Skip to content

Commit be4f971

Browse files
watany-devwatany-dev
authored
feat(lambda): enable RuntimeManagementConfig (#23891)
Introducing AWS Lambda runtime management controls https://aws.amazon.com/jp/blogs/compute/introducing-aws-lambda-runtime-management-controls/ This setting achieves the following set values. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html#cfn-lambda-functionruntimemanagementconfig I have not been able to test this CFn as it does not seem to be supported by cdk. It's only a design. Closes #23890. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent bdcd6c8 commit be4f971

16 files changed

+656
-3
lines changed

‎packages/@aws-cdk/aws-lambda/README.md

+25
Original file line numberDiff line numberDiff line change
@@ -1042,3 +1042,28 @@ new lambda.Function(this, 'Function', {
10421042
code: lambda.Code.fromAsset(path.join(__dirname, 'lambda-handler')),
10431043
});
10441044
```
1045+
1046+
## Runtime updates
1047+
1048+
Lambda runtime management controls help reduce the risk of impact to your workloads in the rare event of a runtime version incompatibility.
1049+
For more information, see [Runtime management controls](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-controls)
1050+
1051+
```ts
1052+
new Function(stack, 'Lambda', {
1053+
runtimeManagementMode: RuntimeManagementMode.AUTO,
1054+
runtime: lambda.Runtime.NODEJS_18_X,
1055+
handler: 'index.handler',
1056+
code: lambda.Code.fromAsset(path.join(__dirname, 'lambda-handler')),
1057+
});
1058+
```
1059+
1060+
If you want to set the "Manual" setting, using the ARN of the runtime version as the argument.
1061+
1062+
```ts
1063+
new Function(stack, 'Lambda', {
1064+
runtimeManagementMode: RuntimeManagementMode.manual('runtimeVersion-arn'),
1065+
runtime: lambda.Runtime.NODEJS_18_X,
1066+
handler: 'index.handler',
1067+
code: lambda.Code.fromAsset(path.join(__dirname, 'lambda-handler')),
1068+
});
1069+
```

‎packages/@aws-cdk/aws-lambda/lib/adot-layers.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
import { RegionInfo } from '@aws-cdk/region-info';
22
import { IConstruct } from 'constructs';
3+
import { Architecture } from './architecture';
4+
import { IFunction } from './function-base';
35
import { Stack } from '../../core/lib/stack';
46
import { Token } from '../../core/lib/token';
57
import { FactName } from '../../region-info/lib/fact';
6-
import { Architecture } from './architecture';
7-
import { IFunction } from './function-base';
88

99
/**
1010
* The type of ADOT Lambda layer

‎packages/@aws-cdk/aws-lambda/lib/function.ts

+8
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import { CfnFunction } from './lambda.generated';
2626
import { LayerVersion, ILayerVersion } from './layers';
2727
import { LogRetentionRetryOptions } from './log-retention';
2828
import { Runtime } from './runtime';
29+
import { RuntimeManagementMode } from './runtime-management';
2930
import { addAlias } from './util';
3031

3132
/**
@@ -359,6 +360,12 @@ export interface FunctionOptions extends EventInvokeConfigOptions {
359360
* @default Architecture.X86_64
360361
*/
361362
readonly architecture?: Architecture;
363+
364+
/**
365+
* Sets the runtime management configuration for a function's version.
366+
* @default Auto
367+
*/
368+
readonly runtimeManagementMode?: RuntimeManagementMode;
362369
}
363370

364371
export interface FunctionProps extends FunctionOptions {
@@ -814,6 +821,7 @@ export class Function extends FunctionBase {
814821
fileSystemConfigs,
815822
codeSigningConfigArn: props.codeSigningConfig?.codeSigningConfigArn,
816823
architectures: this._architecture ? [this._architecture.name] : undefined,
824+
runtimeManagementConfig: props.runtimeManagementMode?.runtimeManagementConfig,
817825
});
818826

819827
if ((props.tracing !== undefined) || (props.adotInstrumentation !== undefined)) {

‎packages/@aws-cdk/aws-lambda/lib/index.ts

+1
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ export * from './lambda-insights';
2323
export * from './log-retention';
2424
export * from './architecture';
2525
export * from './function-url';
26+
export * from './runtime-management';
2627

2728
// AWS::Lambda CloudFormation Resources:
2829
export * from './lambda.generated';

‎packages/@aws-cdk/aws-lambda/lib/runtime-management.ts

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
import { CfnFunction } from './lambda.generated';
2+
3+
/**
4+
* Specify the runtime update mode.
5+
*/
6+
export class RuntimeManagementMode {
7+
/**
8+
* Automatically update to the most recent and secure runtime version using Two-phase runtime version rollout.
9+
* We recommend this mode for most customers so that you always benefit from runtime updates.
10+
*/
11+
public static readonly AUTO = new RuntimeManagementMode('Auto');
12+
/**
13+
* When you update your function, Lambda updates the runtime of your function to the most recent and secure runtime version.
14+
* This approach synchronizes runtime updates with function deployments,
15+
* giving you control over when Lambda applies runtime updates.
16+
