Skip to content

Commit c8c3b69

Browse files
author
AWS
committed
AWS Lambda Update: Support for JSON resource-based policies and block public access
1 parent ee31e7e commit c8c3b69

File tree

2 files changed

+274
-0
lines changed

2 files changed

+274
-0
lines changed

‎.changes/next-release/feature-AWSLambda-90390be.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "AWS Lambda",
4+
"contributor": "",
5+
"description": "Support for JSON resource-based policies and block public access"
6+
}

‎services/lambda/src/main/resources/codegen-resources/service-2.json

Lines changed: 268 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,24 @@
311311
],
312312
"documentation":"<p>Deletes the provisioned concurrency configuration for a function.</p>"
313313
},
314+
"DeleteResourcePolicy":{
315+
"name":"DeleteResourcePolicy",
316+
"http":{
317+
"method":"DELETE",
318+
"requestUri":"/2024-09-16/resource-policy/{ResourceArn}",
319+
"responseCode":204
320+
},
321+
"input":{"shape":"DeleteResourcePolicyRequest"},
322+
"errors":[
323+
{"shape":"ServiceException"},
324+
{"shape":"ResourceNotFoundException"},
325+
{"shape":"ResourceConflictException"},
326+
{"shape":"InvalidParameterValueException"},
327+
{"shape":"TooManyRequestsException"},
328+
{"shape":"PreconditionFailedException"}
329+
],
330+
"documentation":"<p>Deletes a <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policy</a> from a function.</p>"
331+
},
314332
"GetAccountSettings":{
315333
"name":"GetAccountSettings",
316334
"http":{
@@ -581,6 +599,40 @@
581599
],
582600
"documentation":"<p>Retrieves the provisioned concurrency configuration for a function's alias or version.</p>"
583601
},
602+
"GetPublicAccessBlockConfig":{
603+
"name":"GetPublicAccessBlockConfig",
604+
"http":{
605+
"method":"GET",
606+
"requestUri":"/2024-09-16/public-access-block/{ResourceArn}",
607+
"responseCode":200
608+
},
609+
"input":{"shape":"GetPublicAccessBlockConfigRequest"},
610+
"output":{"shape":"GetPublicAccessBlockConfigResponse"},
611+
"errors":[
612+
{"shape":"ServiceException"},
613+
{"shape":"ResourceNotFoundException"},
614+
{"shape":"TooManyRequestsException"},
615+
{"shape":"InvalidParameterValueException"}
616+
],
617+
"documentation":"<p>Retrieve the public-access settings for a function.</p>"
618+
},
619+
"GetResourcePolicy":{
620+
"name":"GetResourcePolicy",
621+
"http":{
622+
"method":"GET",
623+
"requestUri":"/2024-09-16/resource-policy/{ResourceArn}",
624+
"responseCode":200
625+
},
626+
"input":{"shape":"GetResourcePolicyRequest"},
627+
"output":{"shape":"GetResourcePolicyResponse"},
628+
"errors":[
629+
{"shape":"ServiceException"},
630+
{"shape":"ResourceNotFoundException"},
631+
{"shape":"TooManyRequestsException"},
632+
{"shape":"InvalidParameterValueException"}
633+
],
634+
"documentation":"<p>Retrieves the <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policy</a> attached to a function.</p>"
635+
},
584636
"GetRuntimeManagementConfig":{
585637
"name":"GetRuntimeManagementConfig",
586638
"http":{
@@ -1028,6 +1080,45 @@
10281080
],
10291081
"documentation":"<p>Adds a provisioned concurrency configuration to a function's alias or version.</p>"
10301082
},
1083+
"PutPublicAccessBlockConfig":{
1084+
"name":"PutPublicAccessBlockConfig",
1085+
"http":{
1086+
"method":"PUT",
1087+
"requestUri":"/2024-09-16/public-access-block/{ResourceArn}",
1088+
"responseCode":200
1089+
},
1090+
"input":{"shape":"PutPublicAccessBlockConfigRequest"},
1091+
"output":{"shape":"PutPublicAccessBlockConfigResponse"},
1092+
"errors":[
1093+
{"shape":"ServiceException"},
1094+
{"shape":"ResourceNotFoundException"},
1095+
{"shape":"ResourceConflictException"},
1096+
{"shape":"InvalidParameterValueException"},
1097+
{"shape":"TooManyRequestsException"}
1098+
],
1099+
