fix(lambda): enforce lambda alias alphanumeric logical id (#3738)

Co-authored-by: Frederic Mbea <117131783+mbfreder@users.noreply.github.com>

Author: vicheey

samtranslator/model/sam_resources.py

@@ -1,6 +1,7 @@
 """ SAM macro definitions """
 
 import copy
+import re
 from contextlib import suppress
 from typing import Any, Callable, Dict, List, Literal, Optional, Tuple, Union, cast
 
@@ -238,7 +239,6 @@ class SamFunction(SamResourceMacro):
 
     # DeadLetterQueue
     dead_letter_queue_policy_actions = {"SQS": "sqs:SendMessage", "SNS": "sns:Publish"}
-    #
 
     # Conditions
     conditions: Dict[str, Any] = {}  # TODO: Replace `Any` with something more specific
@@ -325,7 +325,7 @@ def to_cloudformation(self, **kwargs):  # type: ignore[no-untyped-def] # noqa: P
                 resources.append(url_permission)
 
         self._validate_deployment_preference_and_add_update_policy(
-            kwargs.get("deployment_preference_collection", None),
+            kwargs.get("deployment_preference_collection"),
             lambda_alias,
             intrinsics_resolver,
             cast(IntrinsicsResolver, mappings_resolver),  # TODO: better handle mappings_resolver's Optional
@@ -1002,7 +1002,22 @@ def _construct_alias(self, name: str, function: LambdaFunction, version: LambdaV
         if not name:
             raise InvalidResourceException(self.logical_id, "Alias name is required to create an alias")
 
-        logical_id = f"{function.logical_id}Alias{name}"
+        # Validate alias name against the required pattern: (?!^[0-9]+$)([a-zA-Z0-9-_]+)
+        # This ensures the alias name:
+        # 1. Contains only alphanumeric characters, hyphens, and underscores
+        # 2. Is not purely numeric
+        ALIAS_REGEX = r"(?!^[0-9]+$)([a-zA-Z0-9\-_]+)$"
+        if not re.match(ALIAS_REGEX, name):
+            raise InvalidResourceException(
+                self.logical_id,
+                f"AutoPublishAlias name ('{name}') must contain only alphanumeric characters, hyphens, or underscores matching (?!^[0-9]+$)([a-zA-Z0-9-_]+) pattern.",
+            )
+
+        # Strip hyphens and underscores from the alias name for the logical ID
+        # This ensures the logical ID contains only alphanumeric characters
+        alias_alphanumeric_name = name.replace("-", "D").replace("_", "U")
+
+        logical_id = f"{function.logical_id}Alias{alias_alphanumeric_name}"
         alias = LambdaAlias(logical_id=logical_id, attributes=self.get_passthrough_resource_attributes())
         alias.Name = name
         alias.FunctionName = function.get_runtime_attr("name")
@@ -1014,7 +1029,7 @@ def _construct_alias(self, name: str, function: LambdaFunction, version: LambdaV
 
     def _validate_deployment_preference_and_add_update_policy(  # noqa: PLR0913
         self,
-        deployment_preference_collection: DeploymentPreferenceCollection,
+        deployment_preference_collection: Optional[DeploymentPreferenceCollection],
         lambda_alias: Optional[LambdaAlias],
         intrinsics_resolver: IntrinsicsResolver,
         mappings_resolver: IntrinsicsResolver,

tests/translator/input/error_function_invalid_autopublishalias_name.yaml

@@ -0,0 +1,9 @@
+Resources:
+  MyFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: s3://sam-demo-bucket/hello.zip
+      Handler: hello.handler
+      Runtime: python3.9
+      # Using an invalid alias name with special characters that can't be properly transformed
+      AutoPublishAlias: invalid*alias@name

tests/translator/input/function_with_alias_valid_names.yaml

@@ -0,0 +1,54 @@
+Resources:
+  FunctionAliasNameCamelCase:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: s3://sam-demo-bucket/hello.zip
+      Handler: hello.handler
+      Runtime: python3.9
+      AutoPublishAlias: camelCaseName
+      VersionDescription: sam-testing
+
+  FunctionAliasNameUpperCase:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: s3://sam-demo-bucket/hello.zip
+      Handler: hello.handler
+      Runtime: python3.9
+      AutoPublishAlias: UPPERCASE
+      VersionDescription: sam-testing
+
+  FunctionAliasNameLowerCase:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: s3://sam-demo-bucket/hello.zip
+      Handler: hello.handler
+      Runtime: python3.9
+      AutoPublishAlias: lowercase
+      VersionDescription: sam-testing
+
+  FunctionAliasNameUnderscore:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: s3://sam-demo-bucket/hello.zip
+      Handler: hello.handler
+      Runtime: python3.9
+      AutoPublishAlias: _underscore_name_
+      VersionDescription: sam-testing
+
+  FunctionAliasNameDash:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: s3://sam-demo-bucket/hello.zip
+      Handler: hello.handler
+      Runtime: python3.9
+      AutoPublishAlias: underscore-name
+      VersionDescription: sam-testing
+
+  FunctionAliasNameMix:
+    Type: AWS::Serverless::Function
+    Properties:
+      CodeUri: s3://sam-demo-bucket/hello.zip
+      Handler: hello.handler
+      Runtime: python3.9
+      AutoPublishAlias: underScoreNAME_with-dash-01234
+      VersionDescription: sam-testing