diff --git a/examples/2016-10-31/lambda_edge/template.yaml b/examples/2016-10-31/lambda_edge/template.yaml
index 25cd68aa0d..d0a8ff5fe1 100644
--- a/examples/2016-10-31/lambda_edge/template.yaml
+++ b/examples/2016-10-31/lambda_edge/template.yaml
@@ -61,24 +61,14 @@ Resources:
Handler: index.handler
Timeout: 5
# More info at https://github.com/awslabs/serverless-application-model/blob/master/docs/safe_lambda_deployments.rst
- AutoPublishAlias: live
-
- LambdaEdgeFunctionRole:
- Type: "AWS::IAM::Role"
- Properties:
- Path: "/"
- ManagedPolicyArns:
- - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+ AutoPublishAlias: live
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- -
- Sid: "AllowLambdaServiceToAssumeRole"
- Effect: "Allow"
- Action:
- - "sts:AssumeRole"
+ - Effect: "Allow"
+ Action: "sts:AssumeRole"
Principal:
- Service:
+ Service:
- "lambda.amazonaws.com"
- "edgelambda.amazonaws.com"
diff --git a/samtranslator/model/sam_resources.py b/samtranslator/model/sam_resources.py
index 834c9825c4..3fcead948a 100644
--- a/samtranslator/model/sam_resources.py
+++ b/samtranslator/model/sam_resources.py
@@ -44,6 +44,7 @@ class SamFunction(SamResourceMacro):
'Timeout': PropertyType(False, is_type(int)),
'VpcConfig': PropertyType(False, is_type(dict)),
'Role': PropertyType(False, is_str()),
+ 'AssumeRolePolicyDocument': PropertyType(False, is_type(dict)),
'Policies': PropertyType(False, one_of(is_str(), list_of(one_of(is_str(), is_type(dict), is_type(dict))))),
'PermissionsBoundary': PropertyType(False, is_str()),
'Environment': PropertyType(False, dict_of(is_str(), is_type(dict))),
@@ -201,7 +202,11 @@ def _construct_role(self, managed_policy_map):
:rtype: model.iam.IAMRole
"""
execution_role = IAMRole(self.logical_id + 'Role', attributes=self.get_passthrough_resource_attributes())
- execution_role.AssumeRolePolicyDocument = IAMRolePolicies.lambda_assume_role_policy()
+
+ if self.AssumeRolePolicyDocument is not None:
+ execution_role.AssumeRolePolicyDocument = self.AssumeRolePolicyDocument
+ else:
+ execution_role.AssumeRolePolicyDocument = IAMRolePolicies.lambda_assume_role_policy()
managed_policy_arns = [ArnGenerator.generate_aws_managed_policy_arn('service-role/AWSLambdaBasicExecutionRole')]
if self.Tracing:
diff --git a/samtranslator/plugins/globals/globals.py b/samtranslator/plugins/globals/globals.py
index 82eded26bf..ae17fecfd9 100644
--- a/samtranslator/plugins/globals/globals.py
+++ b/samtranslator/plugins/globals/globals.py
@@ -37,7 +37,8 @@ class Globals(object):
"DeploymentPreference",
"PermissionsBoundary",
"ReservedConcurrentExecutions",
- "ProvisionedConcurrencyConfig"
+ "ProvisionedConcurrencyConfig",
+ "AssumeRolePolicyDocument"
],
# Everything except
diff --git a/tests/model/test_sam_resources.py b/tests/model/test_sam_resources.py
index a2129d1eb7..d699c65884 100644
--- a/tests/model/test_sam_resources.py
+++ b/tests/model/test_sam_resources.py
@@ -8,6 +8,7 @@
from samtranslator.model.apigateway import ApiGatewayRestApi
from samtranslator.model.apigateway import ApiGatewayDeployment
from samtranslator.model.apigateway import ApiGatewayStage
+from samtranslator.model.iam import IAMRole
from samtranslator.model.sam_resources import SamFunction
from samtranslator.model.sam_resources import SamApi
@@ -53,6 +54,70 @@ def test_with_no_code_uri_or_zipfile(self):
with pytest.raises(InvalidResourceException):
function.to_cloudformation(**self.kwargs)
+class TestAssumeRolePolicyDocument(TestCase):
+ kwargs = {
+ 'intrinsics_resolver': IntrinsicsResolver({}),
+ 'event_resources': [],
+ 'managed_policy_map': {
+ "foo": "bar"
+ }
+ }
+
+ @patch('boto3.session.Session.region_name', 'ap-southeast-1')
+ def test_with_assume_role_policy_document(self):
+ function = SamFunction("foo")
+ function.CodeUri = "s3://foobar/foo.zip"
+
+ assume_role_policy_document = {
+ 'Version': '2012-10-17',
+ 'Statement': [
+ {
+ 'Action': [
+ 'sts:AssumeRole'
+ ],
+ 'Effect': 'Allow',
+ 'Principal': {
+ 'Service': [
+ 'lambda.amazonaws.com',
+ 'edgelambda.amazonaws.com'
+ ]
+ }
+ }
+ ]
+ }
+
+ function.AssumeRolePolicyDocument = assume_role_policy_document
+
+ cfnResources = function.to_cloudformation(**self.kwargs)
