Skip to content

Commit 3886df1

Browse files
author
AWS
committed
AWS Lambda Update: Tagging support for Lambda event source mapping, and code signing configuration resources.
1 parent 4c99111 commit 3886df1

File tree

2 files changed

+52
-20
lines changed

2 files changed

+52
-20
lines changed

‎.changes/next-release/feature-AWSLambda-b5631a6.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "AWS Lambda",
4+
"contributor": "",
5+
"description": "Tagging support for Lambda event source mapping, and code signing configuration resources."
6+
}

‎services/lambda/src/main/resources/codegen-resources/service-2.json

Lines changed: 46 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,10 @@
4848
{"shape":"InvalidParameterValueException"},
4949
{"shape":"PolicyLengthExceededException"},
5050
{"shape":"TooManyRequestsException"},
51-
{"shape":"PreconditionFailedException"}
51+
{"shape":"PreconditionFailedException"},
52+
{"shape":"PublicPolicyException"}
5253
],
53-
"documentation":"<p>Grants an Amazon Web Servicesservice, Amazon Web Services account, or Amazon Web Services organization permission to use a function. You can apply the policy at the function level, or specify a qualifier to restrict access to a single version or alias. If you use a qualifier, the invoker must use the full Amazon Resource Name (ARN) of that version or alias to invoke the function. Note: Lambda does not support adding policies to version $LATEST.</p> <p>To grant permission to another account, specify the account ID as the <code>Principal</code>. To grant permission to an organization defined in Organizations, specify the organization ID as the <code>PrincipalOrgID</code>. For Amazon Web Servicesservices, the principal is a domain-style identifier that the service defines, such as <code>s3.amazonaws.com</code> or <code>sns.amazonaws.com</code>. For Amazon Web Servicesservices, you can also specify the ARN of the associated resource as the <code>SourceArn</code>. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function.</p> <p>This operation adds a statement to a resource-based permissions policy for the function. For more information about function policies, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">Using resource-based policies for Lambda</a>.</p>"
54+
"documentation":"<p>Grants a <a href=\"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#Principal_specifying\">principal</a> permission to use a function. You can apply the policy at the function level, or specify a qualifier to restrict access to a single version or alias. If you use a qualifier, the invoker must use the full Amazon Resource Name (ARN) of that version or alias to invoke the function. Note: Lambda does not support adding policies to version $LATEST.</p> <p>To grant permission to another account, specify the account ID as the <code>Principal</code>. To grant permission to an organization defined in Organizations, specify the organization ID as the <code>PrincipalOrgID</code>. For Amazon Web Servicesservices, the principal is a domain-style identifier that the service defines, such as <code>s3.amazonaws.com</code> or <code>sns.amazonaws.com</code>. For Amazon Web Servicesservices, you can also specify the ARN of the associated resource as the <code>SourceArn</code>. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function.</p> <p>This operation adds a statement to a resource-based permissions policy for the function. For more information about function policies, see <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">Using resource-based policies for Lambda</a>.</p>"
5455
},
5556
"CreateAlias":{
5657
"name":"CreateAlias",
@@ -327,7 +328,7 @@
327328
{"shape":"TooManyRequestsException"},
328329
{"shape":"PreconditionFailedException"}
329330
],
330-
"documentation":"<p>Deletes a <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policy</a> from a function.</p>"
331+
