3

We are deploying a lambda using CloudFormation SAM templates.

We would like to package the lambda into an S3 bucket, then deploy the AWS::Serverless::Function in multiple regions.

However, lambda code must reside in the same region as where it's being deployed.

AWS have documented how to work around this problem, essentially by creating another lambda CopyZips to copy the zip file to each region where you want it deployed, and a new s3 bucket LambdaZipsBucket in each region to put it in. Then your lambda function looks like this:

MyFunction:
    DependsOn: CopyZips
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: !Ref 'LambdaZipsBucket'
        S3Key: !Sub '${QSS3KeyPrefix}functions/packages/MyFunction/lambda.zip'

The problem is, that relies on knowing the exact path to the zip file. In our case we are using SAM template substitution, so we never specify the S3 bucket or S3 key - instead our Function looks like this:

  MyFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      CodeUri: ./MyCompany.Service.Broker.Public

The S3 bucket is not referenced at all in the CloudFormation template. And the lambda, which you can see by browsing the bucket, has a name like :

ApiFunction-CodeUri-2342873t823t482346-97346583746583745.zip

This is because there are lots of similar zips, created at build time. The Serverless template model will decode this, and if we look in the CloudFormation console, in the template tab, and select "view processed template", we can see the S3Bucket and S3Key fields populated correctly.

The build is done in Azure devops, using the AmazonWebServices.aws-vsts-tools.LambdaNETCoreDeploy.LambdaNETCoreDeploy@1 task, where we specify the bucket name and region, but again, not the name of the zip file.

Given that I have no access in the template to the exact path to the lambda zip file, how am I supposed to automate the copy of the zip file to a local bucket?

UPDATE:

I tried adding the following line in Properties, just before CodeUri:

      Code:
        S3Bucket: !Ref 'LambdaZipsBucket'

However, I got the following error on deployment:

Resource with id [ApiFunction] is invalid. property Code not defined for resource of type AWS::Serverless::Function
Improve this question
5
  • Is there any reason of why Cloudformation Lambda does not support lambda zip from other region?
    – Nicollas Braga
    Apr 14, 2021 at 7:59
  • @NicollasBraga You're asking the wrong question. The answer was already given in the OP: "However, lambda code must reside in the same region as where it's being deployed." Think a little further about the scenario. CloudFormation is not making the request to pull the Source ZIP, but the Lambda Service itself is doing it, with its own limitations. This isn't a problem with CF but Lambda. If you did what CF is doing manually you'd get exactly the same error from the Lambda Console.
    – eco
    Jan 23, 2022 at 6:21
  • Why can't you get the full S3 URL path? That is not a technical issue, that's a requirement design issue and human error. Why in the world would you use Azure to deploy code in AWS? Azure and AWS compete, you're bound to run into this. Did you RTM? docs.aws.amazon.com/serverless-application-model/latest/… "The function code's Amazon S3 URI, path to local folder, or FunctionCode object..."
    – eco
    Jan 23, 2022 at 6:27
  • Also, the title of your question is badly named. Your issue isn't cross region access from the Lambda service. Your issue is that you can't gather requirements to tell which is the Object Key within each bucket for each region in S3.
    – eco
    Jan 23, 2022 at 6:35
  • No matter what you do, you'll need the key. This is another example: aws.amazon.com/blogs/compute/… Again: s3: { bucket: asset.s3BucketName, key: asset.s3ObjectKey }
    – eco
    Jan 23, 2022 at 6:45

1 Answer 1

Reset to default
0

You can try using policy with AWS::Serverless::Function and give relevant permissions. Which look allowed in format.

Policies:
    - AWSLambdaExecute
    - Version: '2012-10-17' 
      Statement:
        - Effect: Allow
          Action:
            - s3:GetObject
            - s3:GetObjectACL
          Resource: 'arn:aws:s3:::LambdaZipsBucket/*'
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .