feat(aws-lambda): allow placing Lambda in VPC #598

rix0rrr · 2018-08-17T12:31:57Z

Fixes #580.

Checkpointing my work.

TODO

Push IConnectable to up FunctionRef
Make it work with export and import
Tests

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.

Fixes #580.

rix0rrr · 2018-08-20T11:06:04Z

Well then.

Cycle: @aws-cdk/aws-ec2 => @aws-cdk/aws-sns => @aws-cdk/aws-lambda => @aws-cdk/aws-ec2

This is because otherwise the new dependency of aws-lambda => aws-ec2 would introduce the following cycle: Cycle: @aws-cdk/aws-ec2 => @aws-cdk/aws-sns => @aws-cdk/aws-lambda => @aws-cdk/aws-ec2

rix0rrr · 2018-08-20T13:32:58Z

Somewhat blocked by #608 which is a better solution than reversing the sns/ec2 dependency. Will undo the relevant commit from this branch when the other PR has landed in master, but for now I need that change to make this build and continue developing on it.

Revert cfefb7e

This reverts commit cfefb7e.

RomainMuller · 2018-08-21T15:10:04Z

packages/@aws-cdk/aws-lambda/lib/lambda-ref.ts

 }

 export abstract class FunctionRef extends cdk.Construct
-    implements events.IEventRuleTarget, logs.ILogSubscriptionDestination, s3n.IBucketNotificationDestination {
+    implements events.IEventRuleTarget, logs.ILogSubscriptionDestination, s3n.IBucketNotificationDestination,
+    ec2.IConnectable   {


Do whatever you want with that comment:

I'm not a huge fan of this indentation right here. I would prefer some column-aligned. No hard feelings.

This is what my autoformatter made of it, but I guess I'm in board with you

RomainMuller · 2018-08-21T15:12:37Z

packages/@aws-cdk/aws-lambda/lib/lambda-ref.ts

+     */
+    public get connections(): ec2.Connections {
+        if (!this._connections) {
+            throw new Error('Only VPC-associated Lambda Functions can have their security groups managed.');


Somehow I am bummed out by the fact this seems to expect anything to know up-front whether a function is in-VPC or not... At lease should provide a property to verify this (public get isVpcBound(): boolean or something?)

Wouldn't you know since you were building the model yourself?

The error message should tell the user how to fix the problem? (i.e. how to add the lambda to a VPC)

RomainMuller · 2018-08-21T15:15:13Z

packages/@aws-cdk/aws-lambda/lib/lambda.ts

+     *
+     * @default Private subnets
+     */
+    vpcPlacement?: ec2.VpcPlacementStrategy;


Uh? I thought Lambdas could only be in private subnets?

Why would that be? I mean, it might be true, but since it's just an ENI I'm guessing you can place it anywhere.

How would such a restriction even work? If the routing table points to an IGW instead of an NGW, the Lambda will not work?

We also still have isolated subnets that need to be selectable.

This blog post seems to imply you need to do something different for public and private subnets, thereby implying it could be in a public subnet: https://aws.amazon.com/premiumsupport/knowledge-center/internet-access-lambda-function/

Maybe unsolicited feedback but I've been browsing the PRs to learn some CDK aspects..

While Lambda can technically be in a public subnet, invocations will fail if the function attempts to reach any publicly routable IP (ie 0.0.0.0 -> VPC internet gateway).

Therefore, our recommendation is to always add functions in a Private Subnet with NAT Gateway should they need to reach any publicly routable IP.

Thanks for the clarification @heitorlessa. I guess I was wrong.

That still leaves the opportunity to have Private (NAT routed) and Isolated (nonrouted) subnets, so we still need a placement argument, but now complicated by the fact that selecting public subnets is an error, and we might not know a priori what the selection is going to match.

For the moment, I'll propose to fix this with docs. Everyone okay with this?

Fixed it with a post-selection check.

