Skip to content

Commit 6fff363

Browse files
author
awstools
committed
feat(client-lambda): Release FilterCriteria encryption for Lambda EventSourceMapping, enabling customers to encrypt their filter criteria using a customer-owned KMS key.
1 parent 1baa7ea commit 6fff363

13 files changed

+184
-21
lines changed

‎clients/client-lambda/src/commands/AddPermissionCommand.ts

+3-3
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,15 @@ export interface AddPermissionCommandInput extends AddPermissionRequest {}
2828
export interface AddPermissionCommandOutput extends AddPermissionResponse, __MetadataBearer {}
2929

3030
/**
31-
* <p>Grants an Amazon Web Service, Amazon Web Services account, or Amazon Web Services organization
31+
* <p>Grants an Amazon Web Servicesservice, Amazon Web Services account, or Amazon Web Services organization
3232
* permission to use a function. You can apply the policy at the function level, or specify a qualifier to restrict
3333
* access to a single version or alias. If you use a qualifier, the invoker must use the full Amazon Resource Name
3434
* (ARN) of that version or alias to invoke the function. Note: Lambda does not support adding policies
3535
* to version $LATEST.</p>
3636
* <p>To grant permission to another account, specify the account ID as the <code>Principal</code>. To grant
3737
* permission to an organization defined in Organizations, specify the organization ID as the
38-
* <code>PrincipalOrgID</code>. For Amazon Web Services, the principal is a domain-style identifier that
39-
* the service defines, such as <code>s3.amazonaws.com</code> or <code>sns.amazonaws.com</code>. For Amazon Web Services, you can also specify the ARN of the associated resource as the <code>SourceArn</code>. If
38+
* <code>PrincipalOrgID</code>. For Amazon Web Servicesservices, the principal is a domain-style identifier that
39+
* the service defines, such as <code>s3.amazonaws.com</code> or <code>sns.amazonaws.com</code>. For Amazon Web Servicesservices, you can also specify the ARN of the associated resource as the <code>SourceArn</code>. If
4040
* you grant permission to a service principal without specifying the source, other accounts could potentially
4141
* configure resources in their account to invoke your Lambda function.</p>
4242
* <p>This operation adds a statement to a resource-based permissions policy for the function. For more information