* With this mode, you can detect and mitigate rare runtime update incompatibilities early.
17+
* When using this mode, you must regularly update your functions to keep their runtime up to date.
18+
*/
19+
public static readonly FUNCTION_UPDATE = new RuntimeManagementMode('Function update');
20+
/**
21+
* You specify a runtime version in your function configuration.
22+
* The function uses this runtime version indefinitely.
23+
* In the rare case in which a new runtime version is incompatible with an existing function,
24+
* you can use this mode to roll back your function to an earlier runtime version.
25+
*/
26+
public static manual(arn: string): RuntimeManagementMode {
27+
return new RuntimeManagementMode('Manual', arn);
28+
}
29+
30+
/**
31+
* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-lambda-function-runtimemanagementconfig.html
32+
*/
33+
readonly runtimeManagementConfig: CfnFunction.RuntimeManagementConfigProperty;
34+
35+
protected constructor(public readonly mode: string, public readonly arn?: string) {
36+
if (arn) {
37+
this.runtimeManagementConfig = {
38+
runtimeVersionArn: arn,
39+
updateRuntimeOn: mode,
40+
};
41+
} else {
42+
this.runtimeManagementConfig = {
43+
updateRuntimeOn: mode,
44+
};
45+
}
46+
}
47+
}

‎packages/@aws-cdk/aws-lambda/package.json

+3-1
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,9 @@
190190
"props-physical-name:@aws-cdk/aws-lambda.EventInvokeConfigProps",
191191
"props-physical-name:@aws-cdk/aws-lambda.CodeSigningConfigProps",
192192
"props-physical-name:@aws-cdk/aws-lambda.FunctionUrlProps",
193-
"from-method:@aws-cdk/aws-lambda.FunctionUrl"
193+
"from-method:@aws-cdk/aws-lambda.FunctionUrl",
194+
"docs-public-apis:@aws-cdk/aws-lambda.RuntimeManagementMode.mode",
195+
"docs-public-apis:@aws-cdk/aws-lambda.RuntimeManagementMode.arn"
194196
]
195197
},
196198
"stability": "stable",

‎packages/@aws-cdk/aws-lambda/test/integ.runtime-management.js.snapshot/aws-cdk-lambda-runtime-management.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "29.0.0",
3+
"files": {
4+
"45968e77d38b164ece946e2a09ba83ed011953b9ee4b075f276fd124c61df607": {
5+
"source": {
6+
"path": "aws-cdk-lambda-runtime-management.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "45968e77d38b164ece946e2a09ba83ed011953b9ee4b075f276fd124c61df607.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-lambda/test/integ.runtime-management.js.snapshot/aws-cdk-lambda-runtime-management.template.json

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
{
2+
"Resources": {
3+
"LambdaServiceRoleA8ED4D3B": {
4+
"Type": "AWS::IAM::Role",
5+
"Properties": {
6+
"AssumeRolePolicyDocument": {
7+
"Statement": [
8+
{
9+
"Action": "sts:AssumeRole",
10+
"Effect": "Allow",
11+
"Principal": {
12+
"Service": "lambda.amazonaws.com"
13+
}
14+
}
15+
],
16+
"Version": "2012-10-17"
17+
},
18+
"ManagedPolicyArns": [
19+
{
20+
"Fn::Join": [
21+
"",
22+
[
23+
"arn:",
24+
{
25+
"Ref": "AWS::Partition"
26+
},
27+
":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
28+
]
29+
]
30+
}
31+
]
32+
}
33+
},
34+
"LambdaD247545B": {
35+
"Type": "AWS::Lambda::Function",
36+
"Properties": {
37+
"Code": {
38+
"ZipFile": "foo"
39+
},
40+
"Role": {
41+
"Fn::GetAtt": [
42+
"LambdaServiceRoleA8ED4D3B",
43+
"Arn"
44+
]
45+
},
46+
"Handler": "index.handler",
47+
"Runtime": "nodejs18.x",
48+
"RuntimeManagementConfig": {
49+
"UpdateRuntimeOn": "Auto"
50+
}
51+
},
52+
"DependsOn": [
53+
"LambdaServiceRoleA8ED4D3B"
54+
]
55+
}
56+
},
57+
"Parameters": {
58+
"BootstrapVersion": {
59+
"Type": "AWS::SSM::Parameter::Value<String>",
60+
"Default": "/cdk-bootstrap/hnb659fds/version",
61+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
62+
}
63+
},
64+
"Rules": {
65+
"CheckBootstrapVersion": {
66+
"Assertions": [
67+
{
68+
"Assert": {
69+
"Fn::Not": [
70+
{
71+
"Fn::Contains": [
72+
[
73+
"1",
74+
"2",
75+
"3",
76+
"4",
77+
"5"
78+
],
79+
{
80+
"Ref": "BootstrapVersion"
81+
}
82+
]
83+
}
84+
]
85+
},
86+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
87+
}
88+
]
89+
}
90+
}
91+
}

‎packages/@aws-cdk/aws-lambda/test/integ.runtime-management.js.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"29.0.0"}

‎packages/@aws-cdk/aws-lambda/test/integ.runtime-management.js.snapshot/integ.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "29.0.0",
3+
"testCases": {
4+
"lambda-runtime-management/DefaultTest": {
5+
"stacks": [
6+
"aws-cdk-lambda-runtime-management"
7+
],
8+
"assertionStack": "lambda-runtime-management/DefaultTest/DeployAssert",
9+
"assertionStackName": "lambdaruntimemanagementDefaultTestDeployAssertDE680AF3"
10+
}
11+
}
12+
}

‎packages/@aws-cdk/aws-lambda/test/integ.runtime-management.js.snapshot/lambdaruntimemanagementDefaultTestDeployAssertDE680AF3.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "29.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "lambdaruntimemanagementDefaultTestDeployAssertDE680AF3.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-lambda/test/integ.runtime-management.js.snapshot/lambdaruntimemanagementDefaultTestDeployAssertDE680AF3.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

0 commit comments

Comments
 (0)