AWS lambda medium security documentation change
Summary
Added new section 'Kafka: Error handling and retry configuration issues' with guidance on Kafka event source mapping retry settings, common configuration errors, and permission requirements
Security assessment
The change addresses security-related misconfigurations such as infinite retries (potential resource exhaustion), same-topic recursion (data integrity risks), and missing kafka:WriteData permissions (access control). These could lead to message loss, infinite processing loops, or unauthorized access if misconfigured.
Diff
diff --git a/lambda/latest/dg/troubleshooting-execution.md b/lambda/latest/dg/troubleshooting-execution.md index fcc344e98..8d96607b8 100644 --- a//lambda/latest/dg/troubleshooting-execution.md +++ b//lambda/latest/dg/troubleshooting-execution.md @@ -5 +5 @@ -Lambda: Remote debugging with Visual Studio CodeLambda: Execution takes too longLambda: Unexpected event payloadLambda: Unexpectedly large payload sizesLambda: JSON encoding and decoding errorsLambda: Logs or traces don't appearLambda: Not all of my function's logs appearLambda: The function returns before execution finishesLambda: Running an unintended function version or aliasLambda: Detecting infinite loopsGeneral: Downstream service unavailabilityAWS SDK: Versions and updatesPython: Libraries load incorrectlyJava: Your function takes longer to process events after updating to Java 17 from Java 11 +Lambda: Remote debugging with Visual Studio CodeLambda: Execution takes too longLambda: Unexpected event payloadLambda: Unexpectedly large payload sizesLambda: JSON encoding and decoding errorsLambda: Logs or traces don't appearLambda: Not all of my function's logs appearLambda: The function returns before execution finishesLambda: Running an unintended function version or aliasLambda: Detecting infinite loopsGeneral: Downstream service unavailabilityAWS SDK: Versions and updatesPython: Libraries load incorrectlyJava: Your function takes longer to process events after updating to Java 17 from Java 11Kafka: Error handling and retry configuration issues @@ -44,0 +45,2 @@ When your function code or the Lambda runtime return an error, the status code i + * Kafka: Error handling and retry configuration issues + @@ -286,0 +289,19 @@ Tune your compiler using the `JAVA_TOOL_OPTIONS` parameter. Lambda runtimes for +## Kafka: Error handling and retry configuration issues + +**Issue:** _Kafka event source mapping fails to configure retry settings or on-failure destinations_ + +Kafka retry configurations and on-failure destinations are only available for event source mappings with provisioned mode enabled. Ensure that you have configured `MinimumPollers` in your `ProvisionedPollerConfig` before attempting to set retry configurations. + +Common configuration errors: + + * **Infinite retries with bisect batch** – You cannot enable `BisectBatchOnFunctionError` when `MaximumRetryAttempts` is set to -1 (infinite). Set a finite retry limit or disable bisect batch. + + * **Same topic recursion** – The Kafka on-failure destination topic cannot be the same as any of your source topics. Choose a different topic name for your dead letter topic. + + * **Invalid Kafka destination format** – Use the `kafka://<topic-name>` format when specifying a Kafka topic as an on-failure destination. + + * **kafka:WriteData permission issues** – Ensure your execution role has `kafka-cluster:WriteData` permissions for the destination topic. Topic doesn't exist timeout exceptions or write API throttling issues may require increasing the account limits. + + + +