(aws-lambda): retain permissions on old lambda layer versions
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
I am trying to publish a [public lambda layer](https://github.com/jetbridge/lambda-layer-prisma-pg) for all to use.
When I publish a new version, old versions become inaccessible to anyone in another AWS account.
### Reproduction Steps
See code here: https://github.com/jetbridge/layers-cdk/blob/master/lib/infra-stack.ts#L15 and the LayerVersion here: https://github.com/jetbridge/lambda-layer-prisma-pg/blob/e3aa72a8286e89c41f9773618913dada8a57d675/src/index.ts#L9
### What did you expect to happen?
Old layer versions should retain their policy (should be public for everyone)
### What actually happened?
```
aws> lambda get-layer-version-policy --layer-name PrismaPg --version-number 3
{
"Policy": "{\"Version\":\"2012-10-17\",\"Id\":\"default\",\"Statement\":[{\"Sid\":\"PrismaPgLayerremoteaccountg-78URQbFOrs2L\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"lambda:GetLayerVersion\",\"Resource\":\"arn:aws:lambda:eu-west-1:898466741470:layer:PrismaPg:3\"}]}",
"RevisionId": "cdd62d89-006d-4f7a-b4cf-ca5790489688"
}
aws> lambda get-layer-version-policy --layer-name PrismaPg --version-number 2
An error occurred (ResourceNotFoundException) when calling the GetLayerVersionPolicy operation: Layer version arn:aws:lambda:eu-west-1:898466741470:layer:PrismaPg:2 does not have any resource policy.
aws>
```
Where did the version policy go for version 2?
### Environment
- **CDK CLI Version :** 1.110.0
- **Framework Version:**
- **Node.js Version:** v14.15.4
- **OS :** macos
- **Language (Version):** TS
### Other
---
This is :bug: Bug Report
Contributor guide
Research direction
Start with the reproduction files linked in lib/infra-stack.ts and src/index.ts, then inspect the AWS CDK Lambda layer-version entry point and any related tests. Reproduce deployment of successive versions and compare their resource policies; done means old public layer versions retain the expected policy after a new version is published.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100