RomainMuller · 2018-08-22T22:19:44Z

packages/@aws-cdk/aws-lambda/lib/lambda.ts

+        managedPolicyArns.push(cdk.Arn.fromComponents({
+            service: "iam",
+            region: "", // no region for managed policy
+            account: "aws", // the account for a managed policy is 'aws'


Is this also true in other partitions?

Gooooooooood question.

Yes, it is. It's not the partition identifier, it's an abstraction of the account number.

packages/@aws-cdk/aws-iam/lib/managed-policy.ts

eladb · 2018-08-28T07:14:06Z

packages/@aws-cdk/aws-lambda/lib/lambda-ref.ts

+     */
+    public get connections(): ec2.Connections {
+        if (!this._connections) {
+            throw new Error('Only VPC-associated Lambda Functions can have their security groups managed.');


The error message should tell the user how to fix the problem? (i.e. how to add the lambda to a VPC)

eladb · 2018-08-28T07:15:16Z

packages/@aws-cdk/aws-lambda/lib/lambda-ref.ts

@@ -261,6 +296,9 @@ export abstract class FunctionRef extends cdk.Construct
    public export(): FunctionRefProps {
        return {
            functionArn: new cdk.Output(this, 'FunctionArn', { value: this.functionArn }).makeImportValue(),
+            securityGroupId: this._connections && this._connections.securityGroup


What's the rational of exporting the security group ID of the Lambda? Is it in order to be able to use connections on an imported lambda? Maybe worth explaining in the docs

That's exactly it.

eladb · 2018-08-28T07:15:48Z

packages/@aws-cdk/aws-lambda/lib/lambda.ts

+     * Only used if 'vpc' is supplied. Note: internet access for Lambdas
+     * requires a NAT gateway, so picking Public subnets is not allowed.
+     *
+     * @default Private subnets


"all private subnets"

eladb · 2018-08-28T07:16:32Z

packages/@aws-cdk/aws-lambda/lib/lambda.ts

+     *
+     * Only used if 'vpc' is supplied.
+     *
+     * @default A unique security group is created for this Lambda function.


I would be a bit more descriptive here: "If the function is placed within a VPC and a security group is not specified, a dedicated security group will be created for this function"

eladb · 2018-08-28T07:17:52Z

packages/@aws-cdk/aws-lambda/lib/lambda.ts

-                resource: "policy",
-                resourceName: "service-role/AWSLambdaBasicExecutionRole",
-            })],
+            managedPolicyArns,


Maybe role.addManagedPolicy('service-role/xxx') would be nicer?

Ah, but you can have your own managed policies that you can attach, and they'll have a different account ('12345' vs 'aws'). Let's use ARNs to be safe.

Ultimately, this should be just "the object", not "the ARN", but I just wanted to make this copy/pasted code slighly better, not introduce a new modeling of ManagedPolicies as part of this CR.

eladb · 2018-08-28T07:18:23Z

packages/@aws-cdk/aws-lambda/lib/lambda.ts

+     * Returns the VpcConfig that should be added to the
+     * Lambda creation properties.
+     */
+    private addToVpc(props: FunctionProps): cloudformation.FunctionResource.VpcConfigProperty | undefined {


rename to renderVpcConfig or something like that

It's private, and it does more than just render.

So maybe configureVpc

eladb · 2018-08-28T07:19:02Z

packages/@aws-cdk/aws-lambda/lib/lambda.ts

+        const subnets = props.vpc.subnets(props.vpcPlacement);
+        for (const subnet of subnets) {
+            if (props.vpc.publicSubnets.indexOf(subnet) > -1) {
+                throw new Error('Not possible to place Lambda Functions in a Public subnet');


mention what are the legal options (private/internal) and also why is this not possible

I can't mention Internal because in this PR support for selecting internal subnets hasn't landed yet.

