AWS serverless-application-model documentation change
Summary
Updated guidance on intrinsic functions with explicit warning about CodeUri limitations and AWS::LanguageExtensions recommendation
Security assessment
The change clarifies functional limitations of intrinsic functions in SAM templates and recommends workarounds. While misconfiguration could indirectly cause security issues, there's no evidence this change addresses a specific vulnerability or adds security-specific content.
Diff
diff --git a/serverless-application-model/latest/developerguide/sam-specification-intrinsic-functions.md b/serverless-application-model/latest/developerguide/sam-specification-intrinsic-functions.md index 2791a3902..0c865f733 100644 --- a//serverless-application-model/latest/developerguide/sam-specification-intrinsic-functions.md +++ b//serverless-application-model/latest/developerguide/sam-specification-intrinsic-functions.md @@ -9,3 +9 @@ -Intrinsic functions are built-in functions that enable you to assign values to properties that are only available at runtime. `AWS::LanguageExtensions` is a macro hosted by CloudFormation that extends the set of intrinsic functions and template constructs available to you, including `Fn::ForEach`, `Fn::Length`, `Fn::ToJsonString`, and `Fn::FindInMap` with `DefaultValue`. The AWS SAM CLI now supports these language extension constructs locally — it expands them during `sam build`, `sam package`, `sam deploy`, `sam sync`, `sam validate`, and the `sam local` commands so the AWS SAM transform can process them, while CloudFormation processes the same `AWS::LanguageExtensions` transform server-side at deploy time. - -To use language extensions in a AWS SAM template, list `AWS::LanguageExtensions` in the `Transform` section _before_ `AWS::Serverless-2016-10-31`: +Intrinsic functions are built-in functions that enable you to assign values to properties that are only available at runtime. AWS SAM has limited support for certain intrinsic function properties, so it is unable to resolve some intrinsic functions. Consequently, we recommend adding the `AWS::LanguageExtensions` transform to resolve this. The `AWS::LanguageExtensions` is a macro hosted by CloudFormation that lets you use intrinsic functions and other functionalities that are by default not included in CloudFormation. @@ -19 +17,7 @@ To use language extensions in a AWS SAM template, list `AWS::LanguageExtensions` -For details about how the AWS SAM CLI handles language extensions, including using intrinsic functions in `CodeUri` and other packageable properties, see [CloudFormation language extensions support](./sam-specification-language-extensions.html). +###### Note + +If you use intrinsic functions in CodeUri property, AWS SAM will not be able to correctly parse the values. Consider using `AWS::LanguageExtensions` transform instead. + +For more information, refer to [Properties section of AWS::Serverless::Function](./sam-resource-function.html#sam-resource-function-properties). + +For details about how the AWS SAM CLI handles the `AWS::LanguageExtensions` transform, including using intrinsic functions in `CodeUri` and other packageable properties, see [CloudFormation language extensions support](./sam-specification-language-extensions.html).