Merge pull request #159 from mapbox/unique-lambda-policy-names

ryndaniels · web-flow · commit d8edef37daed · 2025-11-27T10:29:28.000+02:00
Use unique names for the lambda policies
diff --git a/changelog.md b/changelog.md
@@ -1,13 +1,17 @@
 # Changelog
 
+## 9.1.0
+
+- Change the policy name for the Lambda shortcuts to include the stack's LogicalName
+
 ## 9.0.0
 
-- Removes: 
+- Removes:
    - aws-sdk as a runtime dependency.
    - All node support prior to version 20.
-- Adds: 
+- Adds:
   - `@aws-sdk/client-cloudformation` as a runtime dependency.
-- Updates: 
+- Updates:
     - bin/validate-template to use `@aws-sdk/client-cloudformation`.
     - Lambda shortcut lambda runtime default to use `node22.x`
 
diff --git a/lib/shortcuts/lambda.js b/lib/shortcuts/lambda.js
@@ -203,7 +203,7 @@ class Lambda {
         Condition,
         DependsOn: (RoleArn) ? undefined : `${LogicalName}Role`,
         Properties: {
-          PolicyName: 'lambda-log-access',
+          PolicyName: `${LogicalName}-lambda-log-access`,
           Roles: [roleName],
           PolicyDocument: {
             Version: '2012-10-17',
diff --git a/package-lock.json b/package-lock.json
diff --git a/test/fixtures/shortcuts/event-lambda-custom-eventbus.json b/test/fixtures/shortcuts/event-lambda-custom-eventbus.json
@@ -87,7 +87,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/event-lambda-defaults.json b/test/fixtures/shortcuts/event-lambda-defaults.json
@@ -87,7 +87,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/event-lambda-full.json b/test/fixtures/shortcuts/event-lambda-full.json
@@ -87,7 +87,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/hookshot-github-compatible-legacy-node-runtimes.json b/test/fixtures/shortcuts/hookshot-github-compatible-legacy-node-runtimes.json
@@ -175,7 +175,7 @@
         },
         "Handler": "index.lambda",
         "MemorySize": 128,
-        "Runtime": "nodejs16.x",
+        "Runtime": "nodejs22.x",
         "Timeout": 30,
         "Role": {
           "Fn::GetAtt": [
@@ -225,7 +225,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -366,7 +366,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/hookshot-github-secret-ref.json b/test/fixtures/shortcuts/hookshot-github-secret-ref.json
@@ -231,7 +231,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -372,7 +372,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/hookshot-github-secret-string.json b/test/fixtures/shortcuts/hookshot-github-secret-string.json
@@ -225,7 +225,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -366,7 +366,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/hookshot-github.json b/test/fixtures/shortcuts/hookshot-github.json
@@ -233,7 +233,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -374,7 +374,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/hookshot-passthrough-access-log-format.json b/test/fixtures/shortcuts/hookshot-passthrough-access-log-format.json
@@ -229,7 +229,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -370,7 +370,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/hookshot-passthrough-alarms.json b/test/fixtures/shortcuts/hookshot-passthrough-alarms.json
@@ -213,7 +213,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -354,7 +354,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/hookshot-passthrough-compatible-legacy-node-runtimes.json b/test/fixtures/shortcuts/hookshot-passthrough-compatible-legacy-node-runtimes.json
@@ -161,7 +161,7 @@
         },
         "Handler": "index.lambda",
         "MemorySize": 128,
-        "Runtime": "nodejs16.x",
+        "Runtime": "nodejs22.x",
         "Timeout": 30,
         "Role": {
           "Fn::GetAtt": [
@@ -211,7 +211,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -352,7 +352,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/hookshot-passthrough-enhanced-logging.json b/test/fixtures/shortcuts/hookshot-passthrough-enhanced-logging.json
@@ -211,7 +211,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -352,7 +352,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/hookshot-passthrough-full-blown-logging.json b/test/fixtures/shortcuts/hookshot-passthrough-full-blown-logging.json
@@ -211,7 +211,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -352,7 +352,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/hookshot-passthrough-logging.json b/test/fixtures/shortcuts/hookshot-passthrough-logging.json
@@ -211,7 +211,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -352,7 +352,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/hookshot-passthrough.json b/test/fixtures/shortcuts/hookshot-passthrough.json
@@ -211,7 +211,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "PassFunctionRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "PassFunction-lambda-log-access",
         "Roles": [
           {
             "Ref": "PassFunctionRole"
@@ -352,7 +352,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "DestinationRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "Destination-lambda-log-access",
         "Roles": [
           {
             "Ref": "DestinationRole"
diff --git a/test/fixtures/shortcuts/lambda-defaults.json b/test/fixtures/shortcuts/lambda-defaults.json
@@ -87,7 +87,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/lambda-docker.json b/test/fixtures/shortcuts/lambda-docker.json
@@ -85,7 +85,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/lambda-full.json b/test/fixtures/shortcuts/lambda-full.json
@@ -121,7 +121,7 @@
       "Condition": "Always",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/lambda-provided-role.json b/test/fixtures/shortcuts/lambda-provided-role.json
@@ -86,7 +86,7 @@
     "MyLambdaLogPolicy": {
       "Type": "AWS::IAM::Policy",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Fn::Select": [
diff --git a/test/fixtures/shortcuts/lambda-zipfile.json b/test/fixtures/shortcuts/lambda-zipfile.json
@@ -86,7 +86,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/log-subscription-lambda-defaults.json b/test/fixtures/shortcuts/log-subscription-lambda-defaults.json
@@ -87,7 +87,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/log-subscription-lambda-no-defaults.json b/test/fixtures/shortcuts/log-subscription-lambda-no-defaults.json
@@ -87,7 +87,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/queue-lambda-zero.json b/test/fixtures/shortcuts/queue-lambda-zero.json
@@ -88,7 +88,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/queue-lambda.json b/test/fixtures/shortcuts/queue-lambda.json
@@ -88,7 +88,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/scheduled-lambda-defaults.json b/test/fixtures/shortcuts/scheduled-lambda-defaults.json
@@ -87,7 +87,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/scheduled-lambda-full.json b/test/fixtures/shortcuts/scheduled-lambda-full.json
@@ -87,7 +87,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/stream-lambda-defaults.json b/test/fixtures/shortcuts/stream-lambda-defaults.json
@@ -87,7 +87,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"
diff --git a/test/fixtures/shortcuts/stream-lambda-no-defaults.json b/test/fixtures/shortcuts/stream-lambda-no-defaults.json
@@ -87,7 +87,7 @@
       "Type": "AWS::IAM::Policy",
       "DependsOn": "MyLambdaRole",
       "Properties": {
-        "PolicyName": "lambda-log-access",
+        "PolicyName": "MyLambda-lambda-log-access",
         "Roles": [
           {
             "Ref": "MyLambdaRole"

Original file line number	Diff line number	Diff line change
`@@ -87,7 +87,7 @@`
`87`	`87`	`"Type": "AWS::IAM::Policy",`
`88`	`88`	`"DependsOn": "MyLambdaRole",`
`89`	`89`	`"Properties": {`
`90`		`- "PolicyName": "lambda-log-access",`
	`90`	`+ "PolicyName": "MyLambda-lambda-log-access",`
`91`	`91`	`"Roles": [`
`92`	`92`	`{`
`93`	`93`	`"Ref": "MyLambdaRole"`