awslabs / landing-zone-accelerator-on-aws

Deploy a multi-account cloud foundation to support highly-regulated workloads and complex compliance requirements.
https://aws.amazon.com/solutions/implementations/landing-zone-accelerator-on-aws/
Apache License 2.0
564 stars 449 forks source link

Customization breaks Lambda@Edge functions due to SOLUTION_ID Environment Variable #643

Open kisst opened 1 week ago

kisst commented 1 week ago

Describe the bug As part of the customization re-render my Lambda Function is modified by adding the SOLUTION_ID Environment Variable, ( adding the extra SSM parameters , which makes it incompatible with Lambda@Edge as they are unsupported https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-at-edge-function-restrictions.html#lambda-at-edge-restrictions-features As far as I am considered this is a bug, as it modifies the code I have provided in a matter which makes it unusable, but it might be considered as a feature request, to be able to tell as part of the https://awslabs.github.io/landing-zone-accelerator-on-aws/latest/typedocs/latest/interfaces/___packages__aws_accelerator_config_lib_models_customizations_config.ICloudFormationStack.html stack definition that this stack should not be modified, although I believe generally this modification is unwanted for all customization.

The use-case is, a centralized route in CDN to be deployed from LZA, and to make some smarter application routing I added and inline lambda function to be deployed on the Edge.

To Reproduce Try to deploy this simple template, as part of the customization.

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  HelloWorldLambdaFunction:
    Type: 'AWS::Lambda::Function'
    Properties:
      Handler: index.lambda_handler
      Role: !GetAtt LambdaExecutionRole.Arn
      Code:
        ZipFile: |
          def lambda_handler(event, context):
              return 'Hello, World!'
      Runtime: python3.9

  LambdaExecutionRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: [lambda.amazonaws.com]
            Action: ['sts:AssumeRole']
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

Check the deployed function's Env variables

Expected behavior Lambda functions or in general customisation codes are left alone, and not modified any further then needed ( SSM parameters for solution tracking )

Please complete the following information about the solution: