fix(custom-resource): provider framework lambda missing GetFunction permission by samson-keung · Pull Request #32904 · aws/aws-cdk

samson-keung · 2025-01-13T22:39:34Z

Issue # (if applicable)

Reason for this change

In the Provider Framework lambda code, there is a logic to catch error arise from invoking the User Defined handler lambda. Upon error, it polls the state of the User Defined handler until it is in ACTIVE state (#22612 added this logic):

aws-cdk/packages/aws-cdk-lib/custom-resources/lib/provider-framework/runtime/outbound.ts

Lines 66 to 80 in 64b865b

    
             } catch { 
        
               /** 
        
                * The status of the Lambda function is checked every second for up to 300 seconds. 
        
                * Exits the loop on 'Active' state and throws an error on 'Inactive' or 'Failed'. 
        
                * 
        
                * And now we wait. 
        
                */ 
        
               await waitUntilFunctionActiveV2({ 
        
                 client: lambda, 
        
                 maxWaitTime: 300, 
        
               }, { 
        
                 FunctionName: req.FunctionName, 
        
               }); 
        
               return lambda.invoke(req); 
        
             }

The polling uses the AWS SDK waitUntilFunctionActiveV2 function, which calls the Lambda GetFunction API:
https://github.com/aws/aws-sdk-js-v3/blob/6858c7e04730a2b524b06355969e4076c28ae863/clients/client-lambda/src/waiters/waitForFunctionActiveV2.ts#L57

However, the Provider Framework lambda does not have the lambda:GetFunction permission.

Why is the issue saying the `lambda:GetFunctionConfiguration` is needed instead of `lambda:GetFunction`?

At some point in time, the retry logic used waitUntilFunctionActive for polling, which use the GetFunctionConfiguration. But this is no longer the case after c3a4b7b#diff-85920270c638d83b082246e0026f1a316dd39aaa3cd8720fdaeb3d526e438f7fR66

Description of changes

Added the lambda:GetFunction permission on the role used by the Provider Framework lambda.

Describe any new or updated permissions being added

The lambda:GetFunction permission is added.

Description of how you validated changes

There isn't a straight forward way to test the INACTIVE lambda scenario as one need to wait 14 days for a Lambda function to become INACTIVE. Therefore, I am not able to create an integ test.

What I did was locally changing the Provider Framework lambda code to throw an error such that it executes the catch block. Then I verified in CloudTrail that the Provider Framework lambda called GetFunction successfully and then it was also able to invoke the User Defined Handler lambda.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

codecov · 2025-01-13T22:57:55Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.46%. Comparing base (e5ac918) to head (fe11b92).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #32904   +/-   ##
=======================================
  Coverage   81.46%   81.46%           
=======================================
  Files         224      224           
  Lines       13748    13748           
  Branches     2412     2412           
=======================================
  Hits        11200    11200           
  Misses       2273     2273           
  Partials      275      275

Flag	Coverage Δ
suite.unit	`81.46% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`80.85% <ø> (ø)`
packages/aws-cdk-lib/core	`82.10% <ø> (ø)`

aws-cdk-automation · 2025-01-15T04:48:32Z

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

samson-keung · 2025-01-20T16:42:58Z

Exemption Request

It requires waiting 14 days for a lambda to be in INACTIVE state. Therefore, we don't have a way to integ test this change.

packages/aws-cdk-lib/custom-resources/lib/provider-framework/provider.ts

moelasmar

In general the change looks good, I left a minor comment

packages/aws-cdk-lib/custom-resources/lib/provider-framework/provider.ts

aws-cdk-automation · 2025-01-20T21:34:23Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: fe11b92
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

mergify · 2025-01-20T21:45:42Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-01-20T21:46:06Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

aws-cdk-automation requested a review from a team January 13, 2025 22:39

github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p1 labels Jan 13, 2025

mergify bot added the contribution/core This is a PR that came from AWS. label Jan 13, 2025

