ALB: Lambda permissions should use aws:SourceArn

[argenstijn]

This is both more secure and makes the ALB show up in the Lambda console.

---

If you create a Lambda with ALB integration
you don't see the ALB popping up in the AWS console in the designer TAB.

Should be like this:

I think you should explicit give the TG access to the lambda.

{
"Sid": "WhaTEVER",
"Effect": "Allow",
"Principal": {
"Service": "elasticloadbalancing.amazonaws.com"
},
"Action": "lambda:InvokeFunction",
"Resource": "LAMBDA",
"Condition": {
"ArnLike": {
"AWS:SourceArn": "TARGET GROUP"
}
}
}

Use Case

Proposed Solution

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[argenstijn]

It;s CDK 1.39 by the way. I am using Java 11 with CDK!

[rix0rrr]

Sure. But I'm a little confused.

Can you explain to me how it is that the TargetGroup/LoadBalancer can apparently call the Lambda (since handling requests works, no?) but not see it to render it in the console?

[argenstijn]

@rix0rrr Because of the permission below. But this is not enough clearly for AWS to show the ALB in the designer view of the LAMBDA

{
"Sid": "iapi-dev-nec-test-CDKStack-awsLambdaLambdaAliasInvokeServicePrincipalelasticloadbalanc-J0ER6SMD8G8Y",
"Effect": "Allow",
"Principal": {
"Service": "elasticloadbalancing.amazonaws.com"
},
"Action": "lambda:InvokeFunction",
"Resource": "arn:aws:lambda:eu-west-1:124905771571:function:iapi-dev-nec-test-lambda:life"
},

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.