AWS lambda medium security documentation change
Summary
Added Terraform support, replaced custom IAM permissions with managed policy 'AWSLambdaBasicDurableExecutionRolePolicy', updated timeout/retention defaults, and added Terraform deployment example
Security assessment
The change replaces custom inline IAM policies granting 'lambda:CheckpointDurableExecutions' and 'lambda:GetDurableExecutionState' permissions with a standardized AWS-managed policy. This centralizes permission management and reduces risk of misconfiguration. The managed policy ensures consistent security controls for durable functions across IaC tools.
Diff
diff --git a/lambda/latest/dg/durable-getting-started-iac.md b/lambda/latest/dg/durable-getting-started-iac.md index 79cfbc560..0a2b347d9 100644 --- a//lambda/latest/dg/durable-getting-started-iac.md +++ b//lambda/latest/dg/durable-getting-started-iac.md @@ -5 +5 @@ -AWS CloudFormationAWS CDKAWS Serverless Application ModelCommon configuration patternsNext steps +AWS CloudFormationAWS CDKAWS Serverless Application ModelTerraformCommon configuration patternsNext steps @@ -9 +9 @@ AWS CloudFormationAWS CDKAWS Serverless Application ModelCommon configuration pa -You can deploy Lambda durable functions using Infrastructure as Code (IaC) tools like AWS CloudFormation, AWS CDK, or AWS Serverless Application Model. These tools let you define your function, execution role, and permissions in code, making deployments repeatable and version-controlled. +You can deploy Lambda durable functions using Infrastructure as Code (IaC) tools like AWS CloudFormation, AWS CDK, AWS Serverless Application Model, or Terraform. These tools let you define your function, execution role, and permissions in code, making deployments repeatable and version-controlled. @@ -42,11 +42 @@ Use CloudFormation to define your durable function in a template. The following - - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole - Policies: - - PolicyName: DurableExecutionPolicy - PolicyDocument: - Version: '2012-10-17' - Statement: - - Effect: Allow - Action: - - lambda:CheckpointDurableExecutions - - lambda:GetDurableExecutionState - Resource: !GetAtt DurableFunction.Arn + - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy @@ -68,2 +58,2 @@ Use CloudFormation to define your durable function in a template. The following - ExecutionTimeout: 10 - RetentionPeriodInDays: 1 + ExecutionTimeout: 3600 + RetentionPeriodInDays: 7 @@ -126,9 +115,0 @@ TypeScript - // Add checkpoint permissions - durableFunction.addToRolePolicy(new iam.PolicyStatement({ - actions: [ - 'lambda:CheckpointDurableExecutions', - 'lambda:GetDurableExecutionState', - ], - resources: [durableFunction.functionArn], - })); - @@ -176,8 +157,4 @@ Python - # Add checkpoint permissions - durable_function.add_to_role_policy(iam.PolicyStatement( - actions=[ - 'lambda:CheckpointDurableExecutions', - 'lambda:GetDurableExecutionState', - ], - resources=[durable_function.function_arn] - )) + # Add durable execution managed policy for checkpoint permissions + durable_function.role.add_managed_policy( + iam.ManagedPolicy.from_aws_managed_policy_name('service-role/AWSLambdaBasicDurableExecutionRolePolicy') + ) @@ -223,2 +200,2 @@ AWS SAM simplifies CloudFormation templates for serverless applications. The fol - ExecutionTimeout: 10 - RetentionPeriodInDays: 1 + ExecutionTimeout: 3600 + RetentionPeriodInDays: 7 @@ -226,7 +203 @@ AWS SAM simplifies CloudFormation templates for serverless applications. The fol - - Version: '2012-10-17' - Statement: - - Effect: Allow - Action: - - lambda:CheckpointDurableExecutions - - lambda:GetDurableExecutionState - Resource: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${DurableFunction}' + - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy @@ -248,0 +220,85 @@ AWS SAM simplifies CloudFormation templates for serverless applications. The fol +## Terraform + +Terraform is a popular open-source IaC tool that supports AWS resources. The following example creates a durable function with Terraform using the AWS provider version 6.25.0 or later. + + + terraform { + required_version = ">= 1.0" + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 6.25.0" + } + } + } + + provider "aws" { + region = "us-east-2" + } + + # IAM Role for Lambda Function + resource "aws_iam_role" "lambda_role" { + name = "durable-function-role" + + assume_role_policy = jsonencode({ + Version = "2012-10-17" + Statement = [{ + Action = "sts:AssumeRole" + Effect = "Allow" + Principal = { + Service = "lambda.amazonaws.com" + } + }] + }) + } + + # Attach durable execution policy for checkpoint operations + resource "aws_iam_role_policy_attachment" "lambda_durable" { + policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicDurableExecutionRolePolicy" + role = aws_iam_role.lambda_role.name + } + + # Lambda Function with Durable Execution enabled + resource "aws_lambda_function" "durable_function" { + filename = "function.zip" + function_name = "myDurableFunction" + role = aws_iam_role.lambda_role.arn + handler = "index.handler" + runtime = "nodejs22.x" + timeout = 30 + memory_size = 512 + + durable_config { + execution_timeout = 900 + retention_period = 7 + } + } + + # Publish a version + resource "aws_lambda_alias" "prod" { + name = "prod" + function_name = aws_lambda_function.durable_function.function_name + function_version = aws_lambda_function.durable_function.version + } + + output "function_arn" { + description = "ARN of the Lambda function" + value = aws_lambda_function.durable_function.arn + } + + output "alias_arn" { + description = "ARN of the function alias (use this for invocations)" + value = aws_lambda_alias.prod.arn + } + +**To deploy with Terraform** + + + terraform init + terraform plan + terraform apply + +###### Note + +Terraform support for Lambda durable functions requires AWS provider version 6.25.0 or later. Update your provider version if you're using an older version. + @@ -255 +311 @@ Regardless of which IaC tool you use, follow these patterns for durable function -Set the `DurableExecution.Enabled` property to `true`. This property is only available when creating the function—you cannot enable durable execution on existing functions. +Set the `DurableConfig` property on your function to enable durable execution. This property is only available when creating the function. You cannot enable durable execution on existing functions. @@ -259 +315 @@ Set the `DurableExecution.Enabled` property to `true`. This property is only ava -Add `lambda:CheckpointDurableExecutions` and `lambda:GetDurableExecutionState` to the execution role. Scope these permissions to the specific function ARN. +Attach the `AWSLambdaBasicDurableExecutionRolePolicy` managed policy to the execution role. This policy includes the required `lambda:CheckpointDurableExecutions` and `lambda:GetDurableExecutionState` permissions. @@ -263 +319 @@ Add `lambda:CheckpointDurableExecutions` and `lambda:GetDurableExecutionState` t -Create a version or alias for your function. Durable functions require qualified ARNs (with version or alias) for invocation. Use `AutoPublishAlias` in AWS SAM or create explicit versions in CloudFormation and AWS CDK. +Create a version or alias for your function. Durable functions require qualified ARNs (with version or alias) for invocation. Use `AutoPublishAlias` in AWS SAM or create explicit versions in CloudFormation, AWS CDK, and Terraform. @@ -301 +357 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Using AWS CLI +Deploy with CLI @@ -303 +359 @@ Using AWS CLI -Examples +Durable functions or Step Functions