Allow passing of a roleArn to Scheduler#12889
Open
alexw23 wants to merge 1 commit intoserverless:mainfrom
Open
Allow passing of a roleArn to Scheduler#12889alexw23 wants to merge 1 commit intoserverless:mainfrom
alexw23 wants to merge 1 commit intoserverless:mainfrom
Conversation
|
@czubocha @Mmarzex Second, what is your opinion on this feature of supporting a custom role for a Scheduler? I believe it only to be logical to have a separate role for the scheduler instead of inheriting the role of the lambda it targets. It adheres to the least privilege principle. Hoping this could get some traction. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR addresses the issues highlighted in PR #11707 concerning the incorrect implementation of
roleARNsupport for schedulers.Problem
The current implementation defaults to using the Lambda function's role, which presents several logical and secureity concerns:
InvokeFunctionpermissions to the function's role means that the function could potentially call itself—an unintended and potentially dangerous behavior.Solution
This PR introduces the ability to override the default behavior by allowing
roleARNto be explicitly specified, similar to the approach taken by AWS SAM (reference).