AWS lambda documentation change
Summary
Added Kafka as a supported on-failure destination type, updated IAM permissions, and included a section about Kafka topic failure destinations.
Security assessment
The change introduces documentation for configuring Kafka as an on-failure destination, including required IAM permissions (kafka-cluster:WriteData). While this enhances failure-handling capabilities, there is no evidence of addressing a security vulnerability. The addition of permissions guidance qualifies as security-related documentation for proper access control.
Diff
diff --git a/lambda/latest/dg/kafka-on-failure.md b/lambda/latest/dg/kafka-on-failure.md index 7e2b39b79..9d134ab2c 100644 --- a//lambda/latest/dg/kafka-on-failure.md +++ b//lambda/latest/dg/kafka-on-failure.md @@ -9 +9 @@ Configuring on-failure destinations for a Kafka event source mapping -To retain records of failed event source mapping invocations, add a destination to your function's event source mapping. Each record sent to the destination is a JSON document containing metadata about the failed invocation. For Amazon S3 destinations, Lambda also sends the entire invocation record along with the metadata. You can configure any Amazon SNS topic, Amazon SQS queue, or S3 bucket as a destination. +To retain records of failed event source mapping invocations, add a destination to your function's event source mapping. Each record sent to the destination is a JSON document containing metadata about the failed invocation. For Amazon S3 destinations, Lambda also sends the entire invocation record along with the metadata. You can configure any Amazon SNS topic, Amazon SQS queue, Amazon S3 bucket, or Kafka as a destination. @@ -15 +15 @@ Your execution role must have permissions for the destination: - * **For SQS destinations:** [sqs:SendMessage](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html) + * **For an SQS destination:** [sqs:SendMessage](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html) @@ -17 +17 @@ Your execution role must have permissions for the destination: - * **For SNS destinations:** [sns:Publish](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) + * **For an SNS destination:** [sns:Publish](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) @@ -19 +19 @@ Your execution role must have permissions for the destination: - * **For S3 bucket destinations:** [ s3:PutObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html) and [s3:ListBucket](https://docs.aws.amazon.com/AmazonS3/latest/API/ListObjectsV2.html) + * **For an S3 destination:** [ s3:PutObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html) and [s3:ListBucket](https://docs.aws.amazon.com/AmazonS3/latest/API/ListObjectsV2.html) @@ -20,0 +21 @@ Your execution role must have permissions for the destination: + * **For a Kafka destination:** [kafka-cluster:WriteData](https://docs.aws.amazon.com/msk/latest/developerguide/kafka-actions.html) @@ -23,0 +25,3 @@ Your execution role must have permissions for the destination: + +You can configure a Kafka topic as an on-failure destination for your Kafka event source mappings. When Lambda can't process records after exhausting retry attempts or when records exceed the maximum age, Lambda sends the failed records to the specified Kafka topic for later processing. Refer to [Using a Kafka topic as an on-failure destination](./kafka-on-failure-destination.html). + @@ -258 +262 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Polling and stream positions +Retry configurations @@ -260 +264 @@ Polling and stream positions -Event filtering +Kafka on-failure destination