aws / aws/aws-cdk

(aws-lambda): retain permissions on old lambda layer versions

Open
#15,524 6 comments 3 reactions 0 assignees View on GitHub
@aws-cdk/aws-lambda effort/medium feature-request feature/enhancement p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

I am trying to publish a [public lambda layer](https://github.com/jetbridge/lambda-layer-prisma-pg) for all to use.

When I publish a new version, old versions become inaccessible to anyone in another AWS account.

### Reproduction Steps

See code here: https://github.com/jetbridge/layers-cdk/blob/master/lib/infra-stack.ts#L15 and the LayerVersion here: https://github.com/jetbridge/lambda-layer-prisma-pg/blob/e3aa72a8286e89c41f9773618913dada8a57d675/src/index.ts#L9

### What did you expect to happen?

Old layer versions should retain their policy (should be public for everyone)

### What actually happened?

```
aws> lambda get-layer-version-policy --layer-name PrismaPg --version-number 3
{
"Policy": "{\"Version\":\"2012-10-17\",\"Id\":\"default\",\"Statement\":[{\"Sid\":\"PrismaPgLayerremoteaccountg-78URQbFOrs2L\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"lambda:GetLayerVersion\",\"Resource\":\"arn:aws:lambda:eu-west-1:898466741470:layer:PrismaPg:3\"}]}",
"RevisionId": "cdd62d89-006d-4f7a-b4cf-ca5790489688"
}
aws> lambda get-layer-version-policy --layer-name PrismaPg --version-number 2

An error occurred (ResourceNotFoundException) when calling the GetLayerVersionPolicy operation: Layer version arn:aws:lambda:eu-west-1:898466741470:layer:PrismaPg:2 does not have any resource policy.
aws>
```
Where did the version policy go for version 2?

### Environment

- **CDK CLI Version :** 1.110.0
- **Framework Version:**
- **Node.js Version:** v14.15.4
- **OS :** macos
- **Language (Version):** TS

### Other

---

This is :bug: Bug Report

Contributor guide

Open the contributing guide

Research direction

Start with the reproduction files linked in lib/infra-stack.ts and src/index.ts, then inspect the AWS CDK Lambda layer-version entry point and any related tests. Reproduce deployment of successive versions and compare their resource policies; done means old public layer versions retain the expected policy after a new version is published.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.