+ generateFunctionVersion = [x for x in cfnResources if isinstance(x, IAMRole)]
+ self.assertEqual(generateFunctionVersion[0].AssumeRolePolicyDocument, assume_role_policy_document)
+
+ @patch('boto3.session.Session.region_name', 'ap-southeast-1')
+ def test_without_assume_role_policy_document(self):
+ function = SamFunction("foo")
+ function.CodeUri = "s3://foobar/foo.zip"
+
+ assume_role_policy_document = {
+ 'Version': '2012-10-17',
+ 'Statement': [
+ {
+ 'Action': [
+ 'sts:AssumeRole'
+ ],
+ 'Effect': 'Allow',
+ 'Principal': {
+ 'Service': [
+ 'lambda.amazonaws.com'
+ ]
+ }
+ }
+ ]
+ }
+
+ cfnResources = function.to_cloudformation(**self.kwargs)
+ generateFunctionVersion = [x for x in cfnResources if isinstance(x, IAMRole)]
+ self.assertEqual(generateFunctionVersion[0].AssumeRolePolicyDocument, assume_role_policy_document)
+
class TestVersionDescription(TestCase):
kwargs = {
'intrinsics_resolver': IntrinsicsResolver({}),
diff --git a/tests/translator/output/error_globals_unsupported_property.json b/tests/translator/output/error_globals_unsupported_property.json
index b84f45e787..473141a417 100644
--- a/tests/translator/output/error_globals_unsupported_property.json
+++ b/tests/translator/output/error_globals_unsupported_property.json
@@ -4,5 +4,5 @@
"errorMessage": "'Globals' section is invalid. 'SomeKey' is not a supported property of 'Function'. Must be one of the following values - ['Handler', 'Runtime', 'CodeUri', 'DeadLetterQueue', 'Description', 'MemorySize', 'Timeout', 'VpcConfig', 'Environment', 'Tags', 'Tracing', 'KmsKeyArn', 'AutoPublishAlias', 'Layers', 'DeploymentPreference', 'PermissionsBoundary', 'ReservedConcurrentExecutions', 'ProvisionedConcurrencyConfig']"
}
],
- "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. 'Globals' section is invalid. 'SomeKey' is not a supported property of 'Function'. Must be one of the following values - ['Handler', 'Runtime', 'CodeUri', 'DeadLetterQueue', 'Description', 'MemorySize', 'Timeout', 'VpcConfig', 'Environment', 'Tags', 'Tracing', 'KmsKeyArn', 'AutoPublishAlias', 'Layers', 'DeploymentPreference', 'PermissionsBoundary', 'ReservedConcurrentExecutions', 'ProvisionedConcurrencyConfig']"
+ "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. 'Globals' section is invalid. 'SomeKey' is not a supported property of 'Function'. Must be one of the following values - ['Handler', 'Runtime', 'CodeUri', 'DeadLetterQueue', 'Description', 'MemorySize', 'Timeout', 'VpcConfig', 'Environment', 'Tags', 'Tracing', 'KmsKeyArn', 'AutoPublishAlias', 'Layers', 'DeploymentPreference', 'PermissionsBoundary', 'ReservedConcurrentExecutions', 'ProvisionedConcurrencyConfig', 'AssumeRolePolicyDocument']"
}
diff --git a/versions/2016-10-31.md b/versions/2016-10-31.md
index 1ec55be2ca..d653374a09 100644
--- a/versions/2016-10-31.md
+++ b/versions/2016-10-31.md
@@ -117,6 +117,7 @@ Description | `string` | Description of the function.
MemorySize | `integer` | Size of the memory allocated per invocation of the function in MB. Defaults to 128.
Timeout | `integer` | Maximum time that the function can run before it is killed in seconds. Defaults to 3.
Role | `string` | ARN of an IAM role to use as this function's execution role. If omitted, a default role is created for this function.
+AssumeRolePolicyDocument | [IAM policy document object](http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html) | AssumeRolePolicyDocument of the default created role for this function.
Policies | `string` | List of `string` | [IAM policy document object](http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html) | List of [IAM policy document object](http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies.html) | List of [SAM Policy Templates](../docs/policy_templates.rst) | Names of AWS managed IAM policies or IAM policy documents or SAM Policy Templates that this function needs, which should be appended to the default role for this function. If the Role property is set, this property has no meaning.
PermissionsBoundary | `string` | ARN of a permissions boundary to use for this function's execution role.
Environment | [Function environment object](#environment-object) | Configuration for the runtime environment.