anyone know if it’s possible in CDK to reference a Lambda layer that’s already deployed (outside of the infra code).. especially one in another AWS account

In my .env file:

LAMBDA_LAYER_ARN=arn:aws:lambda:us-east-1:XXXXX:layer:XXXX:33

Then in your stack:

const myLambdaLayer = lambda.LayerVersion.fromLayerVersionArn(this,
      'myLayer', <string>process.env.LAMBDA_LAYER_ARN);

Then in your Lambda definition

return new sst.Api(this, 'Api', {
      defaultFunctionProps: {
        layers: [myLambdaLayer]

and your Lambda layer is in a different AWS account? how does it have permissions to access that?

I think this is what you need - https://docs.aws.amazon.com/cdk/api/latest/docs/aws-lambda-readme.html#layers

sure, I know how to create a Lambda layer. but I wanted to reference an existing one in a different AWS account

oh geez. sorry. the doc page is messed up.. the ‘#’ anchors didn’t work

weird, works for me.

heh. AWS support, which I pay $100/mo for, tried to tell me it’s not possible

Haha! Hire me lol. 😂

for real

Always a pleasure. 😁🙏

moving the conversation here 😉 but how can my stack in Account B have the ARN of a layer that already exists in Account A?

Are both accounts in the same org?

yep

It’s basically adding a IAM policy that sets principal to all users in your org. IAM voodoo.

so once I add the permission by passing the layer version permission that has the org ID and “*” for all accounts, it’ll just work?

I don’t think that would work. The

addPermission

works on the source layer and account and not on the target. Once you create the layer and add the permission everything from the source side should be done. On the target side you’d use

LayerVersion.fromLayerVersionArn

or

LayerVersion.fromLayerVersionAttributes

to refer it.

so maybe all I need is an IAM role on the primary account w/ the layer, granting the account the ability to access the layer ?

the addPermission will do that, I don’t think you need to do anything manually.

but the sub account surely can’t just call

addPermission

to gain access to the primary account’s layers.. ? that would be a security flaw 😄

The sub account won’t call the addPermission, the owner account would. The sub account uses the static methods to refer.

ohh I gotcha.. when the primary account does

yarn deploy

, it’ll add that permission

you do have a cdk / sst stack in the owner account, right?

nope, that’s why I was confused 😄 haha. I’m testing SST in a test sub account right now

oh, okay, then you’ll have to create a IAM policy to share the layer manually and then refer it from the sub account.

yeah.. ok. I’ll try that in a minute

this is the permission that your sub account needs - lambda:GetLayerVersion

I added this role + policy to the main account, didn’t work

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": "lambda:GetLayerVersion",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalOrgID": "o-xxx"
        }
      }
    }
  ]
}

you’ll have to add PrincipalAccountId * as well.

really? I thought this policy above would allow any account in the organization access

It’s a combination as far as I understand, I haven’t tried this within the same org yet.

any sub accounts are ones I’ve set up for devs 🙂 no biggie if they can access the Lambda layers

no, it wouldn’t have to. The layer resource will match the condition for the subaccount.

didn’t work 😕

Any errors that you see?

same:

Resource handler returned message: "User: arn:aws:iam::<sub_account>:user/sammy is not authorized to perform: lambda:GetLayerVersion on resource: arn:aws:lambda:us-east-1:<main_account>:layer:audio-tools:4

do one thing, use PrincipalArn and give it the subaccount’s Arn and remove the PrincipalOrgID

sure thing

something like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": "lambda:GetLayerVersion",
      "Resource": "arn:aws:lambda:ap-south-1:xxx:layer:test:test",
      "Condition": {
        "ArnEquals": {
          "aws:PrincipalArn": "arn:aws:iam::xxx:user/ashish"
        }
      }
    }
  ]
}

ok, so using that.. this is the first time I’ve seen this show anything on the summary

okay, nice!

I’ll have to ask AWS support how to grant to the whole organization

let me think.

ah, it didn’t work 😞

is the console user and the sst user the same or do you have other profiles too?

er wait. lemme try my username vs

:root

for the IAM user

you can’t give access to root from an IAM account.

right. well, I mean for STS (trust relationships), you do use that. e.g.:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<sub_account>:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {}
    }
  ]
}

same error again?

yep

change the condition to this for my old policy above:

"Condition": {
    "StringEquals": {
        "aws:PrincipalType": "User"
     }
}

there’s no reference to org ID there though

that should be fine.

so the policy is saying any user can do

lambda:GetLayerVersion

. ?

yep.

regardless of organization.. ? so if you had the ARN for my layer, you could access it 😄

your accounts and org have no idea of other orgs so it shouldn’t be an issue.

interesting! I wonder what it does and where it stores that permission

try it go to IAM console and into permissions and sort by last created.

ok the CLI commad worked. where do I go in the console to see this?

it would be under your org permissions probably since we gave it an org id. Great, good exercise lol! 😂

here are the relevant docs! I wouldn’t have known to look for this. https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html#configuration-layers-permissions

yep, that’s where I got the command from.

I dont’ see the permissions anywhere in the console. super weird. maybe they aren’t accessible there. but you can’t even use the CLI to list the permissions either

use

get-layer-version-policy

aha

of course.

I hope I can return the favor someday 🙏

Your questions are already helping me, a good question is its own reward.

😁 goodnight!

@Ashishkumar Pandey Wow, thanks for being so awesome!

Thank you, @Jay 😁🙏