Also I'm told that my understanding of this is incomplete (by someone from the Lambda team), AND they're changing it early next year, AND we never explicate the reason on any other of our public documentation pages, we just say "no public for you". I don't want us to be the single source of truth for a factoid that's going to become wrong in a short while.

rix0rrr · 2018-09-04T08:58:13Z

@eladb ping?

packages/@aws-cdk/aws-iam/lib/managed-policy.ts

@mpiroc

The headliners of this release are __.NET support__, and a wealth of commits by external contributors who are stepping up to fix the CDK for their use cases! Thanks all for the effort put into this release! * Add strongly-named .NET targets, and a `cdk init` template for C# projects ([@mpiroc] in [#617](#617), [#643](#643)). * __@aws-cdk/aws-autoscaling__: Allow attaching additional security groups to Launch Configuration ([@moofish32] in [#636](#636)). * __@aws-cdk/aws-autoscaling__: Support update and creation policies on AutoScalingGroups ([@rix0rrr] in [#595](#595)). * __@aws-cdk/aws-codebuild__: Add support for running script from an asset ([@rix0rrr] in [#677](#677)). * __@aws-cdk/aws-codebuild__: New method `addBuildToPipeline` on Project ([@skinny85] in [783dcb3](783dcb3)). * __@aws-cdk/aws-codecommit__: New method `addToPipeline` on Repository ([@skinny85] in [#616](#616)). * __@aws-cdk/aws-codedeploy__: Add initial support for CodeDeploy ([@skinny85] in [#593](#593), [#641](#641)). * __@aws-cdk/aws-dynamodb__: Add support for DynamoDB autoscaling ([@SeekerWing] in [#637](#637)). * __@aws-cdk/aws-dynamodb__: Add support for DynamoDB streams ([@rhboyd] in [#633](#633)). * __@aws-cdk/aws-dynamodb__: Add support for server-side encryption ([@jungseoklee] in [#684](#864)). * __@aws-cdk/aws-ec2__ (_**BREAKING**_): SecurityGroup can now be used as a Connectable [#582](#582)). * __@aws-cdk/aws-ec2__: Add VPC tagging ([@moofish] in [#538](#538)). * __@aws-cdk/aws-ec2__: Add support for `InstanceSize.Nano` ([@rix0rrr] in [#581](#581)) * __@aws-cdk/aws-lambda__: Add support for dead letter queues ([@SeekerWing] in [#663](#663)). * __@aws-cdk/aws-lambda__: Add support for placing a Lambda in a VPC ([@rix0rrr] in [#598](#598)). * __@aws-cdk/aws-logs__: Add `extractMetric()` helper function ([@rix0rrr] in [#676](#676)). * __@aws-cdk/aws-rds__: Add support for Aurora PostreSQL/MySQL engines ([@cookejames] in [#586](#586)) * __@aws-cdk/aws-s3__: Additional grant methods for Buckets ([@eladb] in [#591](#591)) * __@aws-cdk/aws-s3__: New method `addToPipeline` on Bucket ([@skinny85] in [c8b7a49](c8b7a49)). * __aws-cdk__: Add support for HTTP proxies ([@rix0rrr] in [#666](#666)). * __aws-cdk__: Toolkit now shows failure reason if stack update fails ([@rix0rrr] in [#609](#609)). * __cdk-build-tools__: Add support for running experiment JSII versions ([@RomainMuller] in [#649](#649)). * _**BREAKING**_: Generate classes and types for the CloudFormation resource `.ref` attributes ([@rix0rrr] in [#627](#627)). * _**BREAKING**_: Make types accepted in Policy-related classes narrower (from `any` to `Arn`, for example) to reduce typing mistakes ([@rix0rrr] in [#629](#629)). * __@aws-cdk/aws-codepipeline__ (_**BREAKING**_): Align the CodePipeline APIs ([@skinny85] in [#492](#492), [#568](#568)) * __@aws-cdk/aws-ec2__ (_**BREAKING**_): Move Fleet/AutoScalingGroup to its own package ([@rix0rrr] in [#608](#608)). * __aws-cdk__: Simplify plugin protocol ([@RomainMuller] in [#646](#646)). * __@aws-cdk/aws-cloudfront__: Fix CloudFront behavior for ViewerProtocolPolicy ([@mindstorms6] in [#615](#615)). * __@aws-cdk/aws-ec2__: VPC Placement now supports picking Isolated subnets ([@rix0rrr] in [#610](#610)). * __@aws-cdk/aws-logs__: Add `export()/import()` capabilities ([@rix0rrr] in [#630](#630)). * __@aws-cdk/aws-rds__: Fix a bug where a cluster with 1 instance could not be created ([@cookejames] in [#578](#578)) * __@aws-cdk/aws-s3__: Bucket notifications can now add dependencies, fixing creation order ([@eladb] in [#584](#584)). * __@aws-cdk/aws-s3__: Remove useless bucket name validation ([@rix0rrr] in [#628](#628)). * __@aws-cdk/aws-sqs__: Make `QueueRef.encryptionMasterKey` readonly ([@RomainMuller] in [#650](#650)). * __assets__: S3 read permissions are granted on a prefix to fix lost permissions during asset update ([@rix0rrr] in [#510](#510)). * __aws-cdk__: Remove bootstrapping error if multiple stacks are in the same environment ([@RomainMuller] in [#625](#625)). * __aws-cdk__: Report and continue if git throws errors during `cdk init` ([@rix0rrr] in [#587](#587)). * __@aws-cdk/cfnspec__: Updated [CloudFormation resource specification] to `v2.6.0` ([@RomainMuller] in [#594](#594)) + **New AWS Construct Library** - `@aws-cdk/aws-sagemaker` supports AWS::SageMaker resources + **New Resource Types** - AWS::AmazonMQ::Broker - AWS::AmazonMQ::Configuration - AWS::CodePipeline::Webhook - AWS::Config::AggregationAuthorization - AWS::Config::ConfigurationAggregator - AWS::EC2::VPCEndpointConnectionNotification - AWS::EC2::VPCEndpointServicePermissions - AWS::IAM::ServiceLinkedRole - AWS::SSM::ResourceDataSync - AWS::SageMaker::Endpoint - AWS::SageMaker::EndpointConfig - AWS::SageMaker::Model - AWS::SageMaker::NotebookInstance - AWS::SageMaker::NotebookInstanceLifecycleConfig + **Attribute