Bug: LambdaFunctionUrlSchema fails with CloudFront Origin Access Control (OAC)

[aripalo]

Expected Behaviour

Using .use(parser({ schema: LambdaFunctionUrlSchema })) middleware should work with Lambda Function URLs protected by the newly launched CloudFront OACs.

Current Behaviour

The parser throws an error:

Failed to parse schema. This error was caused by: [
  
{
    "code": "invalid_type",
    "expected": "string",
    "received": "null",
    "path": [
        "requestContext",
        "authorizer",
        "iam",
        "principalOrgId"
    ],
    "message": "Expected string, received null"
}
,
  
{
    "code": "invalid_type",
    "expected": "object",
    "received": "null",
    "path": [
        "requestContext",
        "authorizer",
        "iam",
        "cognitoIdentity"
    ],
    "message": "Expected object, received null"
}

This is because when CloudFront OAC is calling the Lambda Function URL, the principalOrgId and cognitoIdentity are actual set to null:

// some sensitive'ish values replaced with fictional values
"requestContext": {
            "accountId": "123456789012",
            "apiId": "abcd1",
            "authorizer": {
                "iam": {
                    "accessKey": "ASIA123EXAMPLE",
                    "accountId": "123456789012",
                    "callerId": "AROA123EXAMPLE:OriginAccessSession",
/* NOTICE NULL → */ "cognitoIdentity": null, 
/* NOTICE NULL → */ "principalOrgId": null,  
                    "userArn": "arn:aws:sts::123456789012:assumed-role/OriginAccessControlRole/OriginAccessSession",
                    "userId": "AROA123EXAMPLE:OriginAccessSession"
                }
            },

Code snippet

.use(parser({ schema: LambdaFunctionUrlSchema })) with Lambda Function URL + CloudFront OAC

Steps to Reproduce

Creating a full example is a bit too much work for right now, but you can take my minimal Lambda Function URL + CloudFront OAC example from aws/aws-cdk#21771 (comment) and replace the Lambda function with a TS one using .use(parser({ schema: LambdaFunctionUrlSchema })) middleware.

Possible Solution

• Make principalOrgId nullable
• Make cognitoIdentity nullable

Powertools for AWS Lambda (TypeScript) version

latest

AWS Lambda function runtime

20.x

Packaging format used

npm

Execution logs

No response

[aripalo]

Temporary "user-land" workaround is to ignore the requestContext (assuming one doesn't care about its contents in Lambda FnUrl + OAC context):

const TempSchema = LambdaFunctionUrlSchema.merge(
  z.object({
    requestContext: z.unknown(),
  }),
);

[dreamorosi]

Hi @aripalo, thank you for trying the Parser utility and taking the time to open an issue, as well as providing a temporary workaround.

I'll add this to the backlog so we can take a look at fixing it.

[github-actions]

⚠️ COMMENT VISIBILITY WARNING ⚠️

This issue is now closed. Please be mindful that future comments are hard for our team to see.

If you need more assistance, please either tag a team member or open a new issue that references this one.

If you wish to keep having a conversation with other community members under this issue feel free to do so.

[github-actions]

This is now released under v2.1.1 version!