https://serverless-stack.com/ logo
Join Slack
Powered by
How would I add a custom Trust relationship to the...
# help
l
How would I add a custom Trust relationship to the ServiceRole for my Lambda functions?
f
You can reference the role via 
role
, so
Copy code
const fn = new sst.Function(...);
fn.role
And you can look at the IAM Role doc and see if that’s doable - https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-iam.Role.html
l
Phew, I figured out how to do this. Turns out 'Trust relationships' are a very confusing concept because they are named differently in different parts of AWS docs. Essentially it's the same as the 
assumeRolePolicy
in the role for your function. Here's a code snippet of how to change it
Copy code
import * as sst from "@serverless-stack/resources";
import * as lambda from "@aws-cdk/aws-lambda";
import { PolicyStatement, Effect, ServicePrincipal } from "@aws-cdk/aws-iam";

export default class Edge extends sst.Stack {
  constructor(scope, id, props) {
    super(scope, id, props);

    const edgeFunction = new sst.Function(this, "MyEdgeFunction2", {
      handler: "src/lambda.main",
    });

    const edgePolicyStatement = new PolicyStatement({
      actions: ["sts:AssumeRole"],
      effect: Effect.ALLOW,
      principals: [
        new ServicePrincipal("<http://lambda.amazonaws.com|lambda.amazonaws.com>"),
        new ServicePrincipal("<http://edgelambda.amazonaws.com|edgelambda.amazonaws.com>"),
      ],
    });

    edgeFunction.node.host.role.assumeRolePolicy.statements = [
      edgePolicyStatement,
    ];

    edgeFunction.node.host.environment = {};

    const version = new lambda.Version(this, "MyVersion2", {
      lambda: edgeFunction,
    });

    this.addOutputs({
      VersionArn: { value: version.functionArn },
    });
  }
}
(Refer to the lines where 
edgePolicyStatement
is defined and then used to set 
...assumeRolePolicy.statements
)
f
@Louis Barclay Thanks for sharing! Dang! That looks super messy.
Let me bump up the priority on Lambda@Edge support https://github.com/serverless-stack/serverless-stack/issues/577
Open in Slack
PreviousNext
Powered by