AWS lambda documentation change
Summary
Simplified IAM configuration by replacing custom policy with managed policy, updated durable function configuration defaults, added notes about idempotent invocations and production best practices.
Security assessment
The change adds security documentation about idempotent invocations to prevent duplicate executions, which is a security best practice. It also recommends using published versions/aliases in production for stability. However, there's no evidence of a specific security vulnerability being addressed.
Diff
diff --git a/lambda/latest/dg/durable-getting-started-cli.md b/lambda/latest/dg/durable-getting-started-cli.md index 5687e71a6..92ec78850 100644 --- a//lambda/latest/dg/durable-getting-started-cli.md +++ b//lambda/latest/dg/durable-getting-started-cli.md @@ -49 +49 @@ Create an IAM role with permissions for basic Lambda execution and checkpoint op - 3. Attach the basic execution policy: + 3. Attach the durable execution policy for checkpoint operations and basic execution: @@ -53,17 +53 @@ Create an IAM role with permissions for basic Lambda execution and checkpoint op - --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole - - 4. Create a policy for checkpoint operations. Save this as `checkpoint-policy.json`: - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "lambda:CheckpointDurableExecutions", - "lambda:GetDurableExecutionState" - ], - "Resource": "arn:aws:lambda:REGION:ACCOUNT_ID:function:myDurableFunction" - } - ] - } + --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy @@ -71,9 +54,0 @@ Create an IAM role with permissions for basic Lambda execution and checkpoint op - 5. Create and attach the checkpoint policy: - - aws iam create-policy \ - --policy-name durable-checkpoint-policy \ - --policy-document file://checkpoint-policy.json - - aws iam attach-role-policy \ - --role-name durable-function-role \ - --policy-arn arn:aws:iam::ACCOUNT_ID:policy/durable-checkpoint-policy @@ -82,0 +58 @@ Create an IAM role with permissions for basic Lambda execution and checkpoint op +The `AWSLambdaBasicDurableExecutionRolePolicy` managed policy includes the required permissions for checkpoint operations (`lambda:CheckpointDurableExecutions` and `lambda:GetDurableExecutionState`) and basic Lambda execution. @@ -102 +78 @@ Create your durable function with the `--durable-config` parameter. - --durable-config '{"ExecutionTimeout": 10, "RetentionPeriodInDays":1}' + --durable-config '{"ExecutionTimeout": 3600, "RetentionPeriodInDays":7}' @@ -113 +89 @@ You can only enable durable execution when creating the function. You cannot ena -Durable functions require a qualified ARN (with version or alias) for invocation. Publish a version of your function: +While durable functions can be invoked using the `$LATEST` version qualifier, you must always use a qualified ARN pointing to a stable version to ensure deterministic execution of your code. @@ -133,0 +110,4 @@ Invoke your durable function using the qualified ARN (version or alias). +###### Note + +**Idempotent invocations:** To prevent duplicate executions when retrying failed invocations, you can provide an execution name that ensures at-most-once execution semantics. See [Idempotency](./durable-execution-idempotency.html) for details. + @@ -167,0 +148,4 @@ With asynchronous invocation, Lambda returns immediately. The function continues +###### Note + +You can use `$LATEST` for prototyping and testing in the console. For production workloads, use a published version or alias. + @@ -273,4 +257 @@ Delete your durable function and associated resources: - --policy-arn arn:aws:iam::ACCOUNT_ID:policy/durable-checkpoint-policy - - aws iam delete-policy \ - --policy-arn arn:aws:iam::ACCOUNT_ID:policy/durable-checkpoint-policy + --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy