Skip to content

Commit 453a3bf

Browse files
aaythapaaaythapa
committed
feat: support SourceKMSKeyArn
1 parent c029c63 commit 453a3bf

File tree

14 files changed

+431
-20
lines changed

14 files changed

+431
-20
lines changed

‎.cfnlintrc.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,7 @@ ignore_templates:
131131
- tests/translator/output/**/function_with_mq.json # Property "EventSourceArn" can Fn::GetAtt to a resource of types [AWS::DynamoDB::GlobalTable, AWS::DynamoDB::Table, AWS::Kinesis::Stream, AWS::Kinesis::StreamConsumer, AWS::SQS::Queue]
132132
- tests/translator/output/**/function_with_mq_using_autogen_role.json # Property "EventSourceArn" can Fn::GetAtt to a resource of types [AWS::DynamoDB::GlobalTable, AWS::DynamoDB::Table, AWS::Kinesis::Stream, AWS::Kinesis::StreamConsumer, AWS::SQS::Queue]
133133
- tests/translator/output/**/function_with_recursive_loop.json # Invalid Property Resources/RecursiveLoopParameterFunction/Properties/RecursiveLoop
134+
- tests/translator/output/**/function_with_sourcekmskeyarn.json # Invalid Property Resources/SourceKMSKeyArnParameterFunction/Properties/SourceKMSKeyArn
134135
- tests/translator/output/**/function_with_tracing.json # Obsolete DependsOn on resource
135136
- tests/translator/output/**/api_with_propagate_tags.json # TODO: Intentional error transform tests. Will be updated.
136137
- tests/translator/output/**/function_with_intrinsics_resource_attribute.json # CFN now supports intrinsics in DeletionPolicy

‎samtranslator/internal/schema_source/aws_serverless_function.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -513,6 +513,7 @@ class ScheduleV2Event(BaseModel):
513513
RuntimeManagementConfig = Optional[PassThroughProp] # TODO: check the type
514514
LoggingConfig = Optional[PassThroughProp] # TODO: add documentation
515515
RecursiveLoop = Optional[PassThroughProp]
516+
SourceKMSKeyArn = Optional[PassThroughProp]
516517

517518

518519
class Properties(BaseModel):
@@ -640,6 +641,7 @@ class Properties(BaseModel):
640641
VpcConfig: Optional[VpcConfig] = prop("VpcConfig")
641642
LoggingConfig: Optional[PassThroughProp] # TODO: add documentation
642643
RecursiveLoop: Optional[PassThroughProp] # TODO: add documentation
644+
SourceKMSKeyArn: Optional[PassThroughProp] # TODO: add documentation
643645

644646

645647
class Globals(BaseModel):
@@ -699,6 +701,7 @@ class Globals(BaseModel):
699701
RuntimeManagementConfig: Optional[RuntimeManagementConfig] = prop("RuntimeManagementConfig")
700702
LoggingConfig: Optional[PassThroughProp] # TODO: add documentation
701703
RecursiveLoop: Optional[PassThroughProp] # TODO: add documentation
704+
SourceKMSKeyArn: Optional[PassThroughProp] # TODO: add documentation
702705

703706

704707
class Resource(ResourceAttributes):

‎samtranslator/model/sam_resources.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,6 +180,7 @@ class SamFunction(SamResourceMacro):
180180
"RuntimeManagementConfig": PassThroughProperty(False),
181181
"LoggingConfig": PassThroughProperty(False),
182182
"RecursiveLoop": PassThroughProperty(False),
183+
"SourceKMSKeyArn": PassThroughProperty(False),
183184
}
184185

185186
FunctionName: Optional[Intrinsicable[str]]
@@ -223,6 +224,7 @@ class SamFunction(SamResourceMacro):
223224
FunctionUrlConfig: Optional[Dict[str, Any]]
224225
LoggingConfig: Optional[Dict[str, Any]]
225226
RecursiveLoop: Optional[str]
227+
SourceKMSKeyArn: Optional[str]
226228

227229
event_resolver = ResourceTypeResolver(
228230
samtranslator.model.eventsources,
@@ -880,7 +882,10 @@ def _construct_inline_code(*args: Any, **kwargs: Dict[str, Any]) -> Dict[str, An
880882
else:
881883
raise InvalidResourceException(self.logical_id, "Either 'InlineCode' or 'CodeUri' must be set.")
882884
dispatch_function: Callable[..., Dict[str, Any]] = artifact_dispatch[filtered_key]
883-
return dispatch_function(artifacts[filtered_key], self.logical_id, filtered_key)
885+
code_dict = dispatch_function(artifacts[filtered_key], self.logical_id, filtered_key)
886+
if self.SourceKMSKeyArn and packagetype == ZIP:
887+
code_dict["SourceKMSKeyArn"] = self.SourceKMSKeyArn
888+
return code_dict
884889

885890
def _construct_version(
886891
self, function: LambdaFunction, intrinsics_resolver: IntrinsicsResolver, code_sha256: Optional[str] = None

‎samtranslator/plugins/globals/globals.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ class Globals:
5555
"RuntimeManagementConfig",
5656
"LoggingConfig",
5757
"RecursiveLoop",
58+
"SourceKMSKeyArn",
5859
],
5960
# Everything except
6061
# DefinitionBody: because its hard to reason about merge of Swagger dictionaries
@@ -99,7 +100,7 @@ class Globals:
99100
}
100101
# unreleased_properties *must be* part of supported_properties too
101102
unreleased_properties: Dict[str, List[str]] = {
102-
SamResourceType.Function.value: ["RuntimeManagementConfig", "RecursiveLoop"],
103+
SamResourceType.Function.value: ["RuntimeManagementConfig", "RecursiveLoop", "SourceKMSKeyArn"],
103104
}
104105

105106
def __init__(self, template: Dict[str, Any]) -> None:

‎samtranslator/schema/schema.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278792,6 +278792,9 @@
278792278792
"markdownDescription": "Create a snapshot of any new Lambda function version\\. A snapshot is a cached state of your initialized function, including all of its dependencies\\. The function is initialized just once and the cached state is reused for all future invocations, improving application performance by reducing the number of times your function must be initialized\\. To learn more, see [Improving startup performance with Lambda SnapStart](https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html) in the *AWS Lambda Developer Guide*\\. \n*Type*: [SnapStart](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstart.html) \n*Required*: No \n*AWS CloudFormation compatibility*: This property is passed directly to the [`SnapStart`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstart.html) property of an `AWS::Lambda::Function` resource\\.",
278793278793
"title": "SnapStart"
278794278794
},
278795+
"SourceKMSKeyArn": {
278796+
"$ref": "#/definitions/PassThroughProp"
278797+
},
278795278798
"Tags": {
278796278799
"markdownDescription": "A map \\(string to string\\) that specifies the tags added to this function\\. For details about valid keys and values for tags, see [Tag Key and Value Requirements](https://docs.aws.amazon.com/lambda/latest/dg/configuration-tags.html#configuration-tags-restrictions) in the *AWS Lambda Developer Guide*\\. \nWhen the stack is created, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this Lambda function, and to the default roles that are generated for this function\\. \n*Type*: Map \n*Required*: No \n*AWS CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-tags) property of an `AWS::Lambda::Function` resource\\. The `Tags` property in AWS SAM consists of key\\-value pairs \\(whereas in AWS CloudFormation this property consists of a list of `Tag` objects\\)\\. Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this Lambda function, and to the default roles that are generated for this function\\.",
278797278800
"title": "Tags",
@@ -279186,6 +279189,9 @@
279186279189
"markdownDescription": "Create a snapshot of any new Lambda function version\\. A snapshot is a cached state of your initialized function, including all of its dependencies\\. The function is initialized just once and the cached state is reused for all future invocations, improving application performance by reducing the number of times your function must be initialized\\. To learn more, see [Improving startup performance with Lambda SnapStart](https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html) in the *AWS Lambda Developer Guide*\\. \n*Type*: [SnapStart](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstart.html) \n*Required*: No \n*AWS CloudFormation compatibility*: This property is passed directly to the [`SnapStart`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstart.html) property of an `AWS::Lambda::Function` resource\\.",
279187279190
"title": "SnapStart"
279188279191
},
279192+
"SourceKMSKeyArn": {
279193+
"$ref": "#/definitions/PassThroughProp"
279194+
},
279189279195
"Tags": {
279190279196
"markdownDescription": "A map \\(string to string\\) that specifies the tags added to this function\\. For details about valid keys and values for tags, see [Tag Key and Value Requirements](https://docs.aws.amazon.com/lambda/latest/dg/configuration-tags.html#configuration-tags-restrictions) in the *AWS Lambda Developer Guide*\\. \nWhen the stack is created, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this Lambda function, and to the default roles that are generated for this function\\. \n*Type*: Map \n*Required*: No \n*AWS CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-tags) property of an `AWS::Lambda::Function` resource\\. The `Tags` property in AWS SAM consists of key\\-value pairs \\(whereas in AWS CloudFormation this property consists of a list of `Tag` objects\\)\\. Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this Lambda function, and to the default roles that are generated for this function\\.",
279191279197
"title": "Tags",

‎schema_source/sam.schema.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5525,6 +5525,9 @@
55255525
"markdownDescription": "Create a snapshot of any new Lambda function version\\. A snapshot is a cached state of your initialized function, including all of its dependencies\\. The function is initialized just once and the cached state is reused for all future invocations, improving application performance by reducing the number of times your function must be initialized\\. To learn more, see [Improving startup performance with Lambda SnapStart](https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html) in the *AWS Lambda Developer Guide*\\. \n*Type*: [SnapStart](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstart.html) \n*Required*: No \n*AWS CloudFormation compatibility*: This property is passed directly to the [`SnapStart`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstart.html) property of an `AWS::Lambda::Function` resource\\.",
55265526
"title": "SnapStart"
55275527
},
5528+
"SourceKMSKeyArn": {
5529+
"$ref": "#/definitions/PassThroughProp"
5530+
},
55285531
"Tags": {
55295532
"markdownDescription": "A map \\(string to string\\) that specifies the tags added to this function\\. For details about valid keys and values for tags, see [Tag Key and Value Requirements](https://docs.aws.amazon.com/lambda/latest/dg/configuration-tags.html#configuration-tags-restrictions) in the *AWS Lambda Developer Guide*\\. \nWhen the stack is created, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this Lambda function, and to the default roles that are generated for this function\\. \n*Type*: Map \n*Required*: No \n*AWS CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-tags) property of an `AWS::Lambda::Function` resource\\. The `Tags` property in AWS SAM consists of key\\-value pairs \\(whereas in AWS CloudFormation this property consists of a list of `Tag` objects\\)\\. Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this Lambda function, and to the default roles that are generated for this function\\.",
55305533
"title": "Tags",
@@ -6110,6 +6113,9 @@
61106113
"markdownDescription": "Create a snapshot of any new Lambda function version\\. A snapshot is a cached state of your initialized function, including all of its dependencies\\. The function is initialized just once and the cached state is reused for all future invocations, improving application performance by reducing the number of times your function must be initialized\\. To learn more, see [Improving startup performance with Lambda SnapStart](https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html) in the *AWS Lambda Developer Guide*\\. \n*Type*: [SnapStart](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstart.html) \n*Required*: No \n*AWS CloudFormation compatibility*: This property is passed directly to the [`SnapStart`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-snapstart.html) property of an `AWS::Lambda::Function` resource\\.",
61116114
"title": "SnapStart"
61126115
},
6116+
"SourceKMSKeyArn": {
6117+
"$ref": "#/definitions/PassThroughProp"
6118+
},
61136119
"Tags": {
61146120
"markdownDescription": "A map \\(string to string\\) that specifies the tags added to this function\\. For details about valid keys and values for tags, see [Tag Key and Value Requirements](https://docs.aws.amazon.com/lambda/latest/dg/configuration-tags.html#configuration-tags-restrictions) in the *AWS Lambda Developer Guide*\\. \nWhen the stack is created, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this Lambda function, and to the default roles that are generated for this function\\. \n*Type*: Map \n*Required*: No \n*AWS CloudFormation compatibility*: This property is similar to the [`Tags`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-function-tags) property of an `AWS::Lambda::Function` resource\\. The `Tags` property in AWS SAM consists of key\\-value pairs \\(whereas in AWS CloudFormation this property consists of a list of `Tag` objects\\)\\. Also, AWS SAM automatically adds a `lambda:createdBy:SAM` tag to this Lambda function, and to the default roles that are generated for this function\\.",
61156121
"title": "Tags",

