aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::Lambda::Permission - SourceArn Allow `*` regions in SourceArn

Open
#431 2 comments 5 reactions 0 assignees View on GitHub
compute
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

## 1. Title
AWS::Lambda::Permission-SourceArn

## 2. Scope of request
AWS::Lambda::Permission SourceArn property is used to specify which resources, like SNS topics, are allowed to invoke the referenced Lambda Function. The SourceArn is put in a condition in the Lambda permission like:

```JSON
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "sns.amazonaws.com"
},
"Action": "lambda:InvokeFunction",
"Resource": "",
"Condition": {
"ArnLike": {
"AWS:SourceArn": ""
}
}
}
```

This syntax allows for wildcards in the region attribute of the SourceArn, but CloudFormation doesn't allow the region to be `*`. The property validation checking simply needs to be loosened to allow for `*` resources.

This is especially helpful for SNS topics in many regions to be subscribed to a single Lambda Function in a central region.
Whether a new API call requires a new attribute, or a new feature is supported and needs to be added to CloudFormation.

## 3. Expected behavior
A resource like the following should succeed in placing a region-agnostic permission on a Lambda Function:

```yaml
Resources:
MyLambdaPermission:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:InvokeFunction
FunctionName: !Ref MyFunction
Principal: sns.amazonaws.com
SourceArn: !Sub arn:aws:sns:*:${AWS::AccountId}:my-cross-region-topic
```

## 4. Suggest specific test cases
## 5. Helpful Links to speed up research and evaluation
## 6. Category (required) - Will help with tagging and be easier to find by other users to +1
1. Compute (EC2, ECS, EKS, Lambda...)

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::Lambda::Permission resource and its SourceArn property validation. Compare the expected CloudFormation template with the current handling of a wildcard region, then verify that a region-agnostic SNS permission is accepted without weakening other validation. The issue names no repository files or tests, so those entry points must be located during research.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.