Changes** - AWS::CodePipeline::Pipeline Version (__added__) + **Property Changes** - AWS::AppSync::DataSource HttpConfig (__added__) - AWS::DAX::Cluster SSESpecification (__added__) - AWS::DynamoDB::Table Stream (__added__) - AWS::DynamoDB::Table AutoScalingSupport (__added__) - AWS::EC2::VPCEndpoint IsPrivateDnsEnabled (__added__) - AWS::EC2::VPCEndpoint SecurityGroupIds (__added__) - AWS::EC2::VPCEndpoint SubnetIds (__added__) - AWS::EC2::VPCEndpoint VPCEndpointType (__added__) - AWS::EC2::VPCEndpoint RouteTableIds.DuplicatesAllowed (__deleted__) - AWS::EC2::VPCPeeringConnection PeerRegion (__added__) - AWS::EFS::FileSystem ProvisionedThroughputInMibps (__added__) - AWS::EFS::FileSystem ThroughputMode (__added__) - AWS::EMR::Cluster KerberosAttributes (__added__) - AWS::Glue::Classifier JsonClassifier (__added__) - AWS::Glue::Classifier XMLClassifier (__added__) - AWS::Glue::Crawler Configuration (__added__) - AWS::Lambda::Lambda DLQConfigurationSupport (__added__) - AWS::Neptune::DBInstance DBSubnetGroupName.UpdateType (__changed__) - Old: Mutable - New: Immutable - AWS::SNS::Subscription DeliveryPolicy (__added__) - AWS::SNS::Subscription FilterPolicy (__added__) - AWS::SNS::Subscription RawMessageDelivery (__added__) - AWS::SNS::Subscription Region (__added__) - AWS::SQS::Queue Tags (__added__) - AWS::ServiceDiscovery::Service HealthCheckCustomConfig (__added__) + **Property Type Changes** - AWS::AppSync::DataSource.HttpConfig (__added__) - AWS::DAX::Cluster.SSESpecification (__added__) - AWS::EMR::Cluster.KerberosAttributes (__added__) - AWS::Glue::Classifier.JsonClassifier (__added__) - AWS::Glue::Classifier.XMLClassifier (__added__) - AWS::ServiceDiscovery::Service.HealthCheckCustomConfig (__added__) - AWS::CloudFront::Distribution.CacheBehavior FieldLevelEncryptionId (__added__) - AWS::CloudFront::Distribution.DefaultCacheBehavior FieldLevelEncryptionId (__added__) - AWS::CodeBuild::Project.Artifacts EncryptionDisabled (__added__) - AWS::CodeBuild::Project.Artifacts OverrideArtifactName (__added__) - AWS::CodeBuild::Project.Environment Certificate (__added__) - AWS::CodeBuild::Project.Source ReportBuildStatus (__added__) - AWS::ServiceDiscovery::Service.DnsConfig RoutingPolicy (__added__) - AWS::WAF::WebACL.ActivatedRule Action.Required (__changed__) - Old: true - New: false * __@aws-cdk/cfnspec__: Updated Serverless Application Model (SAM) Resource Specification ([@RomainMuller] in [#594](#594)) + **Property Changes** - AWS::Serverless::Api MethodSettings (__added__) + **Property Type Changes** - AWS::Serverless::Function.SQSEvent (__added__) - AWS::Serverless::Function.EventSource Properties.Types (__changed__) - Added SQSEvent

