aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[Resource Type] - [BUG] - Lambda Ref sometimes returns ARN

Open
#2,436 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::Lambda::Function

### Resource Name

_No response_

### Issue Description

When I set the FunctionName with a full ARN, the Ref function returns the full ARN.

[Lambda Ref doc](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-function.html): When you pass the logical ID of this resource to the intrinsic `Ref` function, `Ref` returns the **resource name**.

The [Lambda CreateFunction API](https://docs.aws.amazon.com/lambda/latest/api/API_CreateFunction.html) allows setting the function name using

* just the name (`my-function`)
* the full ARN (`arn:aws:lambda:us-west-2:123456789012:function:my-function`)
* a partial ARN (`123456789012:function:my-function`) (didn't test this format)

The [FunctionName property](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-function.html#cfn-lambda-function-functionname) of the AWS::Lambda::Function resource also accepts the full ARN.

### Expected Behavior

Expected output from Rain:

```
Deploying template 'repro.cfn.yml' as stack 'repro-cfn' in eu-central-1.
Stack repro-cfn: CREATE_COMPLETE
Outputs:
CreatedWithNameName: CreatedWithName
CreatedWithArnName: CreatedWithArn
CreateWithNameArn: arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithName
CreateWithArnArn: arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithArn
Successfully deployed repro-cfn
```

### Observed Behavior

Observed output from Rain:

```
Deploying template 'repro.cfn.yml' as stack 'repro-cfn' in eu-central-1.
Stack repro-cfn: CREATE_COMPLETE
Outputs:
CreatedWithNameName: CreatedWithName
CreatedWithArnName: arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithArn
CreateWithNameArn: arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithName
CreateWithArnArn: arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithArn
Successfully deployed repro-cfn
```

Here the `CreatedWithArnName` value is wrong: It should be `CreatedWithArn`.

### Test Cases

Repro template:

```yaml
Resources:

CreatedWithArn:
Type: AWS::Lambda::Function
Properties:
FunctionName: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:CreatedWithArn
Role: !GetAtt PlaceholderRole.Arn
Handler: index.lambda_handler
Runtime: python3.13
Code:
ZipFile: |
def lambda_handler(event, context):
print(event)

CreatedWithName:
Type: AWS::Lambda::Function
Properties:
FunctionName: CreatedWithName
Role: !GetAtt PlaceholderRole.Arn
Handler: index.lambda_handler
Runtime: python3.13
Code:
ZipFile: |
def lambda_handler(event, context):
print(event)

PlaceholderRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: sts:AssumeRole
Principal:
Service: lambda.amazonaws.com

Outputs:

CreatedWithArnName:
Value: !Ref CreatedWithArn
CreateWithArnArn:
Value: !GetAtt CreatedWithArn.Arn

CreatedWithNameName:
Value: !Ref CreatedWithName
CreateWithNameArn:
Value: !GetAtt CreatedWithName.Arn
```

Use Rain to deploy and capture output.

```bash
rain deploy --yes repro.cfn.yml
```

### Other Details

When would you ever want to set the function name using the full ARN? For convenience.

Here's my use case: I need to generate the function ARN to avoid a circular dependency becuase the function's execution policy refers to itself.

Other resources in the template need to refer to the function by ARN and by name. I chose to store the generated function ARN in an SSM parameter and used it to set the function name and the execution policy.

Then I tried to name a log group using an expression like `!Sub "/aws/lambda/${CreatedWithArn}"`, which implicitly uses the Ref value. The create operation failed with an error like this:

`Resource handler returned message: "1 validation error detected: Value '/aws/lambda/arn:aws:lambda:eu-central-1:111111111111:function:CreatedWithArn' at 'logGroupName' failed to satisfy constraint: Member must satisfy regular expression pattern: [\.\-_/#A-Za-z0-9]+ (Service: CloudWatchLogs, Status Code: 400, Request ID: ...) (SDK Attempt Count: 1)" (RequestToken: ..., HandlerErrorCode: InvalidRequest)`

Contributor guide

Open the contributing guide

Research direction

Start with the repro template described in the issue and run `rain deploy --yes repro.cfn.yml` to confirm the differing Ref outputs for the two FunctionName forms. Trace the AWS::Lambda::Function Ref handling, then verify that a full-ARN FunctionName still produces the function name while GetAtt Arn remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.