Skip to content

Commit 83e1f03

Browse files
author
Sid Madipalli
committed
Adding condition for IAM role with if and else case
1 parent cf96ad9 commit 83e1f03

File tree

5 files changed

+284
-7
lines changed

5 files changed

+284
-7
lines changed

‎samtranslator/model/sam_resources.py‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -435,28 +435,27 @@ def _make_lambda_role(
435435

436436
is_both_intrinsic_no_values = is_intrinsic_no_value(role_list[1]) and is_intrinsic_no_value(role_list[2])
437437

438-
# When either one of the condition is a non no value we need to conditionally
439-
# create IAM role, This requires generating a condition that negates the condition check
440-
# passed for IAM role creation and use that for the new role being created
441-
if not is_both_intrinsic_no_values:
442-
execution_role.set_resource_attribute("Condition", f"NOT{role_list[0]}")
443-
conditions[f"NOT{role_list[0]}"] = make_not_conditional(role_list[0])
444-
445438
# both are none values, we need to create a role
446439
if is_both_intrinsic_no_values:
447440
lambda_function.Role = execution_role.get_runtime_attr("arn")
448441

449442
# first value is none so we should create condition ? create : [2]
443+
# create a condition for IAM role to only create on if case
450444
elif is_intrinsic_no_value(role_list[1]):
451445
lambda_function.Role = make_conditional(
452446
role_list[0], execution_role.get_runtime_attr("arn"), role_list[2]
453447
)
448+
execution_role.set_resource_attribute("Condition", f"{role_list[0]}")
454449

455450
# second value is none so we should create condition ? [1] : create
451+
# create a condition for IAM role to only create on else case
452+
# with top level condition that negates the condition passed
456453
elif is_intrinsic_no_value(role_list[2]):
457454
lambda_function.Role = make_conditional(
458455
role_list[0], role_list[1], execution_role.get_runtime_attr("arn")
459456
)
457+
execution_role.set_resource_attribute("Condition", f"NOT{role_list[0]}")
458+
conditions[f"NOT{role_list[0]}"] = make_not_conditional(role_list[0])
460459

461460
def _construct_event_invoke_config( # noqa: PLR0913
462461
self,

‎tests/translator/input/function_with_iam_role_create.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
Parameters:
2+
iamRoleArn:
3+
Type: String
4+
Description: The ARN of an IAM role to use as this function's execution role.
5+
If a role isn't specified, one is created for you with a logical ID of <function-logical-id>Role.
6+
7+
Conditions:
8+
CreateRole: !Not [!Equals ['', !Ref iamRoleArn]]
9+
10+
Resources:
11+
MinimalFunction:
12+
Type: AWS::Serverless::Function
13+
Properties:
14+
CodeUri: s3://sam-demo-bucket/hello.zip
15+
Handler: hello.handler
16+
Runtime: python3.10
17+
Role: !If
18+
- CreateRole
19+
- !Ref "AWS::NoValue"
20+
- !Ref "iamRoleArn"

‎tests/translator/output/aws-cn/function_with_iam_role_create.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"Conditions": {
3+
"CreateRole": {
4+
"Fn::Not": [
5+
{
6+
"Fn::Equals": [
7+
"",
8+
{
9+
"Ref": "iamRoleArn"
10+
}
11+
]
12+
}
13+
]
14+
}
15+
},
16+
"Parameters": {
17+
"iamRoleArn": {
18+
"Description": "The ARN of an IAM role to use as this function's execution role. If a role isn't specified, one is created for you with a logical ID of <function-logical-id>Role.",
19+
"Type": "String"
20+
}
21+
},
22+
"Resources": {
23+
"MinimalFunction": {
24+
"Properties": {
25+
"Code": {
26+
"S3Bucket": "sam-demo-bucket",
27+
"S3Key": "hello.zip"
28+
},
29+
"Handler": "hello.handler",
30+
"Role": {
31+
"Fn::If": [
32+
"CreateRole",
33+
{
34+
"Fn::GetAtt": [
35+
"MinimalFunctionRole",
36+
"Arn"
37+
]
38+
},
39+
{
40+
"Ref": "iamRoleArn"
41+
}
42+
]
43+
},
44+
"Runtime": "python3.10",
45+
"Tags": [
46+
{
47+
"Key": "lambda:createdBy",
48+
"Value": "SAM"
49+
}
50+
]
51+
},
52+
"Type": "AWS::Lambda::Function"
53+
},
54+
"MinimalFunctionRole": {
55+
"Condition": "CreateRole",
56+
"Properties": {
57+
"AssumeRolePolicyDocument": {
58+
"Statement": [
59+
{
60+
"Action": [
61+
"sts:AssumeRole"
62+
],
63+
"Effect": "Allow",
64+
"Principal": {
65+
"Service": [
66+
"lambda.amazonaws.com"
67+
]
68+
}
69+
}
70+
],
71+
"Version": "2012-10-17"
72+
},
73+
"ManagedPolicyArns": [
74+
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
75+
],
76+
"Tags": [
77+
{
78+
"Key": "lambda:createdBy",
79+
"Value": "SAM"
80+
}
81+
]
82+
},
83+
"Type": "AWS::IAM::Role"
84+
}
85+
}
86+
}