"documentation":"<note> <p>The option to create and modify full JSON resource-based policies, and to use the PutResourcePolicy, GetResourcePolicy, and DeleteResourcePolicy APIs, won't be available in all Amazon Web Services Regions until September 30, 2024.</p> </note> <p>Deletes a <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policy</a> from a function.</p>"
331332
},
332333
"GetAccountSettings":{
333334
"name":"GetAccountSettings",
@@ -614,7 +615,7 @@
614615
{"shape":"TooManyRequestsException"},
615616
{"shape":"InvalidParameterValueException"}
616617
],
617-
"documentation":"<p>Retrieve the public-access settings for a function.</p>"
618+
"documentation":"<note> <p>The option to configure public-access settings, and to use the PutPublicAccessBlock and GetPublicAccessBlock APIs, won't be available in all Amazon Web Services Regions until September 30, 2024.</p> </note> <p>Retrieve the public-access settings for a function.</p>"
618619
},
619620
"GetResourcePolicy":{
620621
"name":"GetResourcePolicy",
@@ -631,7 +632,7 @@
631632
{"shape":"TooManyRequestsException"},
632633
{"shape":"InvalidParameterValueException"}
633634
],
634-
"documentation":"<p>Retrieves the <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policy</a> attached to a function.</p>"
635+
"documentation":"<note> <p>The option to create and modify full JSON resource-based policies, and to use the PutResourcePolicy, GetResourcePolicy, and DeleteResourcePolicy APIs, won't be available in all Amazon Web Services Regions until September 30, 2024.</p> </note> <p>Retrieves the <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policy</a> attached to a function.</p>"
635636
},
636637
"GetRuntimeManagementConfig":{
637638
"name":"GetRuntimeManagementConfig",
@@ -932,7 +933,7 @@
932933
{"shape":"InvalidParameterValueException"},
933934
{"shape":"TooManyRequestsException"}
934935
],
935-
"documentation":"<p>Returns a function's <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/tagging.html\">tags</a>. You can also view tags with <a>GetFunction</a>.</p>"
936+
"documentation":"<p>Returns a function, event source mapping, or code signing configuration's <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/tagging.html\">tags</a>. You can also view funciton tags with <a>GetFunction</a>.</p>"
936937
},
937938
"ListVersionsByFunction":{
938939
"name":"ListVersionsByFunction",
@@ -1096,7 +1097,7 @@
10961097
{"shape":"InvalidParameterValueException"},
10971098
{"shape":"TooManyRequestsException"}
10981099
],
1099-
"documentation":"<p>Configure your function's public-access settings.</p> <p>To control public access to a Lambda function, you can choose whether to allow the creation of <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policies</a> that allow public access to that function. You can also block public access to a function, even if it has an existing resource-based policy that allows it.</p>"
1100+
"documentation":"<note> <p>The option to configure public-access settings, and to use the PutPublicAccessBlock and GetPublicAccessBlock APIs, won't be available in all Amazon Web Services Regions until September 30, 2024.</p> </note> <p>Configure your function's public-access settings.</p> <p>To control public access to a Lambda function, you can choose whether to allow the creation of <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policies</a> that allow public access to that function. You can also block public access to a function, even if it has an existing resource-based policy that allows it.</p>"
11001101
},
11011102
"PutResourcePolicy":{
11021103
"name":"PutResourcePolicy",
@@ -1117,7 +1118,7 @@
11171118
{"shape":"PreconditionFailedException"},
11181119
{"shape":"PublicPolicyException"}
11191120
],
1120-
"documentation":"<p>Adds a <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policy</a> to a function. You can use resource-based policies to grant access to other <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-cross-account.html\">Amazon Web Services accounts</a>, <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-organization.html\">organizations</a>, or <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-services.html\">services</a>. Resource-based policies apply to a single function, version, or alias.</p> <important> <p>Adding a resource-based policy using this API action replaces any existing policy you've previously created. This means that if you've previously added resource-based permissions to a function using the <a>AddPermission</a> action, those permissions will be overwritten by your new policy.</p> </important>"
