Interface IPermission
Represents a permission statement that can be added to a Lambda function's resource policy via the addPermission()
method.
Namespace: Amazon.CDK.AWS.Lambda
Assembly: Amazon.CDK.Lib.dll
Syntax (csharp)
public interface IPermission
Syntax (vb)
Public Interface IPermission
Remarks
ExampleMetadata: infused
Examples
// Grant permissions to a service
Function fn;
var principal = new ServicePrincipal("my-service");
fn.GrantInvoke(principal);
// Equivalent to:
fn.AddPermission("my-service Invocation", new Permission {
Principal = principal
});
Synopsis
Properties
Action | The Lambda actions that you want to allow in this statement. |
EventSourceToken | A unique token that must be supplied by the principal invoking the function. |
FunctionUrlAuthType | The authType for the function URL that you are granting permissions for. |
OrganizationId | The organization you want to grant permissions to. |
Principal | The entity for which you are granting permission to invoke the Lambda function. |
Scope | The scope to which the permission constructs be attached. |
SourceAccount | The AWS account ID (without hyphens) of the source owner. |
SourceArn | The ARN of a resource that is invoking your function. |
Properties
Action
The Lambda actions that you want to allow in this statement.
virtual string Action { get; }
Property Value
System.String
Remarks
For example,
you can specify lambda:CreateFunction to specify a certain action, or use
a wildcard (lambda:*
) to grant permission to all Lambda actions. For a
list of actions, see Actions and Condition Context Keys for AWS Lambda in
the IAM User Guide.
Default: 'lambda:InvokeFunction'
EventSourceToken
A unique token that must be supplied by the principal invoking the function.
virtual string EventSourceToken { get; }
Property Value
System.String
Remarks
Default: - The caller would not need to present a token.
FunctionUrlAuthType
The authType for the function URL that you are granting permissions for.
virtual Nullable<FunctionUrlAuthType> FunctionUrlAuthType { get; }
Property Value
System.Nullable<FunctionUrlAuthType>
Remarks
Default: - No functionUrlAuthType
OrganizationId
The organization you want to grant permissions to.
virtual string OrganizationId { get; }
Property Value
System.String
Remarks
Use this ONLY if you
need to grant permissions to a subset of the organization. If you want to
grant permissions to the entire organization, sending the organization principal
through the principal
property will suffice.
You can use this property to ensure that all source principals are owned by a specific organization.
Default: - No organizationId
Principal
The entity for which you are granting permission to invoke the Lambda function.
IPrincipal Principal { get; }
Property Value
Remarks
This entity can be any of the following:
The principal can be an AccountPrincipal, an ArnPrincipal, a ServicePrincipal, or an OrganizationPrincipal.
Scope
The scope to which the permission constructs be attached.
virtual Construct Scope { get; }
Property Value
Constructs.Construct
Remarks
The default is the Lambda function construct itself, but this would need to be different in cases such as cross-stack references where the Permissions would need to sit closer to the consumer of this permission (i.e., the caller).
Default: - The instance of lambda.IFunction
SourceAccount
The AWS account ID (without hyphens) of the source owner.
virtual string SourceAccount { get; }
Property Value
System.String
Remarks
For example, if you specify an S3 bucket in the SourceArn property, this value is the bucket owner's account ID. You can use this property to ensure that all source principals are owned by a specific account.
SourceArn
The ARN of a resource that is invoking your function.
virtual string SourceArn { get; }
Property Value
System.String
Remarks
When granting Amazon Simple Storage Service (Amazon S3) permission to invoke your function, specify this property with the bucket ARN as its value. This ensures that events generated only from the specified bucket, not just any bucket from any AWS account that creates a mapping to your function, can invoke the function.