fix(lambda): imported Function still has region and account from its Stack, instead of its ARN #18255

skinny85 · 2022-01-03T23:41:54Z

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

gitpod-io · 2022-01-03T23:41:56Z

…Stack, instead of its ARN Fixes aws#18228

kaizencc

mergify · 2022-01-04T15:39:33Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2022-01-04T18:17:21Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
Commit ID: 7c4b136
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2022-01-04T18:18:02Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

jhoscar1 · 2022-01-06T15:12:11Z

@skinny85 I'm seeing that this was released in the 2.x version of cdk. Is it possible to get this released in 1.x or is there a plan to?

skinny85 · 2022-01-06T19:44:33Z

@jhoscar1 looks like this just barely missed the release window for v1.138.0. There will be a new release (v1.139.0) next week, and then this will be included in that one for sure.

jhoscar1 · 2022-01-06T19:55:22Z

Great, thanks!

glc-gplassard · 2022-01-12T09:47:47Z

Hello, I think this breaks some of my usages when used in conjunction with cdk.ScopedAws & the aws-events package (at least in unit tests)

const lambdaFunction = lambda.Function.fromFunctionArn(this, 'Lambda', `arn:aws:lambda:${new cdk.ScopedAws(this).region}:${new cdk.ScopedAws(this).accountId}:function:${functionName}`);

const pipeline = new codepipeline.Pipeline(this, 'Codepipeline', {
      artifactBucket: "",
      pipelineName: "pipeline"
    });

pipeline.onStateChange('Notify', {target: new eventsTarget.LambdaFunction(lambdaFunction)});

Cannot create a cross-account or cross-region rule for an imported resource (create a stack with the right environment for the imported resource)
      at Rule.obtainMirrorRuleScope (node_modules/@aws-cdk/aws-events/lib/rule.ts:326:11)
      at Rule.addTarget (node_modules/@aws-cdk/aws-events/lib/rule.ts:170:38)
      at Pipeline.onEvent (node_modules/@aws-cdk/aws-codepipeline/lib/pipeline.ts:91:10)
      at Pipeline.onStateChange (node_modules/@aws-cdk/aws-codepipeline/lib/pipeline.ts:101:23)

It used to work with cdk 1.138.0

I can try to create a clean reproducer if you want

EDIT : or maybe I'm using it wrong

skinny85 · 2022-01-12T20:07:37Z

@cbm-gplassard when you say this used to work, do you mean it used to synth / deploy in the previous CDK version, or do you mean it deployed, and the Function was actually invoked each time the pipeline's state changed? Because I have a feeling that wouldn't work anyway in the old version of the CDK.

glc-gplassard · 2022-01-13T09:48:08Z

Hello @skinny85 ,
the stack was deployed & the function was correctly invoked.

I created a sample reproducer stack : https://github.com/cbm-gplassard/cdk-lambda-events-reproducer (one branch with cdk 1.138.0 and another with 1.139.0)

skinny85 · 2022-01-13T20:21:15Z

@cbm-gplassard I wonder - are you experiencing the same issue as described in #18405?

If so, can we consolidate the conversation there?

glc-gplassard · 2022-01-14T08:42:47Z

Seems like the same issue, indeed! 👍

After aws#18255 has been merged, the account and region of the Function's imported ARN is correctly recognized. Unfortunately, this has surfaced a few cases where that causes problems, like when using an imported Function as the target of a CodePipeline invoke Action (the pipeline construct needs to verify that the target Function is in the same account and region as the pipeline). Add a `Function.fromFunctionName()` method that allows you to import a Function in the same account and region. Fixes aws#19031

After #18255 has been merged, the account and region of the Function's imported ARN is correctly recognized. Unfortunately, this has surfaced a few cases where that causes problems, like when using an imported Function as the target of a CodePipeline invoke Action (the pipeline construct needs to verify that the target Function is in the same account and region as the pipeline). Add a `Function.fromFunctionName()` method that allows you to import a Function in the same account and region. Fixes #19031 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…Stack, instead of its ARN (aws#18255) Fixes aws#18228 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

