(aws-lambda): Allow referencing lambda container image by digest

At the moment it appears DockerImageCode.fromEcr type can only accept a tag as a reference to a container version. I think it would be helpful to also be able to reference a digest instead of a tag.

Use Case

Deploying a Lambda on a moving tag requires intervention outside the CDK to force the lambda to update its digest. In my workflow, I deploy a new container to latest, and get a digest from that update. I would like to just specify that digest in my lambda container to then force it to update to the latest version.

Proposed Solution

Taking into consideration how this issue was resolved: https://github.com/aws/aws-cdk/issues/5082 . Maybe we should have the ability to create a DockerImageCode instance from the full Repository URI, so we can say repository.repositoryUriForDigest in addition to repository.repositoryUriForTag.

Another option is to add a digest property in the options for DockerImageCode.fromEcr, however then that opens an invalid state, where you can specify both a tag and digest.

One other thought, in line with this comment: https://github.com/aws/aws-cdk/issues/5082#issuecomment-555376891, is to overload the tag property for digest, and check if it starts with sha256:.

Other

Resource handler returned message: "Source image 393233896464.dkr.ecr.us-east-2.amazonaws.com/my-image:@sha256:783e6c546ca12437893a8651759f93a642a55d368a238f04bf625859c3bdb25a is not valid. Provide a valid source image. (Service: Lambda, Status
Code: 400, Request ID: 2982d3fc-3741-4a5c-ae6b-e3d7f3b6b076, Extended Request ID: null)" (RequestToken: 3c72609b-e1fa-e34c-f15e-02134f8405d4, HandlerErrorCode: InvalidRequest)

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[nija-at]

Thanks for filing this issue.

The EcrImageCode will need to be updated to use repositoryUriForDigest() here - https://github.com/aws/aws-cdk/blob/929d6aef84eb21aea0d9a4fff953a0f39246288e/packages/%40aws-cdk/aws-lambda/lib/code.ts#L460

and EcrImageCodeProps will need to be updated to accept a digest. property.

Marking as a feature request.

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.