AWS lambda documentation change
Summary
Restructured documentation steps, updated Dockerfile guidance with .NET version alignment requirements, simplified example outputs, and removed explicit note about USER instruction in Dockerfile
Security assessment
The removed note about USER instruction previously explained Lambda's security default (least-privileged user), but there's no evidence this change addresses a specific vulnerability. The update focuses on version alignment and documentation clarity rather than security features.
Diff
diff --git a/lambda/latest/dg/csharp-image.md b/lambda/latest/dg/csharp-image.md index 60a013d22..43108fa18 100644 --- a//lambda/latest/dg/csharp-image.md +++ b//lambda/latest/dg/csharp-image.md @@ -81 +81 @@ In the following steps, you use [Amazon.Lambda.Templates](https://github.com/aws - 3. Navigate to the ``MyFunction`/src/`MyFunction`` directory. This is where the project files are stored. Examine the following files: +The project files are stored in the ``MyFunction`/src/`MyFunction`` directory: @@ -83 +83 @@ In the following steps, you use [Amazon.Lambda.Templates](https://github.com/aws - * **aws-lambda-tools-defaults.json** – This file is where you specify the command line options when deploying your Lambda function. + * **aws-lambda-tools-defaults.json** : Specifies the command line options for deploying your Lambda function. @@ -85 +85 @@ In the following steps, you use [Amazon.Lambda.Templates](https://github.com/aws - * **Function.cs** – Your Lambda handler function code. This is a C# template that includes the default `Amazon.Lambda.Core` library and a default `LambdaSerializer` attribute. For more information about serialization requirements and options, see [Serialization in C# Lambda functions](./csharp-handler.html#csharp-handler-serializer). You can use the provided code for testing, or replace it with your own. + * **Function.cs** : Your Lambda handler function code. This is a C# template that includes the default `Amazon.Lambda.Core` library and a default `LambdaSerializer` attribute. For more information about serialization requirements and options, see [Serialization in C# Lambda functions](./csharp-handler.html#csharp-handler-serializer). You can use the provided code for testing, or replace it with your own. @@ -87 +87 @@ In the following steps, you use [Amazon.Lambda.Templates](https://github.com/aws - * **MyFunction.csproj** – A .NET [project file](https://learn.microsoft.com/en-us/dotnet/core/project-sdk/overview#project-files), which lists the files and assemblies that comprise your application. + * **MyFunction.csproj** : A .NET [project file](https://learn.microsoft.com/en-us/dotnet/core/project-sdk/overview#project-files), which lists the files and assemblies that comprise your application. @@ -89 +89 @@ In the following steps, you use [Amazon.Lambda.Templates](https://github.com/aws - * **Readme.md** – This file contains more information about the sample Lambda function. + * **Dockerfile** : You can use the provided Dockerfile for testing, or replace it with your own. If you use your own, make sure to: @@ -91 +91 @@ In the following steps, you use [Amazon.Lambda.Templates](https://github.com/aws - 4. Examine the Dockerfile in the `src/`MyFunction`` directory. You can use the provided Dockerfile for testing, or replace it with your own. If you use your own, make sure to: + * Set the `FROM` property to the [URI of the base image](https://gallery.ecr.aws/lambda/dotnet). The base image and the `TargetFramework` in the `MyFunction.csproj` file must both use the same .NET version. For example, to use .NET 9: @@ -93 +93 @@ In the following steps, you use [Amazon.Lambda.Templates](https://github.com/aws - * Set the `FROM` property to the [URI of the base image](https://gallery.ecr.aws/lambda/dotnet). Your .NET version must match the version of the base image. + * Dockerfile: `FROM `public.ecr.aws/lambda/dotnet:9`` @@ -95,5 +95 @@ In the following steps, you use [Amazon.Lambda.Templates](https://github.com/aws - * Set the `CMD` argument to the Lambda function handler. This should match the `image-command` in `aws-lambda-tools-defaults.json`. - -Note that the example Dockerfile does not include a [USER instruction](https://docs.docker.com/reference/dockerfile/#user). When you deploy a container image to Lambda, Lambda automatically defines a default Linux user with least-privileged permissions. This is different from standard Docker behavior which defaults to the `root` user when no `USER` instruction is provided. - -###### Example Dockerfile + * MyFunction.csproj: `<TargetFramework>`net9.0`</TargetFramework>` @@ -101,8 +97 @@ Note that the example Dockerfile does not include a [USER instruction](https://d - # You can also pull these images from DockerHub amazon/aws-lambda-dotnet:8 - FROM public.ecr.aws/lambda/dotnet:8 - - # Copy function code to Lambda-defined environment variable - COPY publish/* ${LAMBDA_TASK_ROOT} - - # Set the CMD to your handler (could also be done as a parameter override outside of the Dockerfile) - CMD [ "MyFunction::MyFunction.Function::FunctionHandler" ] + * Set the `CMD` argument to the Lambda function handler. This should match the `image-command` in `aws-lambda-tools-defaults.json`. @@ -110 +99 @@ Note that the example Dockerfile does not include a [USER instruction](https://d - 5. Install the Amazon.Lambda.Tools [.NET Global Tool](https://aws.amazon.com/blogs/developer/net-core-global-tools-for-aws/). + 3. Install the Amazon.Lambda.Tools [.NET Global Tool](https://aws.amazon.com/blogs/developer/net-core-global-tools-for-aws/). @@ -118 +107 @@ If Amazon.Lambda.Tools is already installed, make sure that you have the latest - 6. Change the directory to ``MyFunction`/src/`MyFunction``, if you're not there already. + 4. Change the directory to ``MyFunction`/src/`MyFunction``, if you're not there already. @@ -122 +111 @@ If Amazon.Lambda.Tools is already installed, make sure that you have the latest - 7. Use Amazon.Lambda.Tools to build the Docker image, push it to a new Amazon ECR repository, and deploy the Lambda function. + 5. Use Amazon.Lambda.Tools to build the Docker image, push it to a new Amazon ECR repository, and deploy the Lambda function. @@ -130 +119 @@ For more information about the Amazon.Lambda.Tools .NET Global Tool, see the [AW - 8. Invoke the function. + 6. Invoke the function. @@ -134 +123 @@ For more information about the Amazon.Lambda.Tools .NET Global Tool, see the [AW -If everything is successful, you see the following: +If everything is successful, you see a response similar to the following: @@ -137 +126 @@ If everything is successful, you see the following: - "TESTING THE FUNCTION" + {"Lower":"testing the function","Upper":"TESTING THE FUNCTION"} @@ -140,3 +129,4 @@ If everything is successful, you see the following: - START RequestId: id Version: $LATEST - END RequestId: id - REPORT RequestId: id Duration: 0.99 ms Billed Duration: 1 ms Memory Size: 256 MB Max Memory Used: 12 MB + INIT_REPORT Init Duration: 9999.81 ms Phase: init Status: timeout + START RequestId: 12378346-f302-419b-b1f2-deaa1e8423ed Version: $LATEST + END RequestId: 12378346-f302-419b-b1f2-deaa1e8423ed + REPORT RequestId: 12378346-f302-419b-b1f2-deaa1e8423ed Duration: 3173.06 ms Billed Duration: 3174 ms Memory Size: 512 MB Max Memory Used: 24 MB @@ -144 +134 @@ If everything is successful, you see the following: - 9. Delete the Lambda function. + 7. Delete the Lambda function.