@mpiroc

The headliners of this release are __.NET support__, and a wealth of commits by external contributors who are stepping up to fix the CDK for their use cases! Thanks all for the effort put into this release! * Add strongly-named .NET targets, and a `cdk init` template for C# projects ([@mpiroc] in [#617](#617), [#643](#643)). * __@aws-cdk/aws-autoscaling__: Allow attaching additional security groups to Launch Configuration ([@moofish32] in [#636](#636)). * __@aws-cdk/aws-autoscaling__: Support update and creation policies on AutoScalingGroups ([@rix0rrr] in [#595](#595)). * __@aws-cdk/aws-codebuild__: Add support for running script from an asset ([@rix0rrr] in [#677](#677)). * __@aws-cdk/aws-codebuild__: New method `addBuildToPipeline` on Project ([@skinny85] in [783dcb3](783dcb3)). * __@aws-cdk/aws-codecommit__: New method `addToPipeline` on Repository ([@skinny85] in [#616](#616)). * __@aws-cdk/aws-codedeploy__: Add initial support for CodeDeploy ([@skinny85] in [#593](#593), [#641](#641)). * __@aws-cdk/aws-dynamodb__: Add support for DynamoDB autoscaling ([@SeekerWing] in [#637](#637)). * __@aws-cdk/aws-dynamodb__: Add support for DynamoDB streams ([@rhboyd] in [#633](#633)). * __@aws-cdk/aws-dynamodb__: Add support for server-side encryption ([@jungseoklee] in [#684](#864)). * __@aws-cdk/aws-ec2__ (_**BREAKING**_): SecurityGroup can now be used as a Connectable [#582](#582)). * __@aws-cdk/aws-ec2__: Add VPC tagging ([@moofish] in [#538](#538)). * __@aws-cdk/aws-ec2__: Add support for `InstanceSize.Nano` ([@rix0rrr] in [#581](#581)) * __@aws-cdk/aws-lambda__: Add support for dead letter queues ([@SeekerWing] in [#663](#663)). * __@aws-cdk/aws-lambda__: Add support for placing a Lambda in a VPC ([@rix0rrr] in [#598](#598)). * __@aws-cdk/aws-logs__: Add `extractMetric()` helper function ([@rix0rrr] in [#676](#676)). * __@aws-cdk/aws-rds__: Add support for Aurora PostreSQL/MySQL engines ([@cookejames] in [#586](#586)) * __@aws-cdk/aws-s3__: Additional grant methods for Buckets ([@eladb] in [#591](#591)) * __@aws-cdk/aws-s3__: New method `addToPipeline` on Bucket ([@skinny85] in [c8b7a49](c8b7a49)). * __aws-cdk__: Add support for HTTP proxies ([@rix0rrr] in [#666](#666)). * __aws-cdk__: Toolkit now shows failure reason if stack update fails ([@rix0rrr] in [#609](#609)). * __cdk-build-tools__: Add support for running experiment JSII versions ([@RomainMuller] in [#649](#649)). * _**BREAKING**_: Generate classes and types for the CloudFormation resource `.ref` attributes ([@rix0rrr] in [#627](#627)). * _**BREAKING**_: Make types accepted in Policy-related classes narrower (from `any` to `Arn`, for example) to reduce typing mistakes ([@rix0rrr] in [#629](#629)). * __@aws-cdk/aws-codepipeline__ (_**BREAKING**_): Align the CodePipeline APIs ([@skinny85] in [#492](#492), [#568](#568)) * __@aws-cdk/aws-ec2__ (_**BREAKING**_): Move Fleet/AutoScalingGroup to its own package ([@rix0rrr] in [#608](#608)). * __aws-cdk__: Simplify plugin protocol ([@RomainMuller] in [#646](#646)). * __@aws-cdk/aws-cloudfront__: Fix CloudFront behavior for ViewerProtocolPolicy ([@mindstorms6] in [#615](#615)). * __@aws-cdk/aws-ec2__: VPC Placement now supports picking Isolated subnets ([@rix0rrr] in [#610](#610)). * __@aws-cdk/aws-logs__: Add `export()/import()` capabilities ([@rix0rrr] in [#630](#630)). * __@aws-cdk/aws-rds__: Fix a bug where a cluster with 1 instance could not be created ([@cookejames] in [#578](#578)) * __@aws-cdk/aws-s3__: Bucket notifications can now add dependencies, fixing creation order ([@eladb] in [#584](#584)). * __@aws-cdk/aws-s3__: Remove useless bucket name validation ([@rix0rrr] in [#628](#628)). * __@aws-cdk/aws-sqs__: Make `QueueRef.encryptionMasterKey` readonly ([@RomainMuller] in [#650](#650)). * __assets__: S3 read permissions are granted on a prefix to fix lost permissions during asset update ([@rix0rrr] in [#510](#510)). * __aws-cdk__: Remove bootstrapping error if multiple stacks are in the same environment ([@RomainMuller] in [#625](#625)). * __aws-cdk__: Report and continue if git throws errors during `cdk init` ([@rix0rrr] in [#587](#587)). * __@aws-cdk/cfnspec__: Updated [CloudFormation resource specification] to `v2.6.0` ([@RomainMuller] in [#594](#594)) + **New AWS Construct Library** - `@aws-cdk/aws-sagemaker` supports AWS::SageMaker resources + **New Resource Types** - AWS::AmazonMQ::Broker - AWS::AmazonMQ::Configuration - AWS::CodePipeline::Webhook - AWS::Config::AggregationAuthorization - AWS::Config::ConfigurationAggregator - AWS::EC2::VPCEndpointConnectionNotification - AWS::EC2::VPCEndpointServicePermissions - AWS::IAM::ServiceLinkedRole - AWS::SSM::ResourceDataSync - AWS::SageMaker::Endpoint - AWS::SageMaker::EndpointConfig - AWS::SageMaker::Model - AWS::SageMaker::NotebookInstance - AWS::SageMaker::NotebookInstanceLifecycleConfig + **Attribute Changes** - AWS::CodePipeline::Pipeline Version (__added__) + **Property Changes** - AWS::AppSync::DataSource HttpConfig (__added__) - AWS::DAX::Cluster SSESpecification (__added__) - AWS::DynamoDB::Table Stream (__added__) - AWS::DynamoDB::Table AutoScalingSupport (__added__) - AWS::EC2::VPCEndpoint IsPrivateDnsEnabled (__added__) - AWS::EC2::VPCEndpoint SecurityGroupIds (__added__) - AWS::EC2::VPCEndpoint SubnetIds (__added__) - AWS::EC2::VPCEndpoint VPCEndpointType (__added__) - AWS::EC2::VPCEndpoint RouteTableIds.DuplicatesAllowed (__deleted__) - AWS::EC2::VPCPeeringConnection PeerRegion (__added__) - AWS::EFS::FileSystem ProvisionedThroughputInMibps (__added__) - AWS::EFS::FileSystem ThroughputMode (__added__) - AWS::EMR::Cluster KerberosAttributes (__added__) - AWS::Glue::Classifier JsonClassifier (__added__) - AWS::Glue::Classifier XMLClassifier (__added__) - AWS::Glue::Crawler Configuration (__added__) - AWS::Lambda::Lambda DLQConfigurationSupport (__added__) - AWS::Neptune::DBInstance DBSubnetGroupName.UpdateType (__changed__) - Old: Mutable - New: Immutable - AWS::SNS::Subscription DeliveryPolicy (__added__) - AWS::SNS::Subscription FilterPolicy (__added__) - AWS::SNS::Subscription RawMessageDelivery (__added__) - AWS::SNS::Subscription Region (__added__) - AWS::SQS::Queue Tags (__added__) - AWS::ServiceDiscovery::Service HealthCheckCustomConfig (__added__) + **Property Type Changes** - AWS::AppSync::DataSource.HttpConfig (__added__) - AWS::DAX::Cluster.SSESpecification (__added__) - AWS::EMR::Cluster.KerberosAttributes (__added__) - AWS::Glue::Classifier.JsonClassifier (__added__) - AWS::Glue::Classifier.XMLClassifier (__added__) - AWS::ServiceDiscovery::Service.HealthCheckCustomConfig (__added__) - AWS::CloudFront::Distribution.CacheBehavior FieldLevelEncryptionId (__added__) - AWS::CloudFront::Distribution.DefaultCacheBehavior FieldLevelEncryptionId (__added__) - AWS::CodeBuild::Project.Artifacts EncryptionDisabled (__added__) - AWS::CodeBuild::Project.Artifacts OverrideArtifactName (__added__) - AWS::CodeBuild::Project.Environment Certificate (__added__) - AWS::CodeBuild::Project.Source ReportBuildStatus (__added__) - AWS::ServiceDiscovery::Service.DnsConfig RoutingPolicy (__added__) - AWS::WAF::WebACL.ActivatedRule Action.Required (__changed__) - Old: true - New: false * __@aws-cdk/cfnspec__: Updated Serverless Application Model (SAM) Resource Specification ([@RomainMuller] in [#594](#594)) + **Property Changes** - AWS::Serverless::Api MethodSettings (__added__) + **Property Type Changes** - AWS::Serverless::Function.SQSEvent (__added__) - AWS::Serverless::Function.EventSource Properties.Types (__changed__) - Added SQSEvent

