feat(lambda): lambda code assets are marked as deploy time assets (#25705)

Mark lambda assets as deploy time assets. This has no functionality for default synthesis, but if used in conjunction with the `AppStagingSynthesizer`, lambda assets will be marked with the `deploy-time/` prefix in the staging bucket and subject to lifecycle policies. This is because for lambda code, the s3 staging bucket is an intermediate step and the code is copied to lambda immediately. The code in s3 is no longer referenced after deploy, except when in a rollback scenario.

Since this is a no-op for normal synthesis, the only test that can be done is in `app-staging-synthesizer-alpha`.

Also I've deleted a duplicate test I found in `app-staging-synthesizer-alpha`.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: kaizencc

packages/@aws-cdk/app-staging-synthesizer-alpha/test/app-staging-synthesizer.test.ts

@@ -1,6 +1,8 @@
 import * as fs from 'fs';
+import * as path from 'path';
 import { App, Stack, CfnResource, FileAssetPackaging, Token, Lazy, Duration } from 'aws-cdk-lib';
 import { Match, Template } from 'aws-cdk-lib/assertions';
+import * as lambda from 'aws-cdk-lib/aws-lambda';
 import * as cxschema from 'aws-cdk-lib/cloud-assembly-schema';
 import { CloudAssembly } from 'aws-cdk-lib/cx-api';
 import { evaluateCFN } from './evaluate-cfn';
@@ -178,32 +180,43 @@ describe(AppStagingSynthesizer, () => {
         deployTime: true,
       });
 
-      // THEN - asset has bucket prefix
+      // THEN - asset has deploy time prefix
       expect(evalCFN(location.objectKey)).toEqual(`${DEPLOY_TIME_PREFIX}abcdef.js`);
     });
 
-    test('do not get specified bucketPrefix', () => {
-      // GIVEN
-      app = new App({
-        defaultStackSynthesizer: AppStagingSynthesizer.defaultResources({ appId: APP_ID }),
-      });
-      stack = new Stack(app, 'Stack', {
-        env: {
-          account: '000000000000',
-          region: 'us-west-2',
-        },
-      });
-
+    test('lambda assets are by default deploy time assets', () => {
       // WHEN
-      const location = stack.synthesizer.addFileAsset({
-        fileName: __filename,
-        packaging: FileAssetPackaging.FILE,
-        sourceHash: 'abcdef',
-        deployTime: true,
+      new lambda.Function(stack, 'Lambda', {
+        handler: 'index.handler',
+        code: lambda.Code.fromAsset(path.join(__dirname, 'assets')),
+        runtime: lambda.Runtime.PYTHON_3_10,
       });
 
-      // THEN - asset has bucket prefix
-      expect(evalCFN(location.objectKey)).toEqual(`${DEPLOY_TIME_PREFIX}abcdef.js`);
+      // THEN - lambda asset has deploy time prefix
+      const asm = app.synth();
+
+      const manifestArtifact = asm.artifacts.filter(isAssetManifest)[0];
+      expect(manifestArtifact).toBeDefined();
+      const manifest: cxschema.AssetManifest = JSON.parse(fs.readFileSync(manifestArtifact.file, { encoding: 'utf-8' }));
+
+      expect(manifest.files).toBeDefined();
+      expect(Object.keys(manifest.files!).length).toEqual(2);
+      const firstFile = manifest.files![Object.keys(manifest.files!)[0]];
+      const assetHash = '68539effc3f7ad46fff9765606c2a01b7f7965833643ab37e62799f19a37f650';
+      expect(firstFile).toEqual({
+        source: {
+          packaging: 'zip',
+          path: `asset.${assetHash}`,
+        },
+        destinations: {
+          '000000000000-us-east-1': {
+            bucketName: `cdk-${APP_ID}-staging-000000000000-us-east-1`,
+            objectKey: `${DEPLOY_TIME_PREFIX}${assetHash}.zip`,
+            region: 'us-east-1',
+            assumeRoleArn: `arn:\${AWS::Partition}:iam::000000000000:role/cdk-${APP_ID}-file-role-us-east-1`,
+          },
+        },
+      });
     });
 
     test('have s3 bucket has lifecycle rule by default', () => {

packages/@aws-cdk/app-staging-synthesizer-alpha/test/integ.synth-default-resources.js.snapshot/manifest.json

