Package com.pulumi.aws.lambda

Class Permission

  • public class Permission
extends com.pulumi.resources.CustomResource
    Manages an AWS Lambda permission. Use this resource to grant external sources (e.g., EventBridge Rules, SNS, or S3) permission to invoke Lambda functions. ## Example Usage ### Basic Usage with EventBridge 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.Alias;
 import com.pulumi.aws.lambda.AliasArgs;
 import com.pulumi.aws.lambda.Permission;
 import com.pulumi.aws.lambda.PermissionArgs;
 import com.pulumi.asset.FileArchive;
 import static com.pulumi.codegen.internal.Serialization.*;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var iamForLambda = new Role("iamForLambda", RoleArgs.builder()
             .name("iam_for_lambda")
             .assumeRolePolicy(serializeJson(
                 jsonObject(
                     jsonProperty("Version", "2012-10-17"),
                     jsonProperty("Statement", jsonArray(jsonObject(
                         jsonProperty("Action", "sts:AssumeRole"),
                         jsonProperty("Effect", "Allow"),
                         jsonProperty("Sid", ""),
                         jsonProperty("Principal", jsonObject(
                             jsonProperty("Service", "lambda.amazonaws.com")
                         ))
                     )))
                 )))
             .build());
 
         var testLambda = new Function("testLambda", FunctionArgs.builder()
             .code(new FileArchive("lambdatest.zip"))
             .name("lambda_function_name")
             .role(iamForLambda.arn())
             .handler("exports.handler")
             .runtime("nodejs24.x")
             .build());
 
         var testAlias = new Alias("testAlias", AliasArgs.builder()
             .name("testalias")
             .description("a sample description")
             .functionName(testLambda.name())
             .functionVersion("$LATEST")
             .build());
 
         var allowCloudwatch = new Permission("allowCloudwatch", PermissionArgs.builder()
             .statementId("AllowExecutionFromCloudWatch")
             .action("lambda:InvokeFunction")
             .function(testLambda.name())
             .principal("events.amazonaws.com")
             .sourceArn("arn:aws:events:eu-west-1:111122223333:rule/RunDaily")
             .qualifier(testAlias.name())
             .build());
 
     }
 }
    ### SNS Integration 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.sns.Topic;
 import com.pulumi.aws.sns.TopicArgs;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.Permission;
 import com.pulumi.aws.lambda.PermissionArgs;
 import com.pulumi.aws.sns.TopicSubscription;
 import com.pulumi.aws.sns.TopicSubscriptionArgs;
 import com.pulumi.asset.FileArchive;
 import static com.pulumi.codegen.internal.Serialization.*;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var default_ = new Topic("default", TopicArgs.builder()
             .name("call-lambda-maybe")
             .build());
 
         var defaultRole = new Role("defaultRole", RoleArgs.builder()
             .name("iam_for_lambda_with_sns")
             .assumeRolePolicy(serializeJson(
                 jsonObject(
                     jsonProperty("Version", "2012-10-17"),
                     jsonProperty("Statement", jsonArray(jsonObject(
                         jsonProperty("Action", "sts:AssumeRole"),
                         jsonProperty("Effect", "Allow"),
                         jsonProperty("Sid", ""),
                         jsonProperty("Principal", jsonObject(
                             jsonProperty("Service", "lambda.amazonaws.com")
                         ))
                     )))
                 )))
             .build());
 
         var func = new Function("func", FunctionArgs.builder()
             .code(new FileArchive("lambdatest.zip"))
             .name("lambda_called_from_sns")
             .role(defaultRole.arn())
             .handler("exports.handler")
             .runtime("python3.12")
             .build());
 
         var withSns = new Permission("withSns", PermissionArgs.builder()
             .statementId("AllowExecutionFromSNS")
             .action("lambda:InvokeFunction")
             .function(func.name())
             .principal("sns.amazonaws.com")
             .sourceArn(default_.arn())
             .build());
 
         var lambda = new TopicSubscription("lambda", TopicSubscriptionArgs.builder()
             .topic(default_.arn())
             .protocol("lambda")
             .endpoint(func.arn())
             .build());
 
     }
 }
    ### API Gateway REST API Integration 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.apigateway.RestApi;
 import com.pulumi.aws.apigateway.RestApiArgs;
 import com.pulumi.aws.lambda.Permission;
 import com.pulumi.aws.lambda.PermissionArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var myDemoAPI = new RestApi("myDemoAPI", RestApiArgs.builder()
             .name("MyDemoAPI")
             .description("This is my API for demonstration purposes")
             .build());
 
         var lambdaPermission = new Permission("lambdaPermission", PermissionArgs.builder()
             .statementId("AllowMyDemoAPIInvoke")
             .action("lambda:InvokeFunction")
             .function("MyDemoFunction")
             .principal("apigateway.amazonaws.com")
             .sourceArn(myDemoAPI.executionArn().applyValue(_executionArn -> String.format("%s/*", _executionArn)))
             .build());
 
     }
 }
    ### CloudWatch Log Group Integration 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.cloudwatch.LogGroup;
 import com.pulumi.aws.cloudwatch.LogGroupArgs;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.Permission;
 import com.pulumi.aws.lambda.PermissionArgs;
 import com.pulumi.aws.cloudwatch.LogSubscriptionFilter;
 import com.pulumi.aws.cloudwatch.LogSubscriptionFilterArgs;
 import com.pulumi.asset.FileArchive;
 import com.pulumi.resources.CustomResourceOptions;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var default_ = new LogGroup("default", LogGroupArgs.builder()
             .name("/default")
             .build());
 
         final var assumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("Service")
                     .identifiers("lambda.amazonaws.com")
                     .build())
                 .effect("Allow")
                 .actions("sts:AssumeRole")
                 .build())
             .build());
 
         var defaultRole = new Role("defaultRole", RoleArgs.builder()
             .name("iam_for_lambda_called_from_cloudwatch_logs")
             .assumeRolePolicy(assumeRole.json())
             .build());
 
         var loggingFunction = new Function("loggingFunction", FunctionArgs.builder()
             .code(new FileArchive("lamba_logging.zip"))
             .name("lambda_called_from_cloudwatch_logs")
             .handler("exports.handler")
             .role(defaultRole.arn())
             .runtime("python3.12")
             .build());
 
         var logging = new Permission("logging", PermissionArgs.builder()
             .action("lambda:InvokeFunction")
             .function(loggingFunction.name())
             .principal("logs.eu-west-1.amazonaws.com")
             .sourceArn(default_.arn().applyValue(_arn -> String.format("%s:*", _arn)))
             .build());
 
         var loggingLogSubscriptionFilter = new LogSubscriptionFilter("loggingLogSubscriptionFilter", LogSubscriptionFilterArgs.builder()
             .destinationArn(loggingFunction.arn())
             .filterPattern("")
             .logGroup(default_.name())
             .name("logging_default")
             .build(), CustomResourceOptions.builder()
                 .dependsOn(logging)
                 .build());
 
     }
 }
    ### Cross-Account Function URL Access 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.lambda.FunctionUrl;
 import com.pulumi.aws.lambda.FunctionUrlArgs;
 import com.pulumi.aws.lambda.Permission;
 import com.pulumi.aws.lambda.PermissionArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var url = new FunctionUrl("url", FunctionUrlArgs.builder()
             .functionName(example.functionName())
             .authorizationType("AWS_IAM")
             .build());
 
         var urlPermission = new Permission("urlPermission", PermissionArgs.builder()
             .action("lambda:InvokeFunctionUrl")
             .function(example.functionName())
             .principal("arn:aws:iam::444455556666:role/example")
             .sourceAccount("444455556666")
             .functionUrlAuthType("AWS_IAM")
             .build());
 
