Create Lambda permission in serverless

Question

I'm running into an issue with Serverless v1.5 (latest version currently available at the time of writing)

I've to add permission to the lambda function and I'm trying to achieve this by creating a CF template and running along with the deploy of the function:

resources:
  Resources:
    logsGroup:
      Type: "AWS::Lambda::Permission"
      Properties: 
        Action: lambda:InvokeFunction
        FunctionName: 
          Fn::GetAtt:
            - "${self:custom.${opt:stage}.name}"
            - "Arn"
        Principal: "logs.amazonaws.com"
        SourceAccount:
          Ref: "AWS::AccountId"
        SourceArn: "arn:aws:logs:${self:provider.region}:*:log-group:*:*"

This is how it should look like. My problem is that when I try to deploy it I get an error which says that the function is not created yet which is understandable. How can I overcome to this issue? Any ideas?

How did you resolve this? If you found a solution it would be helpful to those of us finding your question if you wrote an answer and accepted it if your solution works. — Nelfo
– Nelfo, Commented Jul 20, 2017 at 14:22
I am in the same scenario at the moment. Please let us know if you have found a solution to this. — Jeffrey Wen
– Jeffrey Wen, Commented Jul 24, 2019 at 15:50

ironmanwaring · Accepted Answer · 2017-01-11 20:53:41Z

4

Not enough rep to add a comment - have you tried adding a DependsOn attribute to the Lambda Permission resource? Explicitly setting that property will result in CloudFormation waiting until the Lambda Function resource is created before creating this permission.

Also if you weren't already aware the .serverless folder that gets created in the root of your project contains the CloudFormation templates used by serverless, which can be helpful when troubleshooting unexpected CloudFormation behavior.

answered Jan 11, 2017 at 20:53

ironmanwaring

914 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

vahdet · Accepted Answer · 2019-05-23 21:03:16Z

3

By default, Serverless creates your custom resources first, which makes sense as you usually put S3 buckets etc. there that your functions rely on.

In the end though, Serverless translates everything to a Cloudformation template, which you can see in the .serverless directory. What you will notice there is that your function names are suffixed with "LambdaFunction". So if you named your function "Foo", this is translated to "FooLambdaFunction". By that name, you can reference the function in a custom resource, which makes Cloudformation wait for the function before it creates the resource.

E.g.

functions:
  Foo:
    handler: functions/foo.handler
    name: foo-lambda
    description: Sample function
resources:
  Resources:
    PermissionToCallFoo:
      Type: "AWS::Lambda::Permission"
      Properties: 
        Action: lambda:InvokeFunction
        FunctionName: 
          Ref: FooLambdaFunction
        Principal: "logs.amazonaws.com"
  Outputs:
    FooArn:
      Value:
        Fn::GetAtt: 
          - FooLambdaFunction
          - Arn
      Export:
        Name: "FooArn"

edited May 23, 2019 at 21:03

vahdet

6,78910 gold badges62 silver badges116 bronze badges

answered Jun 8, 2018 at 7:34

Ulli

2,2101 gold badge15 silver badges11 bronze badges

1 Comment

Marceli Wac Over a year ago

One thing I would add, is that the "exported" function name, will be capitalised by default, so if you define a function called foo, or myCodeRunner, your Ref will have to account for this difference (i.e. Foo or MyCodeRunner respectively).

Collectives™ on Stack Overflow

Create Lambda permission in serverless

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related