AWS lambda documentation change
Summary
Added Kafka as a supported destination for failed event source mapping invocations and included required Kafka permissions
Security assessment
The change adds documentation about Kafka integration as a failure destination and specifies required IAM permissions (kafka-cluster:WriteData). While this includes security-related permissions guidance, there is no evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/lambda/latest/dg/kinesis-on-failure-destination.md b/lambda/latest/dg/kinesis-on-failure-destination.md index ea8562d79..ef48eaea2 100644 --- a//lambda/latest/dg/kinesis-on-failure-destination.md +++ b//lambda/latest/dg/kinesis-on-failure-destination.md @@ -22 +22 @@ If the error handling measures fail, Lambda discards the records and continues p -To retain records of failed event source mapping invocations, add a destination to your function's event source mapping. Each record sent to the destination is a JSON document containing metadata about the failed invocation. For Amazon S3 destinations, Lambda also sends the entire invocation record along with the metadata. You can configure any Amazon SNS topic, Amazon SQS queue, or S3 bucket as a destination. +To retain records of failed event source mapping invocations, add a destination to your function's event source mapping. Each record sent to the destination is a JSON document containing metadata about the failed invocation. For Amazon S3 destinations, Lambda also sends the entire invocation record along with the metadata. You can configure any Amazon SNS topic, Amazon SQS queue, Amazon S3 bucket, or Kafka as a destination. @@ -28 +28 @@ Your execution role must have permissions for the destination: - * **For SQS destinations:** [sqs:SendMessage](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html) + * **For an SQS destination:** [sqs:SendMessage](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_SendMessage.html) @@ -30 +30 @@ Your execution role must have permissions for the destination: - * **For SNS destinations:** [sns:Publish](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) + * **For an SNS destination:** [sns:Publish](https://docs.aws.amazon.com/sns/latest/api/API_Publish.html) @@ -32 +32 @@ Your execution role must have permissions for the destination: - * **For S3 bucket destinations:** [ s3:PutObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html) and [s3:ListBucket](https://docs.aws.amazon.com/AmazonS3/latest/API/ListObjectsV2.html) + * **For an S3 destination:** [ s3:PutObject](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html) and [s3:ListBucket](https://docs.aws.amazon.com/AmazonS3/latest/API/ListObjectsV2.html) @@ -33,0 +34 @@ Your execution role must have permissions for the destination: + * **For a Kafka destination:** [kafka-cluster:WriteData](https://docs.aws.amazon.com/msk/latest/developerguide/kafka-actions.html) @@ -36,0 +38,3 @@ Your execution role must have permissions for the destination: + +You can configure a Kafka topic as an on-failure destination for your Kafka event source mappings. When Lambda can't process records after exhausting retry attempts or when records exceed the maximum age, Lambda sends the failed records to the specified Kafka topic for later processing. Refer to [Using a Kafka topic as an on-failure destination](./kafka-on-failure-destination.html). +