(aws-config): Creating multiple rules from the same lambda fails

[fitzoh]

What is the problem?

If you create a (python) lambda and use it as the lambda function for multiple custom config rules, it will fail with the following error:
jsii.errors.JSIIError: There is already a Construct with name 'Permission' in PythonFunction [MonolithicConfigRuleLambda]

This appears to be similar to #9756 which was fixed in 1.61.0

Reproduction Steps

Create a (python) lambda function and use it to create more than one custom AWS Config rule

        rule_lambda = aws_lambda_python.PythonFunction(
            self,
            f"MonolithicConfigRuleLambda",
            runtime=aws_lambda.Runtime.PYTHON_3_9,
            entry=str(Path(__file__).parent / "config_lambda"),
            index="handler.py",
            handler="lambda_handler",
            memory_size=512,
            timeout=core.Duration.seconds(60),
        )
        aws_config.CustomRule(
            self,
            "Rule1",
            config_rule_name="Rule1",
            rule_scope=aws_config.RuleScope.from_tag("Key"),
            configuration_changes=True,
            lambda_function=rule_lambda,
        )
        aws_config.CustomRule(
            self,
            "Rule2",
            config_rule_name="Rule2",
            rule_scope=aws_config.RuleScope.from_tag("Key"),
            configuration_changes=True,
            lambda_function=rule_lambda,
        )

What did you expect to happen?

Create many config rules using a single labmda

What actually happened?

The following error is received:
jsii.errors.JSIIError: There is already a Construct with name 'Permission' in PythonFunction [MonolithicConfigRuleLambda]

CDK CLI Version

1.130.0

Framework Version

No response

Node.js Version

15.14.0

OS

MacOS

Language

Python

Language Version

3.9

Other information

You can work around it by referencing the function by arn for subsequent calls:

        rule_lambda = aws_lambda_python.PythonFunction(
            self,
            f"MonolithicConfigRuleLambda",
            runtime=aws_lambda.Runtime.PYTHON_3_9,
            entry=str(Path(__file__).parent / "config_lambda"),
            index="handler.py",
            handler="lambda_handler",
            memory_size=512,
            timeout=core.Duration.seconds(60),
        )
        aws_config.CustomRule(
            self,
            "Rule1",
            config_rule_name="Rule1",
            rule_scope=aws_config.RuleScope.from_tag("Key"),
            configuration_changes=True,
            lambda_function=rule_lambda,
        )
        rule_lambda_copy = aws_lambda.Function.from_function_arn(self, "MonolithicConfigRuleLambdaCopy", rule_lambda.function_arn)
        aws_config.CustomRule(
            self,
            "Rule2",
            config_rule_name="Rule2",
            rule_scope=aws_config.RuleScope.from_tag("Key"),
            configuration_changes=True,
            lambda_function=rule_lambda_copy,
        )
        aws_config.CustomRule(
            self,
            "Rule3",
            config_rule_name="Rule3",
            rule_scope=aws_config.RuleScope.from_tag("Key"),
            configuration_changes=True,
            lambda_function=rule_lambda_copy,
        )

[watany-dev]

This is because the id of addPermission is set to a fixed value of ″permission″, which means that only one can be set in the stack.

Try the following modification

1. and add the name of each config rule to the id. This will allow multiple custom rules to be handled in one stack.
2. Do the id check before addPermission. This will allow only one permission to be granted to a custom rule from the config service.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.