     }
 }
    #### Optional * `accountId` (String) AWS Account where this resource is managed. * `qualifier` (String) Qualifier for the function version or alias. * `region` (String) Region where this resource is managed. Using `qualifier`: For backwards compatibility, the following legacy `pulumi import` commands are also supported: ```sh $ pulumi import aws:lambda/permission:Permission example my_test_lambda_function/AllowExecutionFromCloudWatch $ pulumi import aws:lambda/permission:Permission example my_test_lambda_function:qualifier_name/AllowExecutionFromCloudWatch ```

    • Nested Class Summary

      • Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

        com.pulumi.resources.CustomResource.CustomResourceInternal

      • Nested classes/interfaces inherited from class com.pulumi.resources.Resource

        com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

    • Field Summary

      • Fields inherited from class com.pulumi.resources.Resource

        childResources, remote

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      com.pulumi.core.Output<java.lang.String> action()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> eventSourceToken()  
      com.pulumi.core.Output<java.lang.String> function()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> functionUrlAuthType()  
      static Permission get​(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, PermissionState state, com.pulumi.resources.CustomResourceOptions options)
      Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
      com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> invokedViaFunctionUrl()  
      com.pulumi.core.Output<java.lang.String> principal()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> principalOrgId()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> qualifier()  
      com.pulumi.core.Output<java.lang.String> region()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> sourceAccount()  
      com.pulumi.core.Output<java.util.Optional<java.lang.String>> sourceArn()  
      com.pulumi.core.Output<java.lang.String> statementId()  
      com.pulumi.core.Output<java.lang.String> statementIdPrefix()  

      • Methods inherited from class com.pulumi.resources.CustomResource

        getId, id, idFuture

      • Methods inherited from class com.pulumi.resources.Resource

        getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • Permission

        public Permission​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • Permission

        public Permission​(java.lang.String name,
                  PermissionArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • Permission

        public Permission​(java.lang.String name,
                  PermissionArgs args,
                  @Nullable
                  com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • action

        public com.pulumi.core.Output<java.lang.String> action()
        Returns:
        Lambda action to allow in this statement (e.g., `lambda:InvokeFunction`)

      • eventSourceToken

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> eventSourceToken()
        Returns:
        Event Source Token for Alexa Skills

      • function

        public com.pulumi.core.Output<java.lang.String> function()
        Returns:
        Name or ARN of the Lambda function

      • functionUrlAuthType

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> functionUrlAuthType()
        Returns:
        Lambda Function URL authentication type. Valid values: `AWS_IAM` or `NONE`. Only valid with `lambda:InvokeFunctionUrl` action

      • invokedViaFunctionUrl

        public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> invokedViaFunctionUrl()
        Returns:
        Lambda Function URL invoke permission. Only valid with `lambda:InvokeFunction` action

      • principal

        public com.pulumi.core.Output<java.lang.String> principal()
        Returns:
        AWS service or account that invokes the function (e.g., `s3.amazonaws.com`, `sns.amazonaws.com`, AWS account ID, or AWS IAM principal) The following arguments are optional:

      • principalOrgId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> principalOrgId()
        Returns:
        AWS Organizations ID to grant permission to all accounts under this organization

      • qualifier

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> qualifier()
        Returns:
        Lambda function version or alias name

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration

      • sourceAccount

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> sourceAccount()
        Returns:
        AWS account ID of the source owner for cross-account access, S3, or SES

      • sourceArn

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> sourceArn()
        Returns:
        ARN of the source resource granting permission to invoke the Lambda function

      • statementId

        public com.pulumi.core.Output<java.lang.String> statementId()
        Returns:
        Statement identifier. Generated by Pulumi if not provided

      • statementIdPrefix

        public com.pulumi.core.Output<java.lang.String> statementIdPrefix()
        Returns:
        Statement identifier prefix. Conflicts with `statementId`

      • get

        public static Permission get​(java.lang.String name,
                             com.pulumi.core.Output<java.lang.String> id,
                             @Nullable
                             PermissionState state,
                             @Nullable
                             com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.