You are viewing documentation for version 2 of the AWS SDK for Ruby. Version 3 documentation can be found here.

Class: Aws::Lambda::Types::AddPermissionRequest

Inherits:
Struct
  • Object
show all
Defined in:
(unknown)

Overview

Note:

When passing AddPermissionRequest as input to an Aws::Client method, you can use a vanilla Hash:

{
  function_name: "FunctionName", # required
  statement_id: "StatementId", # required
  action: "Action", # required
  principal: "Principal", # required
  source_arn: "Arn",
  source_account: "SourceOwner",
  event_source_token: "EventSourceToken",
  qualifier: "Qualifier",
}

Instance Attribute Summary collapse

Instance Attribute Details

#actionString

The AWS Lambda action you want to allow in this statement. Each Lambda action is a string starting with lambda: followed by the API name . For example, lambda:CreateFunction. You can use wildcard (lambda:*) to grant permission for all AWS Lambda actions.

Returns:

  • (String)

    The AWS Lambda action you want to allow in this statement.

#event_source_tokenString

A unique token that must be supplied by the principal invoking the function. This is currently only used for Alexa Smart Home functions.

Returns:

  • (String)

    A unique token that must be supplied by the principal invoking the function.

#function_nameString

Name of the Lambda function whose resource policy you are updating by adding a new permission.

You can specify a function name (for example, Thumbnail) or you can specify Amazon Resource Name (ARN) of the function (for example, arn:aws:lambda:us-west-2:account-id:function:ThumbNail). AWS Lambda also allows you to specify partial ARN (for example, account-id:Thumbnail). Note that the length constraint applies only to the ARN. If you specify only the function name, it is limited to 64 characters in length.

Returns:

  • (String)

    Name of the Lambda function whose resource policy you are updating by adding a new permission.

#principalString

The principal who is getting this permission. It can be Amazon S3 service Principal (s3.amazonaws.com) if you want Amazon S3 to invoke the function, an AWS account ID if you are granting cross-account permission, or any valid AWS service principal such as sns.amazonaws.com. For example, you might want to allow a custom application in another AWS account to push events to AWS Lambda by invoking your function.

Returns:

  • (String)

    The principal who is getting this permission.

#qualifierString

You can use this optional query parameter to describe a qualified ARN using a function version or an alias name. The permission will then apply to the specific qualified ARN. For example, if you specify function version 2 as the qualifier, then permission applies only when request is made using qualified function ARN:

arn:aws:lambda:aws-region:acct-id:function:function-name:2

If you specify an alias name, for example PROD, then the permission is valid only for requests made using the alias ARN:

arn:aws:lambda:aws-region:acct-id:function:function-name:PROD

If the qualifier is not specified, the permission is valid only when requests is made using unqualified function ARN.

arn:aws:lambda:aws-region:acct-id:function:function-name

Returns:

  • (String)

    You can use this optional query parameter to describe a qualified ARN using a function version or an alias name.

#source_accountString

This parameter is used for S3 and SES. The AWS account ID (without a hyphen) of the source owner. For example, if the SourceArn identifies a bucket, then this is the bucket owner\'s account ID. You can use this additional condition to ensure the bucket you specify is owned by a specific account (it is possible the bucket owner deleted the bucket and some other AWS account created the bucket). You can also use this condition to specify all sources (that is, you don\'t specify the SourceArn) owned by a specific account.

Returns:

  • (String)

    This parameter is used for S3 and SES.

#source_arnString

This is optional; however, when granting permission to invoke your function, you should specify this field with the Amazon Resource Name (ARN) as its value. This ensures that only events generated from the specified source can invoke the function.

If you add a permission without providing the source ARN, any AWS account that creates a mapping to your function ARN can send events to invoke your Lambda function.

Returns:

  • (String)

    This is optional; however, when granting permission to invoke your function, you should specify this field with the Amazon Resource Name (ARN) as its value.

#statement_idString

A unique statement identifier.

Returns:

  • (String)

    A unique statement identifier.