AWS cli documentation change
Summary
Updated AWS Lambda create-function CLI reference to version 2.35.8. Added new runtime versions (Node.js 18.x-24.x, Java 17/21/25, Python 3.10-3.14, .NET 10). Enhanced parameter constraints (min/max values, patterns) for security-related fields including VPC configs, IAM roles, and code signing. Added new --publish-to and --tenancy-config options. Updated ARN patterns to support new region formats.
Security assessment
The changes add documentation for security features like VPC subnet/SG pattern validation, IAM role length constraints, code signing ARN patterns, and tenant isolation configuration. However, there's no evidence these changes address specific vulnerabilities; they improve existing security documentation.
Diff
diff --git a/cli/latest/reference/lambda/create-function.md b/cli/latest/reference/lambda/create-function.md index eeabf54d0..4d25121eb 100644 --- a//cli/latest/reference/lambda/create-function.md +++ b//cli/latest/reference/lambda/create-function.md @@ -15 +15 @@ - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) » @@ -92,0 +93 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda + [--publish-to <value>] @@ -102 +102,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda - [--image-config <value>] @@ -103,0 +104 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda + [--image-config <value>] @@ -107,0 +109 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda + [--tenancy-config <value>] @@ -109 +110,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda - [--publish-to <value>] @@ -111 +111,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda - [--tenancy-config <value>] @@ -156 +156 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda -> * pattern: `(arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:)?(\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\$LATEST|[a-zA-Z0-9-_]+))?` +> * pattern: `(arn:(aws[a-zA-Z-]*)?:lambda:)?((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:)?(\d{12}:)?(function:)?([a-zA-Z0-9-_]+)(:(\$LATEST|[a-zA-Z0-9-_]+))?` @@ -177,0 +178,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda +> * `nodejs18.x` +> * `nodejs20.x` +> * `nodejs22.x` +> * `nodejs24.x` @@ -180,0 +185,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda +> * `java17` +> * `java21` +> * `java25` @@ -185,0 +193,5 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda +> * `python3.10` +> * `python3.11` +> * `python3.12` +> * `python3.13` +> * `python3.14` @@ -191,0 +204 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda +> * `dotnet10` @@ -196,5 +208,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda -> * `provided` -> * `provided.al2` -> * `nodejs18.x` -> * `python3.10` -> * `java17` @@ -204,11 +211,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda -> * `python3.11` -> * `nodejs20.x` -> * `provided.al2023` -> * `python3.12` -> * `java21` -> * `python3.13` -> * `nodejs22.x` -> * `nodejs24.x` -> * `python3.14` -> * `java25` -> * `dotnet10` @@ -215,0 +213,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda +> * `provided` +> * `provided.al2` +> * `provided.al2023` @@ -224,0 +225,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda +> * min: `0` +> * max: `10000` @@ -264,0 +267 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda +>> * pattern: `.*` @@ -275,0 +279 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda +>> * pattern: `.