‎tests/translator/input/function_with_sourcekmskeyarn.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
Parameters:
2+
SourceKMSKeyArnParam:
3+
Type: String
4+
Default: arn:aws:kms:us-west-2:123456789012:key/dec86919-7219-4e8d-8871-7f1609df2c7f
5+
6+
Resources:
7+
SourceKMSKeyArnFunction:
8+
Type: AWS::Serverless::Function
9+
Properties:
10+
CodeUri: s3://sam-demo-bucket/hello.zip
11+
Handler: hello.handler
12+
Runtime: python3.9
13+
SourceKMSKeyArn: arn:aws:kms:us-west-2:987654321098:key/dec86919-7219-4e8d-8871-7f1609df2c7f
14+
15+
SourceKMSKeyArnParameterFunction:
16+
Type: AWS::Serverless::Function
17+
Properties:
18+
CodeUri: s3://sam-demo-bucket/hello.zip
19+
Handler: hello.handler
20+
Runtime: python3.9
21+
SourceKMSKeyArn: !Ref SourceKMSKeyArnParam

‎tests/translator/input/globals_for_function.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ Globals:
3333
LoggingConfig:
3434
LogGroup: myJsonStructuredLogs
3535
RecursiveLoop: ALLOW
36+
SourceKMSKeyArn: arn:aws:kms:us-west-2:123456789012:key/dec86919-7219-4e8d-8871-7f1609df2c7f
3637

3738

3839

@@ -67,3 +68,4 @@ Resources:
6768
RuntimeManagementConfig:
6869
UpdateRuntimeOn: FunctionChange
6970
RecursiveLoop: TERMINATE
71+
SourceKMSKeyArn: arn:aws:kms:us-west-2:987654321098:key/dec86919-7219-4e8d-8871-7f1609df2c7f

