Repository: aws/serverless-application-model

Issue #2386: Permission does not include alias when attaching a function URL with a pre-traffic hook
Created: 2022-04-25T07:34:40Z
Adding FunctionUrlConfig to a serverless function definition which also has a pre-traffic hook creates a lambda permission that points to the latest version of the funciton, not the 'live' alias and browsing the lambda endpoint returns {"error": "Forbidden"}.
Using the AWS Console, the lambda function shows the Permission on the latest version, but does not show the URL.  Changing to the live alias shows the URL but not the permission.
Example template:
`  MyTestLambda:
Type: AWS::Serverless::Function
Properties:
CodeUri: src/
Handler: main.lambda_handler
Runtime: python3.9
FunctionName: MyTestLambda
Description: Test lambda
AutoPublishAlias: live
DeploymentPreference:
Type: AllAtOnce
Hooks:
PreTraffic: !Ref PreTrafficHook
  FunctionUrlConfig:
    AuthType: NONE

For ref, this is what I had to add as a workaround:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:InvokeFunctionUrl
Principal: "*"
FunctionName:
!Sub
- "${name}:live"
- name:
!Ref myTestLambda
FunctionUrlAuthType: NONE
`
Using aws-sam-cli version 1.46 on both macOS and Linux.

Duplicate issue #2373: Function.FunctionUrlConfig generates incorrect policy for aliased function
Created: 2022-04-07T05:05:06Z
Description:
I have created a function that has an alias and URL configuration with the following template:
Transform: AWS::Serverless-2016-10-31

Resources:
  Function:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./bootstrap
      Architectures: [arm64]
      Runtime: provided.al2
      Handler: unused
      AutoPublishAlias: live # notice defined alias
      FunctionUrlConfig:
        AuthType: NONE
This is the template after the serverless transformation. Note that the 7th line is incorrectly referencing the function and not the function's alias.
Resources:
  FunctionUrlPublicPermissions:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunctionUrl
      FunctionName:
        Ref: Function # this should be Ref: FunctionAliaslive
      Principal: "*"
      FunctionUrlAuthType: NONE
  FunctionUrl:
    Type: AWS::Lambda::Url
    Properties:
      TargetFunctionArn:
        Ref: FunctionAliaslive
      AuthType: NONE
  Function:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: stackit-ap-southeast-2-0123465690
        S3Key: urlshenanigans/bootstrap.zip/b15b257b4b1d56015ffb6160f1564d2e
        S3ObjectVersion: ThuT.NfqNqrs7apqjJT7nb9P4ox8TpiT
      Handler: unused
      Role:
        Fn::GetAtt:
          - FunctionRole
          - Arn
      Runtime: provided.al2
      Timeout: 30
      Tags:
        - Key: lambda:createdBy
          Value: SAM
      Architectures:
        - arm64
  FunctionVersionbe0cebe936:
    Type: AWS::Lambda::Version
    DeletionPolicy: Retain
    Properties:
      FunctionName:
        Ref: Function
  FunctionAliaslive:
    Type: AWS::Lambda::Alias
    Properties:
      Name: live
      FunctionName:
        Ref: Function
      FunctionVersion:
        Fn::GetAtt:
          - FunctionVersionbe0cebe936
          - Version
  FunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Tags:
        - Key: lambda:createdBy
          Value: SAM

Observed result:
Accessing the function URL yields a Forbidden error.
Expected result:
Accessing the function URL should be allowed.

Closing comment (2022-05-12T14:57:49Z): Closing this as a duplicate of #2386. Only reason to close this one for a newer one is that #2386 has some back and forth on it.
Closing.