"documentation":"<p>Configure your function's public-access settings.</p> <p>To control public access to a Lambda function, you can choose whether to allow the creation of <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policies</a> that allow public access to that function. You can also block public access to a function, even if it has an existing resource-based policy that allows it.</p>"
1100+
},
1101+
"PutResourcePolicy":{
1102+
"name":"PutResourcePolicy",
1103+
"http":{
1104+
"method":"PUT",
1105+
"requestUri":"/2024-09-16/resource-policy/{ResourceArn}",
1106+
"responseCode":200
1107+
},
1108+
"input":{"shape":"PutResourcePolicyRequest"},
1109+
"output":{"shape":"PutResourcePolicyResponse"},
1110+
"errors":[
1111+
{"shape":"ServiceException"},
1112+
{"shape":"ResourceNotFoundException"},
1113+
{"shape":"ResourceConflictException"},
1114+
{"shape":"InvalidParameterValueException"},
1115+
{"shape":"PolicyLengthExceededException"},
1116+
{"shape":"TooManyRequestsException"},
1117+
{"shape":"PreconditionFailedException"},
1118+
{"shape":"PublicPolicyException"}
1119+
],
1120+
"documentation":"<p>Adds a <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html\">resource-based policy</a> to a function. You can use resource-based policies to grant access to other <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-cross-account.html\">Amazon Web Services accounts</a>, <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-organization.html\">organizations</a>, or <a href=\"https://docs.aws.amazon.com/lambda/latest/dg/permissions-function-services.html\">services</a>. Resource-based policies apply to a single function, version, or alias.</p> <important> <p>Adding a resource-based policy using this API action replaces any existing policy you've previously created. This means that if you've previously added resource-based permissions to a function using the <a>AddPermission</a> action, those permissions will be overwritten by your new policy.</p> </important>"
1121+
},
10311122
"PutRuntimeManagementConfig":{
10321123
"name":"PutRuntimeManagementConfig",
10331124
"http":{
@@ -2236,6 +2327,24 @@
22362327
}
22372328
}
22382329
},
2330+
"DeleteResourcePolicyRequest":{
2331+
"type":"structure",
2332+
"required":["ResourceArn"],
2333+
"members":{
2334+
"ResourceArn":{
2335+
"shape":"PolicyResourceArn",
2336+
"documentation":"<p>The Amazon Resource Name (ARN) of the function you want to delete the policy from. You can use either a qualified or an unqualified ARN, but the value you specify must be a complete ARN and wildcard characters are not accepted.</p>",
2337+
"location":"uri",
2338+
"locationName":"ResourceArn"
2339+
},
2340+
"RevisionId":{
2341+
"shape":"RevisionId",
2342+
"documentation":"<p>Delete the existing policy only if its revision ID matches the string you specify. To find the revision ID of the policy currently attached to your function, use the <a>GetResourcePolicy</a> action.</p>",
2343+
"location":"querystring",
2344+
"locationName":"RevisionId"
2345+
}
2346+
}
2347+
},
22392348
"Description":{
22402349
"type":"string",
22412350
"max":256,
@@ -3466,6 +3575,52 @@
34663575
}
34673576
}
34683577
},
3578+
"GetPublicAccessBlockConfigRequest":{
3579+
"type":"structure",
3580+
"required":["ResourceArn"],
3581+
"members":{
3582+
"ResourceArn":{
3583+
"shape":"PublicAccessBlockResourceArn",
3584+
"documentation":"<p>The Amazon Resource Name (ARN) of the function you want to retrieve public-access settings for.</p>",
3585+
"location":"uri",
3586+
"locationName":"ResourceArn"
3587+
}
3588+
}
3589+
},
3590+
"GetPublicAccessBlockConfigResponse":{
3591+
"type":"structure",
3592+
"members":{
3593+
"PublicAccessBlockConfig":{
3594+
"shape":"PublicAccessBlockConfig",
3595+
"documentation":"<p>The public-access settings configured for the function you specified</p>"
3596+
}
3597+
}
