search

aws-amplify / amplify-cli

The AWS Amplify CLI is a toolchain for simplifying serverless web and mobile development.
Apache License 2.0
2.81k stars 821 forks source link

Unable to update Lambda Layer permissions #8898

Open josefaidt opened 2 years ago

josefaidt commented 2 years ago

Before opening, please confirm:

How did you install the Amplify CLI?

pnpm add -g @aws-amplify/cli

If applicable, what version of Node.js are you using?

v16.13.0

Amplify CLI Version

7.3.3

What operating system are you using?

Mac

Amplify Categories

function

Amplify Commands

update

Describe the bug

After upgrading the CLI to the latest version (7.3.3), I am unable to update lambda layer permissions from a layer created with a previous version of the CLI (6.3.1)

A few observation notes:

Expected behavior

CLI should update the layer accordingly

Reproduction steps

  1. using Amplify CLI v6.3.1, create a lambda layer:

    > amplify add function
⚠️ Amplify command hooks are disabled in the current execution environment.
⚠️ See https://docs.amplify.aws/cli/usage/command-hooks/ for more information.
? Select which capability you want to add: Lambda layer (shared code & resource used across functions)
? Provide a name for your Lambda layer: layer2465d15f
? Choose the runtime that you want to use: NodeJS
? The current AWS account will always have access to this layer.
Optionally, configure who else can access this layer. (Hit <Enter> to skip) Public
✅ Lambda layer folders & files created:
amplify/backend/function/8525layerslayer2465d15f

Next steps:
Move your libraries to the following folder:

Include any files you want to share across runtimes in this folder:
amplify/backend/function/8525layerslayer2465d15f/opt

"amplify function update <function-name>" - configure a function with this Lambda layer
"amplify push" - builds all of your local backend resources and provisions them in the cloud
  2. Push new layer amplify push -y
  3. Upgrade to latest version of CLI pnpm add -g @aws-amplify/cli@latest
  4. Attempt to update lambda layer permissions 
    > amplify update function
⚠️ Amplify command hooks are disabled in the current execution environment.
⚠️ See https://docs.amplify.aws/cli/usage/command-hooks/ for more information.
? Do you want to adjust layer version permissions? Yes
? Select the layer version to update: Future layer versions
? The current AWS account will always have access to this layer.
Optionally, configure who else can access this layer. (Hit <Enter> to skip) Specific AWS accounts, Public
? Provide a list of comma-separated AWS account IDs: xxxxxxxx

  5. Observe CLI exits with no clear indication of failed or successful update, running amplify status -v shows no changes

    > amplify status -v
⚠️ Amplify command hooks are disabled in the current execution environment.
⚠️ See https://docs.amplify.aws/cli/usage/command-hooks/ for more information.

    Current Environment: dev

┌──────────┬─────────────────────────┬───────────┬───────────────────┐
│ Category │ Resource name           │ Operation │ Provider plugin   │
├──────────┼─────────────────────────┼───────────┼───────────────────┤
│ Function │ 8525layerslayer2465d15f │ No Change │ awscloudformation │
└──────────┴─────────────────────────┴───────────┴───────────────────┘

GraphQL schema(s)

```graphql # Put schemas below this line ```

Log output

``` # Put your logs below this line ```

Additional information

No response

sachscode commented 2 years ago

Need more clarity on the problem :

  1. Option: "Future layer versions" is the default configuration, hence there is no visible change. This also means that config changes are applied to future lambda layers.
  2. Validated : Add Lambda Layer with 6.3.1 and update lambda layer permission for the existing layer with the latest (7.5.5) works as expected.
sachscode commented 2 years ago

The feature functionality works fine. Tested the following flows:

  1. Create lambda layer, add 2 accounts ( aws1, aws2)
  2. Update lambda layer, replace the above 2 accounts with a third account ( aws3 ) . Push and validate in the layer-configs
  3. Update lambda layer and "un-select" the aws account option . (This removed the account- aws3 ) , and push . All flows worked fine.

UX issues :

  1. Remove "- Access permissions: Maintain existing permissions" prompt, when permissions for future revisions are only updated. This prompt is confusing , since it refers to the current layer instead of future layers.
  2. When "public" access is enabled on the lambda layer, disable addition and removal of aws accounts in the update walkthrough.
  3. amplify -status -v : Needs to be updated to query layer-configuration.json, since layers do not update cloudformation on every permission update.
  4. AWS Lambda console doesn't show any information for account permissions added for the lambda layers. This needs to be updated .
  5. amplify status should show the lambda layers and access accounts
sachscode commented 2 years ago

Moved issue to feature request to address UX upgrades

n-ae commented 1 year ago

Do note that this is the error yielded when such layer doesn't exist on that region. I.e:

An error occurred (AccessDeniedException) when calling the UpdateFunctionConfiguration operation: User: arn:aws:iam::***:user/{username} is not authorized to perform: lambda:GetLayerVersion on resource: arn:aws:lambda:us-east-1:015030872274:layer:AWS-Parameters-and-Secrets-Lambda-Extension:4 because no resource-based policy allows the lambda:GetLayerVersion action

Pay special attention to the fact that account_ids may differ for the same aws managed lambda layer from region to region.