*` @@ -288,0 +293,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/lambda +>> * min: `0` +>> * max: `10000` @@ -328,0 +335 @@ JSON Syntax: +> * max: `5400` @@ -346,0 +354,10 @@ JSON Syntax: +`--publish-to` (string) + +> Specifies where to publish the function version or configuration. +> +> Possible values: +> +> * `LATEST_PUBLISHED` +> + + @@ -362,0 +380,8 @@ JSON Syntax: +>> +>>> Constraints: +>>> +>>> * min: `0` +>>> * max: `1024` +>>> * pattern: `subnet-[0-9a-z]*` +>>> + @@ -375,0 +401,8 @@ JSON Syntax: +>> +>>> Constraints: +>>> +>>> * min: `0` +>>> * max: `1024` +>>> * pattern: `sg-[0-9a-zA-Z]*` +>>> + @@ -417,0 +451,2 @@ JSON Syntax: +>> * min: `0` +>> * max: `10000` @@ -483,0 +519,2 @@ JSON Syntax: +> * min: `0` +> * max: `10000` @@ -521,0 +559,8 @@ JSON Syntax: +> +>> Constraints: +>> +>> * min: `1` +>> * max: `128` +>> * pattern: `([\p{L}\p{Z}\p{N}_.:/=+\-@]*)` +>> + @@ -523,0 +569,8 @@ JSON Syntax: +> +>> Constraints: +>> +>> * min: `0` +>> * max: `256` +>> * pattern: `([\p{L}\p{Z}\p{N}_.:/=+\-@]*)` +>> + @@ -547,2 +600,2 @@ JSON Syntax: ->> * max: `140` ->> * pattern: `arn:[a-zA-Z0-9-]+:lambda:[a-zA-Z0-9-]+:\d{12}:layer:[a-zA-Z0-9-_]+:[0-9]+` +>> * max: `2048` +>> * pattern: `((arn:(aws[a-zA-Z-]*)?:lambda:(eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:\d{12}:layer:[a-zA-Z0-9-_]+:[0-9]+)|(arn:[a-zA-Z0-9-]+:lambda:::awslayer:[a-zA-Z0-9-_]+))` @@ -581 +634 @@ Syntax: ->>> * pattern: `arn:aws[a-zA-Z-]*:elasticfilesystem:[a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-\d{1}:\d{12}:access-point/fsap-[a-f0-9]{17}$|^arn:aws[-a-z]*:s3files:[0-9a-z-:]+:file-system/fs-[0-9a-f]{17,40}/access-point/fsap-[0-9a-f]{17,40}` +>>> * pattern: `arn:aws[a-zA-Z-]*:elasticfilesystem:(eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:\d{12}:access-point/fsap-[a-f0-9]{17}$|^arn:aws[-a-z]*:s3files:[0-9a-z-:]+:file-system/fs-[0-9a-f]{17,40}/access-point/fsap-[0-9a-f]{17,40}` @@ -614,0 +668,12 @@ JSON Syntax: +`--code-signing-config-arn` (string) + +> To enable code signing for this function, specify the ARN of a code-signing configuration. A code-signing configuration includes a set of signing profiles, which define the trusted publishers for this function. +> +> Constraints: +> +> * min: `0` +> * max: `200` +> * pattern: `arn:(aws[a-zA-Z-]*)?:lambda:(eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:\d{12}:code-signing-config:csc-[a-z0-9]{17}` +> + + @@ -672,12 +736,0 @@ JSON Syntax: -`--code-signing-config-arn` (string) - -> To enable code signing for this function, specify the ARN of a code-signing configuration. A code-signing configuration includes a set of signing profiles, which define the trusted publishers for this function. -> -> Constraints: -> -> * min: `0` -> * max: `200` -> * pattern: `arn:(aws[a-zA-Z-]*)?:lambda:[a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-\d{1}:\d{12}:code-signing-config:csc-[a-z0-9]{17}` -> - - @@ -838,0 +892,28 @@ JSON Syntax: +`--tenancy-config` (structure) + +> Configuration for multi-tenant applications that use Lambda functions. Defines tenant isolation settings and resource allocations. Required for functions supporting multiple tenants. +> +> TenantIsolationMode -> (string) [required] +> +>> Tenant isolation mode allows for invocation to be sent to a corresponding execution environment dedicated to a specific tenant ID. +>> +>> Possible values: +>> +>> * `PER_TENANT` +>> + + +Shorthand Syntax: + + + TenantIsolationMode=string + + +JSON Syntax: + + + { + "TenantIsolationMode": "PER_TENANT" + } + + @@ -855 +936 @@ JSON Syntax: ->>> * pattern: `arn:aws[a-zA-Z-]*:lambda:[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:\d{12}:capacity-provider:[a-zA-Z0-9-_]+` +>>> * pattern: `arn:aws[a-zA-Z-]*:lambda:(eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:\d{12}:capacity-provider:[a-zA-Z0-9-_]+` @@ -876,2 +957,2 @@ JSON Syntax: ->>> * min: `2.0` ->>> * max: `8.0` +>>> * min: `2` +>>> * max: `8` @@ -899,10 +979,0 @@ JSON Syntax: -`--publish-to` (string) -