getlift / lift

Expanding Serverless Framework beyond functions using the AWS CDK
MIT License
912 stars 109 forks source link

How to add complementary permissions for queue's worker ? #376

Closed piolet closed 6 months ago

piolet commented 6 months ago

Description

Hi,

I want use queue construct to build a service which send an email when a message is pushed on queue. For that, my worker use ses service. But when i try basically, in logs, i can see an error indicate the lambda doesn't have the require permissions for that. If i add or update manually the role to manage ses: for every resources (), it's ok. But, if i update serverless.yml like documentation about permissions, i don't have the expected result.

How to Reproduce

this my serverless.yml :

service: email-sender
frameworkVersion: '3'

provider:
  name: aws
  runtime: nodejs20.x
  region: eu-west-3
  architecture: arm64
  iam:
    role:
      statements:
        - Effect: Allow
          Action: [ "ses:*" ]
          Resource:
            - ${construct:email-queue.queueArn}
            - "arn:aws:lambda:eu-west-3:*:function:email-sender-*-email-queueWorker"
#
#lift:
#  automaticPermissions: false

constructs:
  email-queue:
    type: queue
    worker:
      handler: src/handler.hello

...

Additional Information

Maybe it will be pretty cool to expose also que worker arn on build's result ?