‎clients/client-lambda/src/commands/CreateEventSourceMappingCommand.ts

+6
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,7 @@ export interface CreateEventSourceMappingCommandOutput extends EventSourceMappin
212212
* CollectionName: "STRING_VALUE",
213213
* FullDocument: "UpdateLookup" || "Default",
214214
* },
215+
* KMSKeyArn: "STRING_VALUE",
215216
* };
216217
* const command = new CreateEventSourceMappingCommand(input);
217218
* const response = await client.send(command);
@@ -283,6 +284,11 @@ export interface CreateEventSourceMappingCommandOutput extends EventSourceMappin
283284
* // CollectionName: "STRING_VALUE",
284285
* // FullDocument: "UpdateLookup" || "Default",
285286
* // },
287+
* // KMSKeyArn: "STRING_VALUE",
288+
* // FilterCriteriaError: { // FilterCriteriaError
289+
* // ErrorCode: "STRING_VALUE",
290+
* // Message: "STRING_VALUE",
291+
* // },
286292
* // };
287293
*
288294
* ```

‎clients/client-lambda/src/commands/CreateFunctionCommand.ts

+3-3
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ export interface CreateFunctionCommandOutput extends FunctionConfiguration, __Me
3535
/**
3636
* <p>Creates a Lambda function. To create a function, you need a <a href="https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-package.html">deployment package</a> and an <a href="https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html#lambda-intro-execution-role">execution role</a>. The
3737
* deployment package is a .zip file archive or container image that contains your function code. The execution role
38-
* grants the function permission to use Amazon Web Services, such as Amazon CloudWatch Logs for log
38+
* grants the function permission to use Amazon Web Servicesservices, such as Amazon CloudWatch Logs for log
3939
* streaming and X-Ray for request tracing.</p>
4040
* <p>If the deployment package is a <a href="https://docs.aws.amazon.com/lambda/latest/dg/lambda-images.html">container
4141
* image</a>, then you set the package type to <code>Image</code>. For a container image, the code property
@@ -66,9 +66,9 @@ export interface CreateFunctionCommandOutput extends FunctionConfiguration, __Me
6666
* <a>UpdateFunctionCode</a>, Lambda checks that the code package has a valid signature from
6767
* a trusted publisher. The code-signing configuration includes set of signing profiles, which define the trusted
6868
* publishers for this function.</p>
69-
* <p>If another Amazon Web Services account or an Amazon Web Service invokes your function, use <a>AddPermission</a> to grant permission by creating a resource-based Identity and Access Management (IAM) policy. You can grant permissions at the function level, on a version, or on an alias.</p>
69+
* <p>If another Amazon Web Services account or an Amazon Web Servicesservice invokes your function, use <a>AddPermission</a> to grant permission by creating a resource-based Identity and Access Management (IAM) policy. You can grant permissions at the function level, on a version, or on an alias.</p>
7070
* <p>To invoke your function directly, use <a>Invoke</a>. To invoke your function in response to events
71-
* in other Amazon Web Services, create an event source mapping (<a>CreateEventSourceMapping</a>),
71+
* in other Amazon Web Servicesservices, create an event source mapping (<a>CreateEventSourceMapping</a>),
7272
* or configure a function trigger in the other service. For more information, see <a href="https://docs.aws.amazon.com/lambda/latest/dg/lambda-invocation.html">Invoking Lambda
7373
* functions</a>.</p>
7474
* @example

‎clients/client-lambda/src/commands/DeleteEventSourceMappingCommand.ts

+5
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,11 @@ export interface DeleteEventSourceMappingCommandOutput extends EventSourceMappin
111111
* // CollectionName: "STRING_VALUE",
112112
* // FullDocument: "UpdateLookup" || "Default",
113113
* // },
114+
* // KMSKeyArn: "STRING_VALUE",
115+
* // FilterCriteriaError: { // FilterCriteriaError
116+
* // ErrorCode: "STRING_VALUE",
117+
* // Message: "STRING_VALUE",
118+
* // },
114119
* // };
115120
*
116121
* ```

‎clients/client-lambda/src/commands/DeleteFunctionCommand.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ export interface DeleteFunctionCommandOutput extends __MetadataBearer {}
3131
* <p>Deletes a Lambda function. To delete a specific function version, use the <code>Qualifier</code> parameter.
3232
* Otherwise, all versions and aliases are deleted. This doesn't require the user to have explicit
3333
* permissions for <a>DeleteAlias</a>.</p>
34-
* <p>To delete Lambda event source mappings that invoke a function, use <a>DeleteEventSourceMapping</a>. For Amazon Web Services and resources that invoke your function
34+
* <p>To delete Lambda event source mappings that invoke a function, use <a>DeleteEventSourceMapping</a>. For Amazon Web Servicesservices and resources that invoke your function
3535
* directly, delete the trigger in the service where you originally configured it.</p>
3636
* @example
3737
* Use a bare-bones client and the command you need to make an API call.