‎tests/translator/output/aws-cn/function_with_sourcekmskeyarn.json‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
{
2+
"Parameters": {
3+
"SourceKMSKeyArnParam": {
4+
"Default": "arn:aws:kms:us-west-2:123456789012:key/dec86919-7219-4e8d-8871-7f1609df2c7f",
5+
"Type": "String"
6+
}
7+
},
8+
"Resources": {
9+
"SourceKMSKeyArnFunction": {
10+
"Properties": {
11+
"Code": {
12+
"S3Bucket": "sam-demo-bucket",
13+
"S3Key": "hello.zip",
14+
"SourceKMSKeyArn": "arn:aws:kms:us-west-2:987654321098:key/dec86919-7219-4e8d-8871-7f1609df2c7f"
15+
},
16+
"Handler": "hello.handler",
17+
"Role": {
18+
"Fn::GetAtt": [
19+
"SourceKMSKeyArnFunctionRole",
20+
"Arn"
21+
]
22+
},
23+
"Runtime": "python3.9",
24+
"Tags": [
25+
{
26+
"Key": "lambda:createdBy",
27+
"Value": "SAM"
28+
}
29+
]
30+
},
31+
"Type": "AWS::Lambda::Function"
32+
},
33+
"SourceKMSKeyArnFunctionRole": {
34+
"Properties": {
35+
"AssumeRolePolicyDocument": {
36+
"Statement": [
37+
{
38+
"Action": [
39+
"sts:AssumeRole"
40+
],
41+
"Effect": "Allow",
42+
"Principal": {
43+
"Service": [
44+
"lambda.amazonaws.com"
45+
]
46+
}
47+
}
48+
],
49+
"Version": "2012-10-17"
50+
},
51+
"ManagedPolicyArns": [
52+
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
53+
],
54+
"Tags": [
55+
{
56+
"Key": "lambda:createdBy",
57+
"Value": "SAM"
58+
}
59+
]
60+
},
61+
"Type": "AWS::IAM::Role"
62+
},
63+
"SourceKMSKeyArnParameterFunction": {
64+
"Properties": {
65+
"Code": {
66+
"S3Bucket": "sam-demo-bucket",
67+
"S3Key": "hello.zip",
68+
"SourceKMSKeyArn": {
69+
"Ref": "SourceKMSKeyArnParam"
70+
}
71+
},
72+
"Handler": "hello.handler",
73+
"Role": {
74+
"Fn::GetAtt": [
75+
"SourceKMSKeyArnParameterFunctionRole",
76+
"Arn"
77+
]
78+
},
79+
"Runtime": "python3.9",
80+
"Tags": [
81+
{
82+
"Key": "lambda:createdBy",
83+
"Value": "SAM"
84+
}
85+
]
86+
},
87+
"Type": "AWS::Lambda::Function"
88+
},
89+
"SourceKMSKeyArnParameterFunctionRole": {
90+
"Properties": {
91+
"AssumeRolePolicyDocument": {
92+
"Statement": [
93+
{
94+
"Action": [
95+
"sts:AssumeRole"
96+
],
97+
"Effect": "Allow",
98+
"Principal": {
99+
"Service": [
100+
"lambda.amazonaws.com"
101+
]
102+
}
103+
}
104+
],
105+
"Version": "2012-10-17"
106+
},
107+
"ManagedPolicyArns": [
108+
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
109+
],
110+
"Tags": [
111+
{
112+
"Key": "lambda:createdBy",
113+
"Value": "SAM"
114+
}
115+
]
116+
},
117+
"Type": "AWS::IAM::Role"
118+
}
119+
}
120+
}

‎tests/translator/output/aws-cn/globals_for_function.json‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@
77
],
88
"Code": {
99
"S3Bucket": "sam-demo-bucket",
10-
"S3Key": "hello.zip"
10+
"S3Key": "hello.zip",
11+
"SourceKMSKeyArn": "arn:aws:kms:us-west-2:987654321098:key/dec86919-7219-4e8d-8871-7f1609df2c7f"
1112
},
1213
"Environment": {
1314
"Variables": {
@@ -84,7 +85,7 @@
8485
},
8586
"FunctionVersion": {
8687
"Fn::GetAtt": [
87-
"FunctionWithOverridesVersion096ed3b52b",
88+
"FunctionWithOverridesVersionb52716e99f",
8889
"Version"
8990
]
9091
},
@@ -133,7 +134,7 @@
133134
},
134135
"Type": "AWS::IAM::Role"
135136
},
136-
"FunctionWithOverridesVersion096ed3b52b": {
137+
"FunctionWithOverridesVersionb52716e99f": {
137138
"DeletionPolicy": "Retain",
138139
"Properties": {
139140
"FunctionName": {
@@ -149,7 +150,8 @@
149150
],
150151
"Code": {
151152
"S3Bucket": "global-bucket",
152-
"S3Key": "global.zip"
153+
"S3Key": "global.zip",
154+
"SourceKMSKeyArn": "arn:aws:kms:us-west-2:123456789012:key/dec86919-7219-4e8d-8871-7f1609df2c7f"
153155
},
154156
"Environment": {
155157
"Variables": {
@@ -217,7 +219,7 @@
217219
},
218220
"FunctionVersion": {
219221
"Fn::GetAtt": [
220-
"MinimalFunctionVersione7c6f56e4d",
222+
"MinimalFunctionVersion5244f38b49",
221223
"Version"
222224
]
223225
},
@@ -262,7 +264,7 @@
262264
},
263265
"Type": "AWS::IAM::Role"
264266
},
265-
"MinimalFunctionVersione7c6f56e4d": {
267+
"MinimalFunctionVersion5244f38b49": {
266268
"DeletionPolicy": "Retain",
267269
"Properties": {
268270
"FunctionName": {

0 commit comments

Comments
 (0)