Gate AWS Lambda role/external-id requirement behind --aws-lambda-skip-role-and-external-id

[mani-j9]

create-version and update-version-compute-config require --aws-lambda-assume-role-arn and --aws-lambda-assume-role-external-id whenever --aws-lambda-function-arn is set. The Temporal server governs whether these are actually mandatory via the global require_role_and_external_id setting (default true), so a role-less config is valid against servers where that setting is disabled — e.g. local dev against LocalStack.

This adds --aws-lambda-skip-role-and-external-id (bool, default false). By default the CLI keeps requiring both fields and fails fast with an actionable client-side error that names the missing flag. Passing the flag opts out of the client-side check and defers entirely to the server's policy.

temporal worker deployment create-version \
  --deployment-name my-app \
  --build-id build-1 \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:000000000000:function:my-temporal-worker \
  --aws-lambda-skip-role-and-external-id

The skip flag is also treated as an AWS-Lambda flag for the existing AWS/GCP mutual-exclusion and --remove conflict checks.

Validated e2e locally against a server with workercontroller.compute_providers.aws.require_role_and_external_id=false.

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

mani seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Pull request overview

This PR removes client-side enforcement of AWS Lambda assume-role ARN and external ID when configuring Worker Deployment compute settings, relying instead on Temporal server-side policy (require_role_and_external_id) so that role-less configurations (e.g., LocalStack/dev setups) are not blocked by the CLI.

Changes:

• Relaxed CLI validation so AWS Lambda compute provider details only require the function ARN.
• Updated CLI flag documentation/help text to no longer claim role/external ID are always required when a function ARN is set.
• Updated create-version error tests to assert server-side rejection when role/external ID are omitted under default server settings.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
internal/temporalcli/commands.yaml	Updated flag descriptions to remove unconditional “required” wording for AWS Lambda role/external ID.
internal/temporalcli/commands.worker.deployment.go	Relaxed AWS Lambda provider-details validation to only require ARN.
internal/temporalcli/commands.worker.deployment_test.go	Updated error expectations to match server-side validation messages.
internal/temporalcli/commands.gen.go	Regenerated/updated Cobra flag help strings consistent with updated YAML descriptions.

Comments suppressed due to low confidence (3)

internal/temporalcli/commands.yaml:1487

• The update-version compute config command has the same documentation issue: clarify that this flag only applies when --aws-lambda-function-arn is being used, and that server-side settings may still require it.

          AWS IAM role ARN that the Temporal server will assume when invoking
          the Lambda function that spawns a new Worker in this Worker
          Deployment Version.

internal/temporalcli/commands.yaml:1493

• Likewise, clarify that the external ID is only applicable alongside the AWS Lambda function ARN (and role ARN), and may still be required depending on server configuration.

          Temporal server will enforce that the AWS IAM trust policy associated
          with the AWS IAM role specified in --aws-lambda-assume-role-arn has
          an aws:ExternalId condition that matches the supplied value.

internal/temporalcli/commands.gen.go:4039

• Same documentation concern for update-version-compute-config: the help text should clarify these flags are only applicable with --aws-lambda-function-arn, and that server-side configuration may still require them.

	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version.")
	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value.")

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mani-j9]

Considered mentioning the server side enforcement based on the flag but left it simple as it may confuse the readers more about why one may want to relax the require_role_and_external_id setting. Open to changing to this suggestion if review comes up with similar concern.

[mani-j9]

Considered mentioning the server side enforcement based on the flag but left it simple as it may confuse the readers more about why one may want to relax the require_role_and_external_id setting. Open to changing to this suggestion if review comes up with similar concern.

[02strich]

I am sorry for the long delay on review. Instead of making the existing flags optional, I would prefer to have a new flag that indicates that the user wants to disable the security setting - and then either that or the external ID flag need to be set. That way there is no oopsie moment risk.