feat(aws-lambda): allow placing Lambda in VPC

6ba0614

Fixes #580.

Rico Huijbers added 2 commits August 20, 2018 13:40

Reverse dependency edge between aws-sns and aws-ec2 packages

cfefb7e

This is because otherwise the new dependency of aws-lambda => aws-ec2 would introduce the following cycle: Cycle: @aws-cdk/aws-ec2 => @aws-cdk/aws-sns => @aws-cdk/aws-lambda => @aws-cdk/aws-ec2

Merge branch 'master' into huijbers/lambda-in-vpc

e807777

Rico Huijbers added 4 commits August 20, 2018 15:45

WIP

d4ef24c

Add tests

5f9e0f6

Merge remote-tracking branch 'origin/master' into huijbers/lambda-in-vpc

66111d7

Revert "Reverse dependency edge between aws-sns and aws-ec2 packages"

d078fec

This reverts commit cfefb7e.

RomainMuller reviewed Aug 22, 2018

View reviewed changes

Rico Huijbers added 2 commits August 23, 2018 10:31

Add isBoundToVpc() method, minimal abstraction for managed policy ARNs

66900d3

Prohibit picking public subnets

5cf128f

eladb reviewed Aug 28, 2018

View reviewed changes

Rico Huijbers added 2 commits September 3, 2018 12:15

More explicit documentation

37bd186

Merge remote-tracking branch 'origin/master' into huijbers/lambda-in-vpc

9fe130f

eladb approved these changes Sep 4, 2018

View reviewed changes

packages/@aws-cdk/aws-iam/lib/managed-policy.ts Outdated Show resolved Hide resolved

packages/@aws-cdk/aws-iam/lib/managed-policy.ts Outdated Show resolved Hide resolved

Rico Huijbers added 4 commits September 7, 2018 16:51

Merge remote-tracking branch 'origin/master' into huijbers/lambda-in-vpc

d11ffb0

Rename AWSManagedPolicy

305da53

Line length

30f78dc

UPdate integ expectation

4eb363a

rix0rrr merged commit 9f815f9 into master Sep 9, 2018

rix0rrr deleted the huijbers/lambda-in-vpc branch September 9, 2018 13:04

rix0rrr mentioned this pull request Sep 11, 2018

v0.9.0 #688

Merged

NGL321 added the contribution/core This is a PR that came from AWS. label Sep 27, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(aws-lambda): allow placing Lambda in VPC #598

feat(aws-lambda): allow placing Lambda in VPC #598

rix0rrr commented Aug 17, 2018 •

edited

Loading

rix0rrr commented Aug 20, 2018

rix0rrr commented Aug 20, 2018 •

edited

Loading

RomainMuller Aug 21, 2018

rix0rrr Aug 23, 2018

RomainMuller Aug 21, 2018

rix0rrr Aug 23, 2018

eladb Aug 28, 2018

RomainMuller Aug 21, 2018

rix0rrr Aug 23, 2018 •

edited

Loading

rix0rrr Aug 23, 2018

heitorlessa Aug 23, 2018

rix0rrr Aug 23, 2018

rix0rrr Aug 23, 2018

RomainMuller Aug 22, 2018

rix0rrr Aug 23, 2018

rix0rrr Aug 23, 2018

eladb Aug 28, 2018

eladb Aug 28, 2018

rix0rrr Aug 28, 2018

eladb Aug 28, 2018

eladb Aug 28, 2018

eladb Aug 28, 2018

rix0rrr Aug 28, 2018

eladb Aug 28, 2018

rix0rrr Sep 3, 2018

eladb Sep 3, 2018

eladb Aug 28, 2018

rix0rrr Aug 28, 2018

rix0rrr commented Sep 4, 2018

feat(aws-lambda): allow placing Lambda in VPC #598

feat(aws-lambda): allow placing Lambda in VPC #598

Conversation

rix0rrr commented Aug 17, 2018 • edited Loading

rix0rrr commented Aug 20, 2018

rix0rrr commented Aug 20, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rix0rrr Aug 23, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rix0rrr commented Sep 4, 2018

rix0rrr commented Aug 17, 2018 •

edited

Loading

rix0rrr commented Aug 20, 2018 •

edited

Loading

rix0rrr Aug 23, 2018 •

edited

Loading