aws-amplify / aws-amplify/amplify-cli

(gen2-migration) `generate` command should handle function to function access

Open
#14,574 1 comment 0 reactions 1 assignee Claimed by @sarayev View on GitHub
gen2-migration p2
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### Is this feature request related to a new or existing Amplify category?

_No response_

### Is this related to another service?

_No response_

### Describe the feature you'd like to request

In Gen1 functions can be configured to access other functions. For example:

```console
? Do you want to configure advanced settings? Yes
? Do you want to access other resources in this project from your Lambda function? Yes
? Select the categories you want this function to have access to. function
? Select the operations you want to permit on quotegenerator create, read, update, delete

You can access the following resource attributes as environment variables from your Lambda function
ENV
FUNCTION_QUOTEGENERATOR_NAME
REGION
```

The generated Gen2 code should configure and allow the same access.

### Describe the solution you'd like

Internally, this creates the following relevant parts in the CFN template:

**IAM Permissions:**

```json
"AmplifyResourcesPolicy": {
"DependsOn": ["LambdaExecutionRole"],
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyName": "amplify-lambda-execution-policy",
"Roles": [{ "Ref": "LambdaExecutionRole" }],
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [{"Effect":"Allow","Action":["lambda:Create*","lambda:Put*","lambda:Add*","lambda:Get*","lambda:List*","lambda:Invoke*","lambda:Update*","lambda:Delete*","lambda:Remove*"],"Resource":[{"Fn::Join":["",["arn:aws:lambda:",{"Ref":"AWS::Region"},":",{"Ref":"AWS::AccountId"},":function:",{"Ref":"functionquotegeneratorName"}]]}]}]
}
}
}
```

**Environment Variable:**

```json
"Environment": {
"Variables" : {"ENV":{"Ref":"env"},"REGION":{"Ref":"AWS::Region"},"FUNCTION_QUOTEGENERATOR_NAME":{"Ref":"functionquotegeneratorName"}}
},
```

The `generate` command should inspect this template (similarly to what it does for other function access types) and generate the following code:

```ts
// environment variable
backend.functionA.addEnvironment('FUNCTION_FUNCTIONB_NAME', backend.functionB.resources.lambda.functionName);

// permissions
backend.functionA.resources.lambda.addToRolePolicy(new aws_iam.PolicyStatement({
actions: ["lambda:Create*", "lambda:Put*", "lambda:Add*", "lambda:Get*", "lambda:List*", "lambda:Invoke*", "lambda:Update*", "lambda:Delete*", "lambda:Remove*"],
resources: [backend.functionB.resources.lambda.functionArn]
}))
```

### Describe alternatives you've considered

None

### Additional context

_No response_

### Is this something that you'd be interested in working on?

- [ ] 👋 I may be able to implement this feature request

### Would this feature include a breaking change?

- [ ] ⚠️ This feature might incur a breaking change

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.