‎tests/translator/output/aws-us-gov/function_with_iam_role_create.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"Conditions": {
3+
"CreateRole": {
4+
"Fn::Not": [
5+
{
6+
"Fn::Equals": [
7+
"",
8+
{
9+
"Ref": "iamRoleArn"
10+
}
11+
]
12+
}
13+
]
14+
}
15+
},
16+
"Parameters": {
17+
"iamRoleArn": {
18+
"Description": "The ARN of an IAM role to use as this function's execution role. If a role isn't specified, one is created for you with a logical ID of <function-logical-id>Role.",
19+
"Type": "String"
20+
}
21+
},
22+
"Resources": {
23+
"MinimalFunction": {
24+
"Properties": {
25+
"Code": {
26+
"S3Bucket": "sam-demo-bucket",
27+
"S3Key": "hello.zip"
28+
},
29+
"Handler": "hello.handler",
30+
"Role": {
31+
"Fn::If": [
32+
"CreateRole",
33+
{
34+
"Fn::GetAtt": [
35+
"MinimalFunctionRole",
36+
"Arn"
37+
]
38+
},
39+
{
40+
"Ref": "iamRoleArn"
41+
}
42+
]
43+
},
44+
"Runtime": "python3.10",
45+
"Tags": [
46+
{
47+
"Key": "lambda:createdBy",
48+
"Value": "SAM"
49+
}
50+
]
51+
},
52+
"Type": "AWS::Lambda::Function"
53+
},
54+
"MinimalFunctionRole": {
55+
"Condition": "CreateRole",
56+
"Properties": {
57+
"AssumeRolePolicyDocument": {
58+
"Statement": [
59+
{
60+
"Action": [
61+
"sts:AssumeRole"
62+
],
63+
"Effect": "Allow",
64+
"Principal": {
65+
"Service": [
66+
"lambda.amazonaws.com"
67+
]
68+
}
69+
}
70+
],
71+
"Version": "2012-10-17"
72+
},
73+
"ManagedPolicyArns": [
74+
"arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
75+
],
76+
"Tags": [
77+
{
78+
"Key": "lambda:createdBy",
79+
"Value": "SAM"
80+
}
81+
]
82+
},
83+
"Type": "AWS::IAM::Role"
84+
}
85+
}
86+
}

‎tests/translator/output/function_with_iam_role_create.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
{
2+
"Conditions": {
3+
"CreateRole": {
4+
"Fn::Not": [
5+
{
6+
"Fn::Equals": [
7+
"",
8+
{
9+
"Ref": "iamRoleArn"
10+
}
11+
]
12+
}
13+
]
14+
}
15+
},
16+
"Parameters": {
17+
"iamRoleArn": {
18+
"Description": "The ARN of an IAM role to use as this function's execution role. If a role isn't specified, one is created for you with a logical ID of <function-logical-id>Role.",
19+
"Type": "String"
20+
}
21+
},
22+
"Resources": {
23+
"MinimalFunction": {
24+
"Properties": {
25+
"Code": {
26+
"S3Bucket": "sam-demo-bucket",
27+
"S3Key": "hello.zip"
28+
},
29+
"Handler": "hello.handler",
30+
"Role": {
31+
"Fn::If": [
32+
"CreateRole",
33+
{
34+
"Fn::GetAtt": [
35+
"MinimalFunctionRole",
36+
"Arn"
37+
]
38+
},
39+
{
40+
"Ref": "iamRoleArn"
41+
}
42+
]
43+
},
44+
"Runtime": "python3.10",
45+
"Tags": [
46+
{
47+
"Key": "lambda:createdBy",
48+
"Value": "SAM"
49+
}
50+
]
51+
},
52+
"Type": "AWS::Lambda::Function"
53+
},
54+
"MinimalFunctionRole": {
55+
"Condition": "CreateRole",
56+
"Properties": {
57+
"AssumeRolePolicyDocument": {
58+
"Statement": [
59+
{
60+
"Action": [
61+
"sts:AssumeRole"
62+
],
63+
"Effect": "Allow",
64+
"Principal": {
65+
"Service": [
66+
"lambda.amazonaws.com"
67+
]
68+
}
69+
}
70+
],
71+
"Version": "2012-10-17"
72+
},
73+
"ManagedPolicyArns": [
74+
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
75+
],
76+
"Tags": [
77+
{
78+
"Key": "lambda:createdBy",
79+
"Value": "SAM"
80+
}
81+
]
82+
},
83+
"Type": "AWS::IAM::Role"
84+
}
85+
}
86+
}

0 commit comments

Comments
 (0)