Skip to content

Fix intermittent Lambda 409 when adding Function URL permissions #6933

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AppleDannyClegg wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

Fix intermittent Lambda 409 when adding Function URL permissions #6933

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 26 additions & 12 deletions platform/src/components/aws/function.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1717,6 +1717,7 @@ export class Function extends Component implements Link.Linkable {
private role: iam.Role;
private logGroup: Output<cloudwatch.LogGroup | undefined>;
private urlEndpoint: Output<string | undefined>;
private urlResource: Output<lambda.FunctionUrl | undefined>;
private eventInvokeConfig?: lambda.FunctionEventInvokeConfig;

private static readonly encryptionKey = lazy(
Expand Down Expand Up @@ -1787,7 +1788,7 @@ export class Function extends Component implements Link.Linkable {
const logGroup = createLogGroup();
const zipAsset = createZipAsset();
const fn = createFunction();
const urlEndpoint = createUrl();
const { endpoint: urlEndpoint, resource: urlResource } = createUrl();
createProvisioned();
const eventInvokeConfig = createEventInvokeConfig();

Expand All @@ -1797,6 +1798,7 @@ export class Function extends Component implements Link.Linkable {
this.role = role;
this.logGroup = logGroup;
this.urlEndpoint = urlEndpoint;
this.urlResource = urlResource;
this.eventInvokeConfig = eventInvokeConfig;

const buildInput = output({
Expand Down Expand Up @@ -2708,9 +2710,13 @@ export class Function extends Component implements Link.Linkable {
);
}

function createUrl() {
return url.apply((url) => {
if (url === undefined) return output(undefined);
function createUrl(): {
endpoint: Output<string | undefined>;
resource: Output<lambda.FunctionUrl | undefined>;
} {
const result = url.apply((url) => {
if (url === undefined)
return { endpoint: output(undefined), resource: undefined };

const authorization = output(url.authorization ?? "none");
const isOac = output(url.route?.routerProtection).apply(
Expand Down Expand Up @@ -2761,7 +2767,7 @@ export class Function extends Component implements Link.Linkable {
principal: "*",
functionUrlAuthType: "NONE",
},
{ parent },
{ parent, dependsOn: [fnUrl] },
);
new lambda.Permission(
`${name}InvokeFunction`,
Expand All @@ -2771,10 +2777,10 @@ export class Function extends Component implements Link.Linkable {
principal: "*",
invokedViaFunctionUrl: true,
},
{ parent },
{ parent, dependsOn: [fnUrl] },
);
});
return fnUrl.functionUrl;
return { endpoint: fnUrl.functionUrl, resource: fnUrl };
}

// Create permissions based on Router protection mode
Expand All @@ -2789,7 +2795,7 @@ export class Function extends Component implements Link.Linkable {
principal: "cloudfront.amazonaws.com",
sourceArn: distributionArn,
},
{ parent },
{ parent, dependsOn: [fnUrl] },
);
new lambda.Permission(
`${name}CloudFrontInvokeFunction`,
Expand All @@ -2800,7 +2806,7 @@ export class Function extends Component implements Link.Linkable {
sourceArn: distributionArn,
invokedViaFunctionUrl: true,
},
{ parent },
{ parent, dependsOn: [fnUrl] },
);
} else if (authorization === "none") {
new lambda.Permission(
Expand All @@ -2811,7 +2817,7 @@ export class Function extends Component implements Link.Linkable {
principal: "*",
functionUrlAuthType: "NONE",
},
{ parent },
{ parent, dependsOn: [fnUrl] },
);
new lambda.Permission(
`${name}PublicInvokeFunction`,
Expand All @@ -2821,7 +2827,7 @@ export class Function extends Component implements Link.Linkable {
principal: "*",
invokedViaFunctionUrl: true,
},
{ parent },
{ parent, dependsOn: [fnUrl] },
);
}
},
Expand Down Expand Up @@ -2890,8 +2896,12 @@ export class Function extends Component implements Link.Linkable {
},
{ parent },
);
return url.route.routerUrl;
return { endpoint: url.route.routerUrl, resource: fnUrl };
});
return {
endpoint: result.apply((r) => r.endpoint),
resource: result.apply((r) => r.resource),
};
}

function createProvisioned() {
Expand Down Expand Up @@ -2960,6 +2970,10 @@ export class Function extends Component implements Link.Linkable {
* The Function Event Invoke Config resource if retries are configured.
*/
eventInvokeConfig: this.eventInvokeConfig,
/**
* The Lambda Function URL resource if `url` is enabled.
*/
url: this.urlResource,
};
}

Expand Down
16 changes: 10 additions & 6 deletions platform/src/components/aws/ssr-site.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1074,6 +1074,7 @@ async function handler(event) {
// Server functions
servers.forEach(({ region, server }) => {
const provider = useProvider(region);
const urlDependsOn = server.nodes.url.apply((u) => (u ? [u] : []));

if (protection.mode === "none") {
new lambda.Permission(
Expand All @@ -1084,7 +1085,7 @@ async function handler(event) {
principal: "*",
functionUrlAuthType: "NONE",
},
{ provider, parent: self },
{ provider, parent: self, dependsOn: urlDependsOn },
);
} else if (
protection.mode === "oac" ||
Expand All @@ -1098,7 +1099,7 @@ async function handler(event) {
principal: "cloudfront.amazonaws.com",
sourceArn: distributionArn,
},
{ provider, parent: self },
{ provider, parent: self, dependsOn: urlDependsOn },
);
new lambda.Permission(
`${name}CloudFrontInvokeFunction${logicalName(region)}`,
Expand All @@ -1109,13 +1110,16 @@ async function handler(event) {
sourceArn: distributionArn,
invokedViaFunctionUrl: true,
},
{ provider, parent: self },
{ provider, parent: self, dependsOn: urlDependsOn },
);
}
});

// Image optimizer
if (imgOptimizer) {
const urlDependsOn = imgOptimizer.nodes.url.apply((u) =>
u ? [u] : [],
);
if (protection.mode === "none") {
new lambda.Permission(
`${name}ImageOptimizerPublicFunctionUrlAccess`,
Expand All @@ -1125,7 +1129,7 @@ async function handler(event) {
principal: "*",
functionUrlAuthType: "NONE",
},
{ parent: self },
{ parent: self, dependsOn: urlDependsOn },
);
} else if (
protection.mode === "oac" ||
Expand All @@ -1139,7 +1143,7 @@ async function handler(event) {
principal: "cloudfront.amazonaws.com",
sourceArn: distributionArn,
},
{ parent: self },
{ parent: self, dependsOn: urlDependsOn },
);
new lambda.Permission(
`${name}ImageOptimizerCloudFrontInvokeFunction`,
Expand All @@ -1150,7 +1154,7 @@ async function handler(event) {
sourceArn: distributionArn,
invokedViaFunctionUrl: true,
},
{ parent: self },
{ parent: self, dependsOn: urlDependsOn },
);
}
}
Expand Down