1121+
"documentation":"<note> <p>The option to create and modify full JSON resource-based policies, and to use the PutResourcePolicy, GetResourcePolicy, and DeleteResourcePolicy APIs, won't be available in all Amazon Web Services Regions until September 30, 2024.</p> </note> <p>Adds a <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policy</a> to a function. You can use resource-based policies to grant access to other <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-cross-account.html\">Amazon Web Services accounts</a>, <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-organization.html\">organizations</a>, or <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-services.html\">services</a>. Resource-based policies apply to a single function, version, or alias.</p> <important> <p>Adding a resource-based policy using this API action replaces any existing policy you've previously created. This means that if you've previously added resource-based permissions to a function using the <a>AddPermission</a> action, those permissions will be overwritten by your new policy.</p> </important>"
11211122
},
11221123
"PutRuntimeManagementConfig":{
11231124
"name":"PutRuntimeManagementConfig",
@@ -1167,7 +1168,8 @@
11671168
{"shape":"ResourceNotFoundException"},
11681169
{"shape":"InvalidParameterValueException"},
11691170
{"shape":"TooManyRequestsException"},
1170-
{"shape":"PreconditionFailedException"}
1171+
{"shape":"PreconditionFailedException"},
1172+
{"shape":"PublicPolicyException"}
11711173
],
11721174
"documentation":"<p>Revokes function-use permission from an Amazon Web Servicesservice or another Amazon Web Services account. You can get the ID of the statement from the output of <a>GetPolicy</a>.</p>"
11731175
},
@@ -1186,7 +1188,7 @@
11861188
{"shape":"TooManyRequestsException"},
11871189
{"shape":"ResourceConflictException"}
11881190
],
1189-
"documentation":"<p>Adds <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/tagging.html\">tags</a> to a function.</p>"
1191+
"documentation":"<p>Adds <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/tagging.html\">tags</a> to a function, event source mapping, or code signing configuration.</p>"
11901192
},
11911193
"UntagResource":{
11921194
"name":"UntagResource",
@@ -1203,7 +1205,7 @@
12031205
{"shape":"TooManyRequestsException"},
12041206
{"shape":"ResourceConflictException"}
12051207
],
1206-
"documentation":"<p>Removes <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/tagging.html\">tags</a> from a function.</p>"
1208+
"documentation":"<p>Removes <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/tagging.html\">tags</a> from a function, event source mapping, or code signing configuration.</p>"
12071209
},
12081210
"UpdateAlias":{
12091211
"name":"UpdateAlias",
@@ -1470,7 +1472,7 @@
14701472
},
14711473
"Principal":{
14721474
"shape":"Principal",
1473-
"documentation":"<p>The Amazon Web Servicesservice or Amazon Web Services account that invokes the function. If you specify a service, use <code>SourceArn</code> or <code>SourceAccount</code> to limit who can invoke the function through that service.</p>"
1475+
"documentation":"<p>The Amazon Web Servicesservice, Amazon Web Services account, IAM user, or IAM role that invokes the function. If you specify a service, use <code>SourceArn</code> or <code>SourceAccount</code> to limit who can invoke the function through that service.</p>"
14741476
},
14751477
"SourceArn":{
14761478
"shape":"Arn",
@@ -1851,6 +1853,10 @@
18511853
"CodeSigningPolicies":{
18521854
"shape":"CodeSigningPolicies",
18531855
"documentation":"<p>The code signing policies define the actions to take if the validation checks fail. </p>"
1856+
},
1857+
"Tags":{
1858+
"shape":"Tags",
1859+