‎clients/client-lambda/src/commands/GetEventSourceMappingCommand.ts

+5
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,11 @@ export interface GetEventSourceMappingCommandOutput extends EventSourceMappingCo
109109
* // CollectionName: "STRING_VALUE",
110110
* // FullDocument: "UpdateLookup" || "Default",
111111
* // },
112+
* // KMSKeyArn: "STRING_VALUE",
113+
* // FilterCriteriaError: { // FilterCriteriaError
114+
* // ErrorCode: "STRING_VALUE",
115+
* // Message: "STRING_VALUE",
116+
* // },
112117
* // };
113118
*
114119
* ```

‎clients/client-lambda/src/commands/ListEventSourceMappingsCommand.ts

+5
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,11 @@ export interface ListEventSourceMappingsCommandOutput extends ListEventSourceMap
115115
* // CollectionName: "STRING_VALUE",
116116
* // FullDocument: "UpdateLookup" || "Default",
117117
* // },
118+
* // KMSKeyArn: "STRING_VALUE",
119+
* // FilterCriteriaError: { // FilterCriteriaError
120+
* // ErrorCode: "STRING_VALUE",
121+
* // Message: "STRING_VALUE",
122+
* // },
118123
* // },
119124
* // ],
120125
* // };

‎clients/client-lambda/src/commands/RemovePermissionCommand.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ export interface RemovePermissionCommandInput extends RemovePermissionRequest {}
2828
export interface RemovePermissionCommandOutput extends __MetadataBearer {}
2929

3030
/**
31-
* <p>Revokes function-use permission from an Amazon Web Service or another Amazon Web Services account. You
31+
* <p>Revokes function-use permission from an Amazon Web Servicesservice or another Amazon Web Services account. You
3232
* can get the ID of the statement from the output of <a>GetPolicy</a>.</p>
3333
* @example
3434
* Use a bare-bones client and the command you need to make an API call.

‎clients/client-lambda/src/commands/UpdateEventSourceMappingCommand.ts

+6
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,7 @@ export interface UpdateEventSourceMappingCommandOutput extends EventSourceMappin
192192
* CollectionName: "STRING_VALUE",
193193
* FullDocument: "UpdateLookup" || "Default",
194194
* },
195+
* KMSKeyArn: "STRING_VALUE",
195196
* };
196197
* const command = new UpdateEventSourceMappingCommand(input);
197198
* const response = await client.send(command);
@@ -263,6 +264,11 @@ export interface UpdateEventSourceMappingCommandOutput extends EventSourceMappin
263264
* // CollectionName: "STRING_VALUE",
264265
* // FullDocument: "UpdateLookup" || "Default",
265266
* // },
267+
* // KMSKeyArn: "STRING_VALUE",
268+
* // FilterCriteriaError: { // FilterCriteriaError
269+
* // ErrorCode: "STRING_VALUE",
270+
* // Message: "STRING_VALUE",
271+
* // },
266272
* // };
267273
*
268274
* ```

‎clients/client-lambda/src/commands/UpdateFunctionConfigurationCommand.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ export interface UpdateFunctionConfigurationCommandOutput extends FunctionConfig
4747
* <p>These settings can vary between versions of a function and are locked when you publish a version. You can't
4848
* modify the configuration of a published version, only the unpublished version.</p>
4949
* <p>To configure function concurrency, use <a>PutFunctionConcurrency</a>. To grant invoke permissions
50-
* to an Amazon Web Services account or Amazon Web Service, use <a>AddPermission</a>.</p>
50+
* to an Amazon Web Services account or Amazon Web Servicesservice, use <a>AddPermission</a>.</p>
5151
* @example
5252
* Use a bare-bones client and the command you need to make an API call.
5353
* ```javascript

‎clients/client-lambda/src/models/models_0.ts

+61-3
Original file line numberDiff line numberDiff line change
@@ -397,23 +397,23 @@ export interface AddPermissionRequest {
397397
Action: string | undefined;
398398

399399
/**
400-
* <p>The Amazon Web Service or Amazon Web Services account that invokes the function. If you specify a
400+
* <p>The Amazon Web Servicesservice or Amazon Web Services account that invokes the function. If you specify a
401401
* service, use <code>SourceArn</code> or <code>SourceAccount</code> to limit who can invoke the function through
402402
* that service.</p>
403403
* @public
404404
*/
405405
Principal: string | undefined;
406406

407407
/**
408-
* <p>For Amazon Web Services, the ARN of the Amazon Web Services resource that invokes the function. For
408+
* <p>For Amazon Web Servicesservices, the ARN of the Amazon Web Services resource that invokes the function. For
409409
* example, an Amazon S3 bucket or Amazon SNS topic.</p>
410410
* <p>Note that Lambda configures the comparison using the <code>StringLike</code> operator.</p>
411411
* @public
412412
*/
413413
SourceArn?: string;
414414

415415
/**
416-
* <p>For Amazon Web Service, the ID of the Amazon Web Services account that owns the resource. Use this
416+
* <p>For Amazon Web Servicesservice, the ID of the Amazon Web Services account that owns the resource. Use this
417417
* together with <code>SourceArn</code> to ensure that the specified account owns the resource. It is possible for an
418418
* Amazon S3 bucket to be deleted by its owner and recreated by another account.</p>
419419
* @public
@@ -1263,6 +1263,35 @@ export interface CreateEventSourceMappingRequest {
12631263
* @public
12641264
*/
12651265
DocumentDBEventSourceConfig?: DocumentDBEventSourceConfig;
1266+
1267+
/**
1268+
* <p>
1269+
* The ARN of the Key Management Service (KMS) customer managed key that Lambda
1270+
* uses to encrypt your function's <a href="https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-basics">filter criteria</a>.
1271+
* By default, Lambda does not encrypt your filter criteria object. Specify this
1272+
* property to encrypt data using your own customer managed key.
1273+
* </p>
1274+
* @public
1275+
*/
1276+
KMSKeyArn?: string;
1277+
}
1278+
1279+
/**
1280+
* <p>An object that contains details about an error related to filter criteria encryption.</p>
1281+
* @public
1282+
*/
1283+
export interface FilterCriteriaError {
1284+
/**
1285+
* <p>The KMS exception that resulted from filter criteria encryption or decryption.</p>
1286+
* @public
1287+
*/
1288+
ErrorCode?: string;
1289+
1290+
/**
1291+
* <p>The error message.</p>
1292+
* @public
1293+
*/
1294+
Message?: string;
12661295
}
12671296

12681297
/**
@@ -1325,6 +1354,10 @@ export interface EventSourceMappingConfiguration {
13251354
/**
13261355
* <p>An object that defines the filter criteria that
13271356
* determine whether Lambda should process an event. For more information, see <a href="https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html">Lambda event filtering</a>.</p>
1357+
* <p>If filter criteria is encrypted, this field shows up as <code>null</code> in the response
1358+
* of ListEventSourceMapping API calls. You can view this field in plaintext in the response of
1359+
* GetEventSourceMapping and DeleteEventSourceMapping calls if you have
1360+
* <code>kms:Decrypt</code> permissions for the correct KMS key.</p>
13281361
* @public
13291362
*/
13301363
FilterCriteria?: FilterCriteria;
@@ -1449,6 +1482,20 @@ export interface EventSourceMappingConfiguration {
14491482
* @public
14501483
*/
14511484
DocumentDBEventSourceConfig?: DocumentDBEventSourceConfig;
1485+
1486+
/**
1487+
* <p>
1488+
* The ARN of the Key Management Service (KMS) customer managed key that Lambda
1489+
* uses to encrypt your function's <a href="https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-basics">filter criteria</a>.</p>
