action:
35 - "logs:CreateLogGroup"
36 - "logs:CreateLogStream"
37 - "logs:PutLogEvents"
38 Effect: "Allow"
39 Resource:
40 - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${stackName}:*"
41 PolicyName: "lambda"
42
43 runtimeLambdaFunction:
44 Type: "AWS::Lambda::Function"
45 Properties:
46 Code:
47 S3Bucket: !Ref lambdaBucket
48 S3Key: !Ref lambdaFile
49 Environment:
50 Variables:
51 NODE_ENV: production
52 FunctionName: !Sub "${stackName}-runtime"
53 Handler: runtime.handler
54 MemorySize: 128
55 Role: !GetAtt lambdaRole.Arn
56 Runtime: "nodejs14.x"
57 Timeout: 5
58
59 lambdaLogGroup:
60 Type: "AWS::Logs::LogGroup"
61 Properties:
62 LogGroupName: !Sub "/aws/${stackName}"
63 RetentionInDays: 30
64
65 runtimeLambdaUrl:
66 Type: "AWS::Lambda::Url"
67 Properties:
68 AuthType: NONE
69 TargetFunctionArn: !Ref runtimeLambdaFunction
70
71Outputs:
72 runtimeLambdaUrl:
73 Value: !GetAtt runtimeLambdaUrl.FunctionUrl
74
75The interesting thing is that I can add the policy through the UI console, and then it works.
Here’s the initial config screen for the function URL right after CFN deployment:
This is what I see when pushing the “Edit” button:
After clicking “Save”, I get the following (note the blue box):
Also, when I go into “Edit” mode again, I now see the following:
After that, the function can be accessed via its URL.
I tried to add the policy into my CFN stack, either standalone as AWS::IAM::Policy, but then it is not a resource-based policy or as an additional action on the lambdaRole. But in either case, I can’t add a Principal and the policy doesn’t have an effect.
Does anybody know how I can make a pure Clouformation deployment for a Lambda with a function URL? Or is this a bug in Cloudformation and/or Lambda?
ANSWER
Answered 2022-Apr-09 at 08:35Your template is missing AWS::Lambda::Permission, thus its does not work. You already know what the permissions should be based on AWS console inspection, so you have to recreate those permissions using AWS::Lambda::Permission. This allows you to specify FunctionUrlAuthType.