aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[Resource Type] - [BUG] - Lambda Ref sometimes returns ARN
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::Lambda::Function
### Resource Name
_No response_
### Issue Description
When I set the FunctionName with a full ARN, the Ref function returns the full ARN.
[Lambda Ref doc](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-function.html): When you pass the logical ID of this resource to the intrinsic `Ref` function, `Ref` returns the **resource name**.
The [Lambda CreateFunction API](https://docs.aws.amazon.com/lambda/latest/api/API_CreateFunction.html) allows setting the function name using
* just the name (`my-function`)
* the full ARN (`arn:aws:lambda:us-west-2:123456789012:function:my-function`)
* a partial ARN (`123456789012:function:my-function`) (didn't test this format)
The [FunctionName property](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-function.html#cfn-lambda-function-functionname) of the AWS::Lambda::Function resource also accepts the full ARN.
### Expected Behavior
Expected output from Rain:
```
Deploying template 'repro.cfn.yml' as stack 'repro-cfn' in eu-central-1.
Stack repro-cfn: CREATE_COMPLETE
Outputs:
CreatedWithNameName: CreatedWithName
CreatedWithArnName: CreatedWithArn
CreateWithNameArn: arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithName
CreateWithArnArn: arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithArn
Successfully deployed repro-cfn
```
### Observed Behavior
Observed output from Rain:
```
Deploying template 'repro.cfn.yml' as stack 'repro-cfn' in eu-central-1.
Stack repro-cfn: CREATE_COMPLETE
Outputs:
CreatedWithNameName: CreatedWithName
CreatedWithArnName: arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithArn
CreateWithNameArn: arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithName
CreateWithArnArn: arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithArn
Successfully deployed repro-cfn
```
Here the `CreatedWithArnName` value is wrong: It should be `CreatedWithArn`.
### Test Cases
Repro template:
```yaml
Resources:
CreatedWithArn:
Type: AWS::Lambda::Function
Properties:
FunctionName: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CreatedWithArn
Role: !GetAtt PlaceholderRole.Arn
Handler: index.lambda_handler
Runtime: python3.13
Code:
ZipFile: |
def lambda_handler(event, context):
print(event)
CreatedWithName:
Type: AWS::Lambda::Function
Properties:
FunctionName: CreatedWithName
Role: !GetAtt PlaceholderRole.Arn
Handler: index.lambda_handler
Runtime: python3.13
Code:
ZipFile: |
def lambda_handler(event, context):
print(event)
PlaceholderRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: sts:AssumeRole
Principal:
Service: lambda.amazonaws.com
Outputs:
CreatedWithArnName:
Value: !Ref CreatedWithArn
CreateWithArnArn:
Value: !GetAtt CreatedWithArn.Arn
CreatedWithNameName:
Value: !Ref CreatedWithName
CreateWithNameArn:
Value: !GetAtt CreatedWithName.Arn
```
Use Rain to deploy and capture output.
```bash
rain deploy --yes repro.cfn.yml
```
### Other Details
When would you ever want to set the function name using the full ARN? For convenience.
Here's my use case: I need to generate the function ARN to avoid a circular dependency becuase the function's execution policy refers to itself.
Other resources in the template need to refer to the function by ARN and by name. I chose to store the generated function ARN in an SSM parameter and used it to set the function name and the execution policy.
Then I tried to name a log group using an expression like `!Sub "/aws/lambda/${CreatedWithArn}"`, which implicitly uses the Ref value. The create operation failed with an error like this:
`Resource handler returned message: "1 validation error detected: Value '/aws/lambda/arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithArn' at 'logGroupName' failed to satisfy constraint: Member must satisfy regular expression pattern: [\.\-_/#A-Za-z0-9]+ (Service: CloudWatchLogs, Status Code: 400, Request ID: ...) (SDK Attempt Count: 1)" (RequestToken: ..., HandlerErrorCode: InvalidRequest)`
Contributor guide
Research direction
Start with the repro template described in the issue and run `rain deploy --yes repro.cfn.yml` to confirm the differing Ref outputs for the two FunctionName forms. Trace the AWS::Lambda::Function Ref handling, then verify that a full-ARN FunctionName still produces the function name while GetAtt Arn remains unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100