1490+
* @public
1491+
*/
1492+
KMSKeyArn?: string;
1493+
1494+
/**
1495+
* <p>An object that contains details about an error related to filter criteria encryption.</p>
1496+
* @public
1497+
*/
1498+
FilterCriteriaError?: FilterCriteriaError;
14521499
}
14531500

14541501
/**
@@ -7014,6 +7061,17 @@ export interface UpdateEventSourceMappingRequest {
70147061
* @public
70157062
*/
70167063
DocumentDBEventSourceConfig?: DocumentDBEventSourceConfig;
7064+
7065+
/**
7066+
* <p>
7067+
* The ARN of the Key Management Service (KMS) customer managed key that Lambda
7068+
* uses to encrypt your function's <a href="https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-basics">filter criteria</a>.
7069+
* By default, Lambda does not encrypt your filter criteria object. Specify this
7070+
* property to encrypt data using your own customer managed key.
7071+
* </p>
7072+
* @public
7073+
*/
7074+
KMSKeyArn?: string;
70177075
}
70187076

70197077
/**

‎clients/client-lambda/src/protocols/Aws_restJson1.ts

+14
Original file line numberDiff line numberDiff line change
@@ -446,6 +446,7 @@ export const se_CreateEventSourceMappingCommand = async (
446446
FilterCriteria: (_) => _json(_),
447447
FunctionName: [],
448448
FunctionResponseTypes: (_) => _json(_),
449+
KMSKeyArn: [],
449450
MaximumBatchingWindowInSeconds: [],
450451
MaximumRecordAgeInSeconds: [],
451452
MaximumRetryAttempts: [],
@@ -1689,6 +1690,7 @@ export const se_UpdateEventSourceMappingCommand = async (
16891690
FilterCriteria: (_) => _json(_),
16901691
FunctionName: [],
16911692
FunctionResponseTypes: (_) => _json(_),
1693+
KMSKeyArn: [],
16921694
MaximumBatchingWindowInSeconds: [],
16931695
MaximumRecordAgeInSeconds: [],
16941696
MaximumRetryAttempts: [],
@@ -1941,8 +1943,10 @@ export const de_CreateEventSourceMappingCommand = async (
19411943
DocumentDBEventSourceConfig: _json,
19421944
EventSourceArn: __expectString,
19431945
FilterCriteria: _json,
1946+
FilterCriteriaError: _json,
19441947
FunctionArn: __expectString,
19451948
FunctionResponseTypes: _json,
1949+
KMSKeyArn: __expectString,
19461950
LastModified: (_) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
19471951
LastProcessingResult: __expectString,
19481952
MaximumBatchingWindowInSeconds: __expectInt32,
@@ -2104,8 +2108,10 @@ export const de_DeleteEventSourceMappingCommand = async (
21042108
DocumentDBEventSourceConfig: _json,
21052109
EventSourceArn: __expectString,
21062110
FilterCriteria: _json,
2111+
FilterCriteriaError: _json,
21072112
FunctionArn: __expectString,
21082113
FunctionResponseTypes: _json,
2114+
KMSKeyArn: __expectString,
21092115
LastModified: (_) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
21102116
LastProcessingResult: __expectString,
21112117
MaximumBatchingWindowInSeconds: __expectInt32,
@@ -2339,8 +2345,10 @@ export const de_GetEventSourceMappingCommand = async (
23392345
DocumentDBEventSourceConfig: _json,
23402346
EventSourceArn: __expectString,
23412347
FilterCriteria: _json,
2348+
FilterCriteriaError: _json,
23422349
FunctionArn: __expectString,
23432350
FunctionResponseTypes: _json,
2351+
KMSKeyArn: __expectString,
23442352
LastModified: (_) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
23452353
LastProcessingResult: __expectString,
23462354
MaximumBatchingWindowInSeconds: __expectInt32,
@@ -3401,8 +3409,10 @@ export const de_UpdateEventSourceMappingCommand = async (
34013409
DocumentDBEventSourceConfig: _json,
34023410
EventSourceArn: __expectString,
34033411
FilterCriteria: _json,
3412+
FilterCriteriaError: _json,
34043413
FunctionArn: __expectString,
34053414
FunctionResponseTypes: _json,
3415+
KMSKeyArn: __expectString,
34063416
LastModified: (_) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
34073417
LastProcessingResult: __expectString,
34083418
MaximumBatchingWindowInSeconds: __expectInt32,
@@ -4797,8 +4807,10 @@ const de_EventSourceMappingConfiguration = (output: any, context: __SerdeContext
47974807
DocumentDBEventSourceConfig: _json,
47984808
EventSourceArn: __expectString,
47994809
FilterCriteria: _json,
4810+
FilterCriteriaError: _json,
48004811
FunctionArn: __expectString,
48014812
FunctionResponseTypes: _json,
4813+
KMSKeyArn: __expectString,
48024814
LastModified: (_: any) => __expectNonNull(__parseEpochTimestamp(__expectNumber(_))),
48034815
LastProcessingResult: __expectString,
48044816
MaximumBatchingWindowInSeconds: __expectInt32,
@@ -4840,6 +4852,8 @@ const de_EventSourceMappingsList = (output: any, context: __SerdeContext): Event
48404852

48414853
// de_FilterCriteria omitted.
48424854

4855+
// de_FilterCriteriaError omitted.
4856+
48434857
// de_FilterList omitted.
48444858

48454859
// de_FunctionArnList omitted.

0 commit comments

Comments
 (0)