aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::Lambda::Permission - SourceArn Allow `*` regions in SourceArn
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
## 1. Title
AWS::Lambda::Permission-SourceArn
## 2. Scope of request
AWS::Lambda::Permission SourceArn property is used to specify which resources, like SNS topics, are allowed to invoke the referenced Lambda Function. The SourceArn is put in a condition in the Lambda permission like:
```JSON
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "sns.amazonaws.com"
},
"Action": "lambda:InvokeFunction",
"Resource": "",
"Condition": {
"ArnLike": {
"AWS:SourceArn": ""
}
}
}
```
This syntax allows for wildcards in the region attribute of the SourceArn, but CloudFormation doesn't allow the region to be `*`. The property validation checking simply needs to be loosened to allow for `*` resources.
This is especially helpful for SNS topics in many regions to be subscribed to a single Lambda Function in a central region.
Whether a new API call requires a new attribute, or a new feature is supported and needs to be added to CloudFormation.
## 3. Expected behavior
A resource like the following should succeed in placing a region-agnostic permission on a Lambda Function:
```yaml
Resources:
MyLambdaPermission:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:InvokeFunction
FunctionName: !Ref MyFunction
Principal: sns.amazonaws.com
SourceArn: !Sub arn:aws:sns:*:${AWS::AccountId}:my-cross-region-topic
```
## 4. Suggest specific test cases
## 5. Helpful Links to speed up research and evaluation
## 6. Category (required) - Will help with tagging and be easier to find by other users to +1
1. Compute (EC2, ECS, EKS, Lambda...)
Contributor guide
Research direction
Start with the AWS::Lambda::Permission resource and its SourceArn property validation. Compare the expected CloudFormation template with the current handling of a wildcard region, then verify that a region-agnostic SNS permission is accepted without weakening other validation. The issue names no repository files or tests, so those entry points must be located during research.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100