AWS serverless-application-model documentation change
Summary
Restructured documentation to categorize generated resources into 'Core function properties', 'Event sources', and 'Event configuration' sections. Added details about FunctionUrlConfig behavior with AuthType and expanded DeploymentPreference resource generation details.
Security assessment
The changes primarily reorganize content and clarify resource generation logic. While the FunctionUrlConfig section mentions AuthType (NONE vs AWS_IAM), this documents existing functionality rather than addressing a security vulnerability. No concrete evidence of security vulnerability fixes or incident responses.
Diff
diff --git a/serverless-application-model/latest/developerguide/sam-specification-generated-resources-function.md b/serverless-application-model/latest/developerguide/sam-specification-generated-resources-function.md index 8a7d88123..7dcbe1e78 100644 --- a//serverless-application-model/latest/developerguide/sam-specification-generated-resources-function.md +++ b//serverless-application-model/latest/developerguide/sam-specification-generated-resources-function.md @@ -5 +5 @@ -AutoPublishAlias property is specifiedRole property is not specifiedDeploymentPreference property is specifiedAn Api event source is specifiedAn HttpApi event source is specifiedA streaming event source is specifiedAn event bridge (or event bus) event source is specifiedAn IotRule event source is specifiedOnSuccess (or OnFailure) property is specified for Amazon SNS eventsOnSuccess (or OnFailure) property is specified for Amazon SQS events +Core function propertiesEvent sourcesEvent configuration @@ -22 +22 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function - * AutoPublishAlias property is specified + * Core function properties @@ -24 +24 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function - * Role property is not specified + * Event sources @@ -26 +26 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function - * DeploymentPreference property is specified + * Event configuration @@ -28 +27,0 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function - * An Api event source is specified @@ -30 +28,0 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function - * An HttpApi event source is specified @@ -32 +29,0 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function - * A streaming event source is specified @@ -34 +31 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function - * An event bridge (or event bus) event source is specified +## Core function properties @@ -36 +33 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function - * An IotRule event source is specified +The following scenarios generate AWS CloudFormation resources based on core function properties: @@ -38 +35 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function - * OnSuccess (or OnFailure) property is specified for Amazon SNS events +### Role property is not specified @@ -40 +37,3 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function - * OnSuccess (or OnFailure) property is specified for Amazon SQS events +When the `Role` property of an `AWS::Serverless::Function` is _not_ specified, AWS SAM generates an `AWS::IAM::Role` AWS CloudFormation resource. + +**`AWS::IAM::Role`** @@ -42,0 +42 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function +_`LogicalId`: _``<function‑LogicalId>`Role` @@ -43,0 +44 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function +_Referenceable property:_ N/A (you must use the `LogicalId` to reference this AWS CloudFormation resource) @@ -45 +46 @@ In addition to this AWS CloudFormation resource, when `AWS::Serverless::Function -## AutoPublishAlias property is specified +### AutoPublishAlias property is specified @@ -69 +70 @@ For additional information on the `AutoPublishAlias` property, see the [Properti -## Role property is not specified +### DeploymentPreference property is specified @@ -71 +72,15 @@ For additional information on the `AutoPublishAlias` property, see the [Properti -When the `Role` property of an `AWS::Serverless::Function` is _not_ specified, AWS SAM generates an `AWS::IAM::Role` AWS CloudFormation resource. +When the `DeploymentPreference` property of an `AWS::Serverless::Function` is specified, AWS SAM generates the following resources AWS CloudFormation resources: `AWS::CodeDeploy::Application` and `AWS::CodeDeploy::DeploymentGroup`. In addition, if the `Role` property of the `DeploymentPreference` object is _not_ specified, AWS SAM also generates an `AWS::IAM::Role` AWS CloudFormation resource. + +**`AWS::CodeDeploy::Application`** + + +_`LogicalId`: _`ServerlessDeploymentApplication` + +_Referenceable property:_ N/A (you must use the `LogicalId` to reference this AWS CloudFormation resource) + +**`AWS::CodeDeploy::DeploymentGroup`** + + +_`LogicalId`: _``<function‑LogicalId>`DeploymentGroup` + +_Referenceable property:_ N/A (you must use the `LogicalId` to reference this AWS CloudFormation resource) @@ -76 +91 @@ When the `Role` property of an `AWS::Serverless::Function` is _not_ specified, A -_`LogicalId`: _``<function‑LogicalId>`Role` +_`LogicalId`: _`CodeDeployServiceRole` @@ -80 +95 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -## DeploymentPreference property is specified +### FunctionUrlConfig property is specified @@ -82 +97 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -When the `DeploymentPreference` property of an `AWS::Serverless::Function` is specified, AWS SAM generates the following resources AWS CloudFormation resources: `AWS::CodeDeploy::Application` and `AWS::CodeDeploy::DeploymentGroup`. In addition, if the `Role` property of the `DeploymentPreference` object is _not_ specified, AWS SAM also generates an `AWS::IAM::Role` AWS CloudFormation resource. +When the `FunctionUrlConfig` property is specified, AWS SAM generates different AWS CloudFormation resources based on the `AuthType`. @@ -84 +99 @@ When the `DeploymentPreference` property of an `AWS::Serverless::Function` is sp -**`AWS::CodeDeploy::Application`** +When `AuthType: NONE` is specified, AWS SAM generates the following AWS CloudFormation resources: @@ -85,0 +101 @@ When the `DeploymentPreference` property of an `AWS::Serverless::Function` is sp +**`AWS::Lambda::Permission` (Invoke Access)** @@ -87 +103,2 @@ When the `DeploymentPreference` property of an `AWS::Serverless::Function` is sp -_`LogicalId`: _`ServerlessDeploymentApplication` + +_`LogicalId`: _``<function‑LogicalId>`URLInvokeAllowPublicAccess` @@ -91 +108 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -**`AWS::CodeDeploy::DeploymentGroup`** +**`AWS::Lambda::Permission` (Public Access)** @@ -94 +111 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -_`LogicalId`: _``<function‑LogicalId>`DeploymentGroup` +_`LogicalId`: _``<function‑LogicalId>`UrlPublicPermissions` @@ -98 +115 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -**`AWS::IAM::Role`** +**`AWS::Lambda::Url`** @@ -101 +118 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -_`LogicalId`: _`CodeDeployServiceRole` +_`LogicalId`: _``<function‑LogicalId>`Url` @@ -105 +122,16 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -## An Api event source is specified +When `AuthType: AWS_IAM` is specified, AWS SAM generates only: + +**`AWS::Lambda::Url`** + + +_`LogicalId`: _``<function‑LogicalId>`Url` + +_Referenceable property:_ N/A (you must use the `LogicalId` to reference this AWS CloudFormation resource) + +For additional information on the `FunctionUrlConfig` property, see [FunctionUrlConfig](./sam-property-function-functionurlconfig.html). + +## Event sources + +The following scenarios generate AWS CloudFormation resources based on event sources: + +### An Api event source is specified @@ -116 +148 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -## An HttpApi event source is specified +### An HttpApi event source is specified @@ -127 +159 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -## A streaming event source is specified +### A streaming event source is specified @@ -138 +170 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -## An event bridge (or event bus) event source is specified +### An event bridge (or event bus) event source is specified @@ -149 +181 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -## An IotRule event source is specified +### An IotRule event source is specified @@ -160 +192,5 @@ _Referenceable property:_ N/A (you must use the `LogicalId` to reference this AW -## OnSuccess (or OnFailure) property is specified for Amazon SNS events +## Event configuration + +The following scenarios generate AWS CloudFormation resources based on event configuration: + +### OnSuccess (or OnFailure) property is specified for Amazon SNS events @@ -180 +216 @@ If both `OnSuccess` and `OnFailure` are specified for an Amazon SNS event, to di -## OnSuccess (or OnFailure) property is specified for Amazon SQS events +### OnSuccess (or OnFailure) property is specified for Amazon SQS events