After aws#18255 has been merged, the account and region of the Function's imported ARN is correctly recognized. Unfortunately, this has surfaced a few cases where that causes problems, like when using an imported Function as the target of a CodePipeline invoke Action (the pipeline construct needs to verify that the target Function is in the same account and region as the pipeline). Add a `Function.fromFunctionName()` method that allows you to import a Function in the same account and region. Fixes aws#19031 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Fixes #21464. KMS keys imported using `fromKeyArn()` currently take the environment of the stack, not the environment from the arn. This PR follows the precedent set in #19026 and #18255. It is essentially the same code change and tests. Ideally, we would have a mechanism for testing all `fromXxxArn` APIs to ensure they have the correct behavior. There are still many places where it does not. However, given the significant overhead of creating such a mechanism, I'm creating this one-off PR to unblock users in KMS. ---- ### All Submissions: * [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Fixes aws#21464. KMS keys imported using `fromKeyArn()` currently take the environment of the stack, not the environment from the arn. This PR follows the precedent set in aws#19026 and aws#18255. It is essentially the same code change and tests. Ideally, we would have a mechanism for testing all `fromXxxArn` APIs to ensure they have the correct behavior. There are still many places where it does not. However, given the significant overhead of creating such a mechanism, I'm creating this one-off PR to unblock users in KMS. ---- ### All Submissions: * [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

github-actions bot added the @aws-cdk/aws-lambda Related to AWS Lambda label Jan 3, 2022

github-actions bot assigned kaizencc Jan 3, 2022

mergify bot added the contribution/core This is a PR that came from AWS. label Jan 3, 2022

skinny85 force-pushed the lambda-import-region-from-arn branch 2 times, most recently from b862ef3 to 3773c09 Compare January 4, 2022 01:47

fix(lambda): imported Function still has region and account from its …

15a0718

…Stack, instead of its ARN Fixes aws#18228

skinny85 force-pushed the lambda-import-region-from-arn branch from 3773c09 to 15a0718 Compare January 4, 2022 03:24

kaizencc approved these changes Jan 4, 2022

View reviewed changes

Merge branch 'master' into lambda-import-region-from-arn

7c4b136

mergify bot merged commit 01bbe4c into aws:master Jan 4, 2022

skinny85 deleted the lambda-import-region-from-arn branch January 4, 2022 20:54

glc-gplassard mentioned this pull request Jan 14, 2022

(aws-events): Cross Stack Rule Requires Concrete Account #18405

Closed

This was referenced Feb 14, 2022

(lambda): cross account lambda resolvers can not be created #18781

Closed

fix(lambda): unlock use case for cross-account functions w/ preconfigured permissions #18979

Merged

skinny85 mentioned this pull request Feb 18, 2022

(codepipeline): Error: The 'account' property must be a concrete value #19031

Closed

skinny85 mentioned this pull request Feb 21, 2022

feat(lambda): add a fromFunctionName() method #19076

Merged

cgarvis mentioned this pull request Mar 17, 2022

feat(aws-codepipeline-actions): Added region as prop of LambdaInvokeAction #18229

Closed

kaizencc mentioned this pull request Aug 9, 2022

fix(kms): imported key ignores environment from arn #21519

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(lambda): imported Function still has region and account from its Stack, instead of its ARN #18255

fix(lambda): imported Function still has region and account from its Stack, instead of its ARN #18255

skinny85 commented Jan 3, 2022

gitpod-io bot commented Jan 3, 2022

kaizencc left a comment

mergify bot commented Jan 4, 2022

aws-cdk-automation commented Jan 4, 2022

mergify bot commented Jan 4, 2022

jhoscar1 commented Jan 6, 2022

skinny85 commented Jan 6, 2022

jhoscar1 commented Jan 6, 2022

glc-gplassard commented Jan 12, 2022 •

edited

skinny85 commented Jan 12, 2022

glc-gplassard commented Jan 13, 2022

skinny85 commented Jan 13, 2022

glc-gplassard commented Jan 14, 2022

fix(lambda): imported Function still has region and account from its Stack, instead of its ARN #18255

fix(lambda): imported Function still has region and account from its Stack, instead of its ARN #18255

Conversation

skinny85 commented Jan 3, 2022

gitpod-io bot commented Jan 3, 2022

kaizencc left a comment

Choose a reason for hiding this comment

mergify bot commented Jan 4, 2022

aws-cdk-automation commented Jan 4, 2022

AWS CodeBuild CI Report

mergify bot commented Jan 4, 2022

jhoscar1 commented Jan 6, 2022

skinny85 commented Jan 6, 2022

jhoscar1 commented Jan 6, 2022

glc-gplassard commented Jan 12, 2022 • edited

skinny85 commented Jan 12, 2022

glc-gplassard commented Jan 13, 2022

skinny85 commented Jan 13, 2022

glc-gplassard commented Jan 14, 2022

glc-gplassard commented Jan 12, 2022 •

edited