3598+
},
3599+
"GetResourcePolicyRequest":{
3600+
"type":"structure",
3601+
"required":["ResourceArn"],
3602+
"members":{
3603+
"ResourceArn":{
3604+
"shape":"PolicyResourceArn",
3605+
"documentation":"<p>The Amazon Resource Name (ARN) of the function you want to retrieve the policy for. You can use either a qualified or an unqualified ARN, but the value you specify must be a complete ARN and wildcard characters are not accepted.</p>",
3606+
"location":"uri",
3607+
"locationName":"ResourceArn"
3608+
}
3609+
}
3610+
},
3611+
"GetResourcePolicyResponse":{
3612+
"type":"structure",
3613+
"members":{
3614+
"Policy":{
3615+
"shape":"ResourcePolicy",
3616+
"documentation":"<p>The resource-based policy attached to the function you specified.</p>"
3617+
},
3618+
"RevisionId":{
3619+
"shape":"RevisionId",
3620+
"documentation":"<p>The revision ID of the policy.</p>"
3621+
}
3622+
}
3623+
},
34693624
"GetRuntimeManagementConfigRequest":{
34703625
"type":"structure",
34713626
"required":["FunctionName"],
@@ -4789,6 +4944,11 @@
47894944
"error":{"httpStatusCode":400},
47904945
"exception":true
47914946
},
4947+
"PolicyResourceArn":{
4948+
"type":"string",
4949+
"max":256,
4950+
"pattern":"arn:(aws[a-zA-Z-]*)?:lambda:[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:\\d{12}:function:[a-zA-Z0-9-_]+(:(\\$LATEST|[a-zA-Z0-9-_])+)?"
4951+
},
47924952
"PositiveInteger":{
47934953
"type":"integer",
47944954
"min":1
@@ -4875,6 +5035,38 @@
48755035
"FAILED"
48765036
]
48775037
},
5038+
"PublicAccessBlockConfig":{
5039+
"type":"structure",
5040+
"members":{
5041+
"BlockPublicPolicy":{
5042+
"shape":"NullableBoolean",
5043+
"documentation":"<p>To block the creation of resource-based policies that would grant public access to your function, set <code>BlockPublicPolicy</code> to <code>true</code>. To allow the creation of resource-based policies that would grant public access to your function, set <code>BlockPublicPolicy</code> to <code>false</code>.</p>"
5044+
},
5045+
"RestrictPublicResource":{
5046+
"shape":"NullableBoolean",
5047+
"documentation":"<p>To block public access to your function, even if its resource-based policy allows it, set <code>RestrictPublicResource</code> to <code>true</code>. To allow public access to a function with a resource-based policy that permits it, set <code>RestrictPublicResource</code> to <code>false</code>.</p>"
5048+
}
5049+
},
5050+
"documentation":"<p>An object that defines the public-access settings for a function.</p>"
5051+
},
5052+
"PublicAccessBlockResourceArn":{
5053+
"type":"string",
5054+
"max":170,
5055+
"pattern":"arn:(aws[a-zA-Z-]*)?:lambda:[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:\\d{12}:function:[a-zA-Z0-9-_]+"
5056+
},
5057+
"PublicPolicyException":{
5058+
"type":"structure",
5059+
"members":{
5060+
"Type":{
5061+
"shape":"String",
5062+
"documentation":"<p>The exception type.</p>"
5063+
},
5064+
"Message":{"shape":"String"}
5065+
},
5066+
"documentation":"<p>Lambda prevented your policy from being created because it would grant public access to your function. If you intended to create a public policy, use the <a>PutPublicAccessBlockConfig</a> API action to configure your function's public-access settings to allow public policies.</p>",
5067+
"error":{"httpStatusCode":400},
5068+
"exception":true
5069+
},
48785070
"PublishLayerVersionRequest":{
48795071
"type":"structure",
48805072
"required":[
@@ -5143,6 +5335,70 @@
51435335
}
51445336
}
51455337
},
5338+
"PutPublicAccessBlockConfigRequest":{
5339+
"type":"structure",
5340+
"required":[
5341+
"ResourceArn",
5342+
"PublicAccessBlockConfig"
5343+
],
5344+
"members":{
5345+
"ResourceArn":{
5346+
"shape":"PublicAccessBlockResourceArn",
5347+