aws-cdk-automation previously requested changes Jan 13, 2025

View reviewed changes

samson-keung force-pushed the custom-resource-missing-permission branch 2 times, most recently from c5d517f to 8a86bf8 Compare January 14, 2025 17:40

aws deleted a comment from aws-cdk-automation Jan 15, 2025

samson-keung force-pushed the custom-resource-missing-permission branch 4 times, most recently from 4c475e9 to 7311e68 Compare January 19, 2025 04:48

samson-keung marked this pull request as ready for review January 20, 2025 00:24

aws-cdk-automation added pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. pr/needs-maintainer-review This PR needs a review from a Core Team Member labels Jan 20, 2025

moelasmar reviewed Jan 20, 2025

View reviewed changes

packages/aws-cdk-lib/custom-resources/lib/provider-framework/provider.ts Outdated Show resolved Hide resolved

moelasmar approved these changes Jan 20, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 20, 2025

samson-keung commented Jan 20, 2025

View reviewed changes

packages/aws-cdk-lib/custom-resources/lib/provider-framework/provider.ts Outdated Show resolved Hide resolved

samson-keung force-pushed the custom-resource-missing-permission branch from bd7b48f to 902f9c7 Compare January 20, 2025 17:20

samson-keung added 6 commits January 20, 2025 13:03

add GetFunction permission to Provider Framework lambda

643e48c

update integ test snapshots

0b2016c

snapshot updates

9e256de

snapshot updates

9ace51d

snapshot updates

5947e4f

snapshot updates

63c9b4b

variable renaming

fe11b92

samson-keung force-pushed the custom-resource-missing-permission branch from 902f9c7 to fe11b92 Compare January 20, 2025 21:03

mergify bot merged commit 035d17d into aws:main Jan 20, 2025

github-actions bot locked as resolved and limited conversation to collaborators Jan 20, 2025

samson-keung deleted the custom-resource-missing-permission branch March 11, 2025 21:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(custom-resource): provider framework lambda missing GetFunction permission#32904

fix(custom-resource): provider framework lambda missing GetFunction permission#32904
mergify[bot] merged 7 commits intoaws:mainfrom
samson-keung:custom-resource-missing-permission

samson-keung commented Jan 13, 2025

Uh oh!

aws-cdk-automation left a comment •

edited

Loading

Uh oh!

codecov bot commented Jan 13, 2025 •

edited

Loading

Uh oh!

aws-cdk-automation commented Jan 15, 2025

Uh oh!

samson-keung commented Jan 20, 2025

Uh oh!

Uh oh!

moelasmar left a comment

Uh oh!

Uh oh!

aws-cdk-automation commented Jan 20, 2025

Uh oh!

mergify bot commented Jan 20, 2025

Uh oh!

github-actions bot commented Jan 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	} catch {
	/**
	* The status of the Lambda function is checked every second for up to 300 seconds.
	* Exits the loop on 'Active' state and throws an error on 'Inactive' or 'Failed'.
	*
	* And now we wait.
	*/
	await waitUntilFunctionActiveV2({
	client: lambda,
	maxWaitTime: 300,
	}, {
	FunctionName: req.FunctionName,
	});
	return lambda.invoke(req);
	}

Conversation

samson-keung commented Jan 13, 2025

Issue # (if applicable)

Reason for this change

Why is the issue saying the lambda:GetFunctionConfiguration is needed instead of lambda:GetFunction?

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Jan 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

aws-cdk-automation commented Jan 15, 2025

Uh oh!

samson-keung commented Jan 20, 2025

Uh oh!

Uh oh!

moelasmar left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aws-cdk-automation commented Jan 20, 2025

AWS CodeBuild CI Report

Uh oh!

mergify bot commented Jan 20, 2025

Uh oh!

github-actions bot commented Jan 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Why is the issue saying the `lambda:GetFunctionConfiguration` is needed instead of `lambda:GetFunction`?

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Jan 13, 2025 •

edited

Loading