@@ -20,7 +20,7 @@
         "additionalDependencies": [
           "synthesize-default-resources.assets"
         ],
-        "stackTemplateAssetObjectUrl": "s3://cdk-default-resources-staging-${AWS::AccountId}-${AWS::Region}/deploy-time/e21d11bec65be920861a56a86066cc88a0241d5cbe8324d0692ca982420e4cb0.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-default-resources-staging-${AWS::AccountId}-${AWS::Region}/deploy-time/dc7275f639c45accfa2abc4842978bcb3b0c5f0b83fcde22015e344b2e008f26.json",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
         "lookupRole": {
           "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}"

packages/@aws-cdk/app-staging-synthesizer-alpha/test/integ.synth-default-resources.js.snapshot/synthesize-default-resources.assets.json

@@ -9,20 +9,20 @@
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-default-resources-staging-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "68539effc3f7ad46fff9765606c2a01b7f7965833643ab37e62799f19a37f650.zip",
+          "objectKey": "deploy-time/68539effc3f7ad46fff9765606c2a01b7f7965833643ab37e62799f19a37f650.zip",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-default-resources-file-role-${AWS::Region}"
         }
       }
     },
-    "e21d11bec65be920861a56a86066cc88a0241d5cbe8324d0692ca982420e4cb0": {
+    "dc7275f639c45accfa2abc4842978bcb3b0c5f0b83fcde22015e344b2e008f26": {
       "source": {
         "path": "synthesize-default-resources.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-default-resources-staging-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "deploy-time/e21d11bec65be920861a56a86066cc88a0241d5cbe8324d0692ca982420e4cb0.json",
+          "objectKey": "deploy-time/dc7275f639c45accfa2abc4842978bcb3b0c5f0b83fcde22015e344b2e008f26.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-default-resources-file-role-${AWS::Region}"
         }
       }

packages/@aws-cdk/app-staging-synthesizer-alpha/test/integ.synth-default-resources.js.snapshot/synthesize-default-resources.template.json

@@ -38,7 +38,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-default-resources-staging-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "68539effc3f7ad46fff9765606c2a01b7f7965833643ab37e62799f19a37f650.zip"
+     "S3Key": "deploy-time/68539effc3f7ad46fff9765606c2a01b7f7965833643ab37e62799f19a37f650.zip"
     },
     "Role": {
      "Fn::GetAtt": [

packages/@aws-cdk/app-staging-synthesizer-alpha/test/integ.synth-default-resources.js.snapshot/tree.json

@@ -105,7 +105,7 @@
                       "s3Bucket": {
                         "Fn::Sub": "cdk-default-resources-staging-${AWS::AccountId}-${AWS::Region}"
                       },
-                      "s3Key": "68539effc3f7ad46fff9765606c2a01b7f7965833643ab37e62799f19a37f650.zip"
+                      "s3Key": "deploy-time/68539effc3f7ad46fff9765606c2a01b7f7965833643ab37e62799f19a37f650.zip"
                     },
                     "role": {
                       "Fn::GetAtt": [
@@ -1150,7 +1150,7 @@
           }
         },
         "constructInfo": {
-          "fqn": "@aws-cdk/app-staging-synthesizer-alpha.DefaultStagingStack",
+          "fqn": "aws-cdk-lib.Stack",
           "version": "0.0.0"
         }
       },

packages/aws-cdk-lib/aws-lambda/lib/code.ts

@@ -277,6 +277,7 @@ export class AssetCode extends Code {
     if (!this.asset) {
       this.asset = new s3_assets.Asset(scope, 'Code', {
         path: this.path,
+        deployTime: true,
         ...this.options,
       });
     } else if (cdk.Stack.of(this.asset) !== cdk.Stack.of(scope)) {