Permission does not include alias when attaching a function URL with a pre-traffic hook

[johnc44]

Adding FunctionUrlConfig to a serverless function definition which also has a pre-traffic hook creates a lambda permission that points to the latest version of the funciton, not the 'live' alias and browsing the lambda endpoint returns {"error": "Forbidden"}.

Using the AWS Console, the lambda function shows the Permission on the latest version, but does not show the URL. Changing to the live alias shows the URL but not the permission.

Example template:
` MyTestLambda:
Type: AWS::Serverless::Function
Properties:
CodeUri: src/
Handler: main.lambda_handler
Runtime: python3.9
FunctionName: MyTestLambda
Description: Test lambda
AutoPublishAlias: live
DeploymentPreference:
Type: AllAtOnce
Hooks:
PreTraffic: !Ref PreTrafficHook

  FunctionUrlConfig:
    AuthType: NONE

For ref, this is what I had to add as a workaround:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:InvokeFunctionUrl
Principal: "*"
FunctionName:
!Sub
- "${name}:live"
- name:
!Ref myTestLambda
FunctionUrlAuthType: NONE
`

Using aws-sam-cli version 1.46 on both macOS and Linux.

[moelasmar]

thanks @johnc44 for raising this issue. This issue is related to SAM repo, I will move it.

[moelasmar]

thanks @johnc44 for raising this issue, I confirmed that it is a bug. The created Permission should be like the following:

HelloWorldFunctionUrlPublicPermissions:
    Properties:
      Action: lambda:InvokeFunctionUrl
      FunctionName:
        Ref: HelloWorldFunctionAliaslive # refer to the alias, not the function
      FunctionUrlAuthType: NONE
      Principal: '*'
    Type: AWS::Lambda::Permission

instead of

HelloWorldFunctionUrlPublicPermissions:
    Properties:
      Action: lambda:InvokeFunctionUrl
      FunctionName:
        Ref: HelloWorldFunction
      FunctionUrlAuthType: NONE
      Principal: '*'
    Type: AWS::Lambda::Permission

[moelasmar]

Pushed this PR to fix this issue.

[johnc44]

Wow - that was fas!t. Thahks so much @moelasmar

[Edited to remove my query - I hadn't read your change properly - looks good!]

[hawflau]

Closing as the fix (#2378) has been release in v1.46.0