lambda policy size exceeds limit when used with multiple RestApi methods

short description:

Override Lambda Permission manually when creating a new API Gateway method.

Use Case

Recently I faced this issue when pointing multiple API Gateways methods to specific lambda :

The final policy size (XXX) is bigger than the limit (20480)

The feature allows users to bypass automatic permission creation (sort of “manual mode”) to avoid this limitation.

I noticed that when using LambdaIntegration class the bind function adds permissions automatically to the lambda function based on the method URL.

My workaround was overriding the bind function with my own class ( see this post - https://stackoverflow.com/questions/59713522/cdk-override-bind-when-using-lambdaintegration?noredirect=1#comment105588249_59713522) and implement my own logic.

This feature can give more flexibility to the end-user and could give more control about the lambda permissions.

This is a 🚀 Feature Request

[rehanvdm]

@nija-at “it wouldn’t be the right customer experience for a CDK user.” Why do you think this? Also it is the resource based policy which has limit of 2,048.

The problem is that LambdaIntegration calls the lambda function addPermission everytime for a new Method. The policy gets filled up quite quickly and then the stack fails stating that the policy size is too big. The solution is to create a variation of the LambdaIntegration class that does the binding but does not add a individual method policy for each API method but rather just give the whole API (any resource + method) access to the Lambda.

import lambda = require('@aws-cdk/aws-lambda');
import apigateway = require('@aws-cdk/aws-apigateway');

class LambdaIntegrationNoPermission extends apigateway.LambdaIntegration
{
    constructor(handler: lambda.IFunction, options?: apigateway.LambdaIntegrationOptions) {
        super(handler, options);
    }

    bind(method: apigateway.Method)
    {
        this['scope'] = method;
    }
}

const api = new apigateway.RestApi(this, id+"-api", {
            restApiName: id,
            deployOptions: { stageName: buildPros.Environment },
            defaultCorsPreflightOptions: {
                allowOrigins: apigateway.Cors.ALL_ORIGINS,
                allowMethods: apigateway.Cors.ALL_METHODS,
                allowHeaders: ["*"]
            },
            defaultIntegration: new LambdaIntegrationNoPermission(apiLambda, {proxy: true}),
        });

.... Add many methods and resources here ....

/* Manually add the permission, specifying with the API function arnForExecuteApi empty params means for all methods, paths and stages    */
apiLambda.addPermission(id + "ApiGWPermissions", {
           action: 'lambda:InvokeFunction',
           principal: new iam.ServicePrincipal('apigateway.amazonaws.com'),
           sourceArn: api.arnForExecuteApi()
       });

[rehanvdm]

@nija-at “it wouldn’t be the right customer experience for a CDK user.” Why do you think this? Also it is the resource based policy which has limit of 2,048.

The problem is that LambdaIntegration calls the lambda function addPermission everytime for a new Method. The policy gets filled up quite quickly and then the stack fails stating that the policy size is too big. The solution is to create a variation of the LambdaIntegration class that does the binding but does not add a individual method policy for each API method but rather just give the whole API (any resource + method) access to the Lambda.

import lambda = require('@aws-cdk/aws-lambda');
import apigateway = require('@aws-cdk/aws-apigateway');

class LambdaIntegrationNoPermission extends apigateway.LambdaIntegration
{
    constructor(handler: lambda.IFunction, options?: apigateway.LambdaIntegrationOptions) {
        super(handler, options);
    }

    bind(method: apigateway.Method)
    {
        this['scope'] = method;
    }
}

const api = new apigateway.RestApi(this, id+"-api", {
            restApiName: id,
            deployOptions: { stageName: buildPros.Environment },
            defaultCorsPreflightOptions: {
                allowOrigins: apigateway.Cors.ALL_ORIGINS,
                allowMethods: apigateway.Cors.ALL_METHODS,
                allowHeaders: ["*"]
            },
            defaultIntegration: new LambdaIntegrationNoPermission(apiLambda, {proxy: true}),
        });

.... Add many methods and resources here ....

/* Manually add the permission, specifying with the API function arnForExecuteApi empty params means for all methods, paths and stages    */
apiLambda.addPermission(id + "ApiGWPermissions", {
           action: 'lambda:InvokeFunction',
           principal: new iam.ServicePrincipal('apigateway.amazonaws.com'),
           sourceArn: api.arnForExecuteApi()
       });

Does not work anymore since the Method signature changed, refer to the newly opened ticket addressing this and the new solution here: https://github.com/aws/aws-cdk/issues/9327#issuecomment-858372987