"documentation":"<p>The Amazon Resource Name (ARN) of the function you want to configure public-access settings for. Public-access settings are applied at the function level, so you can't apply different settings to function versions or aliases.</p>",
5348+
"location":"uri",
5349+
"locationName":"ResourceArn"
5350+
},
5351+
"PublicAccessBlockConfig":{
5352+
"shape":"PublicAccessBlockConfig",
5353+
"documentation":"<p>An object defining the public-access settings you want to apply.</p> <p>To block the creation of resource-based policies that would grant public access to your function, set <code>BlockPublicPolicy</code> to <code>true</code>. To allow the creation of resource-based policies that would grant public access to your function, set <code>BlockPublicPolicy</code> to <code>false</code>.</p> <p>To block public access to your function, even if its resource-based policy allows it, set <code>RestrictPublicResource</code> to <code>true</code>. To allow public access to a function with a resource-based policy that permits it, set <code>RestrictPublicResource</code> to <code>false</code>.</p> <p>The default setting for both <code>BlockPublicPolicy</code> and <code>RestrictPublicResource</code> is <code>true</code>.</p>"
5354+
}
5355+
}
5356+
},
5357+
"PutPublicAccessBlockConfigResponse":{
5358+
"type":"structure",
5359+
"members":{
5360+
"PublicAccessBlockConfig":{
5361+
"shape":"PublicAccessBlockConfig",
5362+
"documentation":"<p>The public-access settings Lambda applied to your function.</p>"
5363+
}
5364+
}
5365+
},
5366+
"PutResourcePolicyRequest":{
5367+
"type":"structure",
5368+
"required":[
5369+
"ResourceArn",
5370+
"Policy"
5371+
],
5372+
"members":{
5373+
"ResourceArn":{
5374+
"shape":"PolicyResourceArn",
5375+
"documentation":"<p>The Amazon Resource Name (ARN) of the function you want to add the policy to. You can use either a qualified or an unqualified ARN, but the value you specify must be a complete ARN and wildcard characters are not accepted.</p>",
5376+
"location":"uri",
5377+
"locationName":"ResourceArn"
5378+
},
5379+
"Policy":{
5380+
"shape":"ResourcePolicy",
5381+
"documentation":"<p>The JSON resource-based policy you want to add to your function.</p> <p>To learn more about creating resource-based policies for controlling access to Lambda, see <a href=\"https://docs.aws.amazon.com/\">Working with resource-based IAM policies in Lambda</a> in the <i>Lambda Developer Guide</i>.</p>"
5382+
},
5383+
"RevisionId":{
5384+
"shape":"RevisionId",
5385+
"documentation":"<p>Replace the existing policy only if its revision ID matches the string you specify. To find the revision ID of the policy currently attached to your function, use the <a>GetResourcePolicy</a> action.</p>"
5386+
}
5387+
}
5388+
},
5389+
"PutResourcePolicyResponse":{
5390+
"type":"structure",
5391+
"members":{
5392+
"Policy":{
5393+
"shape":"ResourcePolicy",
5394+
"documentation":"<p>The policy Lambda added to your function.</p>"
5395+
},
5396+
"RevisionId":{
5397+
"shape":"RevisionId",
5398+
"documentation":"<p>The revision ID of the policy Lambda added to your function.</p>"
5399+
}
5400+
}
5401+
},
51465402
"PutRuntimeManagementConfigRequest":{
51475403
"type":"structure",
51485404
"required":[
@@ -5371,13 +5627,25 @@
53715627
"error":{"httpStatusCode":502},
53725628
"exception":true
53735629
},
5630+
"ResourcePolicy":{
5631+
"type":"string",
5632+
"max":20480,
5633+
"min":1,
5634+
"pattern":"[\\s\\S]+"
5635+
},
53745636
"ResponseStreamingInvocationType":{
53755637
"type":"string",
53765638
"enum":[
53775639
"RequestResponse",
53785640
"DryRun"
53795641
]
53805642
},
5643+
"RevisionId":{
5644+
"type":"string",
5645+
"max":36,
5646+
"min":36,
5647+
"pattern":"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
5648+
},
53815649
"RoleArn":{
53825650
"type":"string",
53835651
"pattern":"arn:(aws[a-zA-Z-]*)?:iam::\\d{12}:role/?[a-zA-Z_0-9+=,.@\\-_/]+"

0 commit comments

Comments
 (0)