"documentation":"<p>A list of tags to add to the code signing configuration.</p>"
18541860
}
18551861
}
18561862
},
@@ -1920,6 +1926,10 @@
19201926
"shape":"MaximumRetryAttemptsEventSourceMapping",
19211927
"documentation":"<p>(Kinesis and DynamoDB Streams only) Discard records after the specified number of retries. The default value is infinite (-1). When set to infinite (-1), failed records are retried until the record expires.</p>"
19221928
},
1929+
"Tags":{
1930+
"shape":"Tags",
1931+
"documentation":"<p>A list of tags to apply to the event source mapping.</p>"
1932+
},
19231933
"TumblingWindowInSeconds":{
19241934
"shape":"TumblingWindowInSeconds",
19251935
"documentation":"<p>(Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources. A value of 0 seconds indicates no tumbling window.</p>"
@@ -2562,6 +2572,12 @@
25622572
"max":10240,
25632573
"min":512
25642574
},
2575+
"EventSourceMappingArn":{
2576+
"type":"string",
2577+
"max":120,
2578+
"min":85,
2579+
"pattern":"arn:(aws[a-zA-Z-]*)?:lambda:[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:\\d{12}:event-source-mapping:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
2580+
},
25652581
"EventSourceMappingConfiguration":{
25662582
"type":"structure",
25672583
"members":{
@@ -2680,6 +2696,10 @@
26802696
"FilterCriteriaError":{
26812697
"shape":"FilterCriteriaError",
26822698
"documentation":"<p>An object that contains details about an error related to filter criteria encryption.</p>"
2699+
},
2700+
"EventSourceMappingArn":{
2701+
"shape":"EventSourceMappingArn",
2702+
"documentation":"<p>The Amazon Resource Name (ARN) of the event source mapping.</p>"
26832703
}
26842704
},
26852705
"documentation":"<p>A mapping between an Amazon Web Services resource and a Lambda function. For details, see <a>CreateEventSourceMapping</a>.</p>"
@@ -4689,8 +4709,8 @@
46894709
"required":["Resource"],
46904710
"members":{
46914711
"Resource":{
4692-
"shape":"FunctionArn",
4693-
"documentation":"<p>The function's Amazon Resource Name (ARN). Note: Lambda does not support adding tags to aliases or versions.</p>",
4712+
"shape":"TaggableResource",
4713+
"documentation":"<p>The resource's Amazon Resource Name (ARN). Note: Lambda does not support adding tags to function aliases or versions.</p>",
46944714
"location":"uri",
46954715
"locationName":"ARN"
46964716
}
@@ -5993,18 +6013,24 @@
59936013
],
59946014
"members":{
59956015
"Resource":{
5996-
"shape":"FunctionArn",
5997-
"documentation":"<p>The function's Amazon Resource Name (ARN).</p>",
6016+
"shape":"TaggableResource",
6017+
"documentation":"<p>The resource's Amazon Resource Name (ARN).</p>",
59986018
"location":"uri",
59996019
"locationName":"ARN"
60006020
},
60016021
"Tags":{
60026022
"shape":"Tags",
6003-
"documentation":"<p>A list of tags to apply to the function.</p>"
6023+
"documentation":"<p>A list of tags to apply to the resource.</p>"
60046024
}
60056025
}
60066026
},
60076027
"TagValue":{"type":"string"},
6028+
"TaggableResource":{
6029+
"type":"string",
6030+
"max":256,
6031+
"min":1,
6032+
"pattern":"arn:(aws[a-zA-Z-]*):lambda:[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:\\d{12}:(function:[a-zA-Z0-9-_]+(:(\\$LATEST|[a-zA-Z0-9-_]+))?|code-signing-config:csc-[a-z0-9]{17}|event-source-mapping:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})"
6033+
},
60086034
"Tags":{
60096035
"type":"map",
60106036
"key":{"shape":"TagKey"},
@@ -6121,14 +6147,14 @@
61216147
],
61226148
"members":{
61236149
"Resource":{
6124-
"shape":"FunctionArn",
6125-
"documentation":"<p>The function's Amazon Resource Name (ARN).</p>",
6150+
"shape":"TaggableResource",
6151+
"documentation":"<p>The resource's Amazon Resource Name (ARN).</p>",
61266152
"location":"uri",
61276153
"locationName":"ARN"
61286154
},
61296155
"TagKeys":{
61306156
"shape":"TagKeyList",
6131-
"documentation":"<p>A list of tag keys to remove from the function.</p>",
6157+
"documentation":"<p>A list of tag keys to remove from the resource.</p>",
61326158
"location":"querystring",
61336159
"locationName":"tagKeys"
61346160
}

0 commit comments

Comments
 (0)