diff --git a/internal/temporalcli/commands.gen.go b/internal/temporalcli/commands.gen.go index 5b62048d0..60c181753 100644 --- a/internal/temporalcli/commands.gen.go +++ b/internal/temporalcli/commands.gen.go @@ -3669,17 +3669,18 @@ type TemporalWorkerDeploymentCreateVersionCommand struct { Parent *TemporalWorkerDeploymentCommand Command cobra.Command DeploymentVersionOptions - AwsLambdaFunctionArn string - AwsLambdaAssumeRoleArn string - AwsLambdaAssumeRoleExternalId string - GcpCloudRunProject string - GcpCloudRunRegion string - GcpCloudRunWorkerPool string - GcpCloudRunServiceAccount string - GcpCloudRunMinInstances int - GcpCloudRunMaxInstances int - GcpCloudRunInitialInstances int - GcpCloudRunUtilizationTarget float32 + AwsLambdaFunctionArn string + AwsLambdaAssumeRoleArn string + AwsLambdaAssumeRoleExternalId string + AwsLambdaSkipRoleAndExternalId bool + GcpCloudRunProject string + GcpCloudRunRegion string + GcpCloudRunWorkerPool string + GcpCloudRunServiceAccount string + GcpCloudRunMinInstances int + GcpCloudRunMaxInstances int + GcpCloudRunInitialInstances int + GcpCloudRunUtilizationTarget float32 } func NewTemporalWorkerDeploymentCreateVersionCommand(cctx *CommandContext, parent *TemporalWorkerDeploymentCommand) *TemporalWorkerDeploymentCreateVersionCommand { @@ -3695,8 +3696,9 @@ func NewTemporalWorkerDeploymentCreateVersionCommand(cctx *CommandContext, paren } s.Command.Args = cobra.NoArgs s.Command.Flags().StringVar(&s.AwsLambdaFunctionArn, "aws-lambda-function-arn", "", "Qualified (contains version suffix) or unqualified AWS Lambda function ARN to invoke when there are no active pollers for task queue targets in the Worker Deployment.") - s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified.") - s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified.") + s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified. This requirement can be ignored with the option --aws-lambda-skip-role-and-external-id.") + s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified. This requirement can be ignored with the option --aws-lambda-skip-role-and-external-id.") + s.Command.Flags().BoolVar(&s.AwsLambdaSkipRoleAndExternalId, "aws-lambda-skip-role-and-external-id", false, "Permit omitting --aws-lambda-assume-role-arn and --aws-lambda-assume-role-external-id when --aws-lambda-function-arn is specified. Both are required unless this flag is passed.") s.Command.Flags().StringVar(&s.GcpCloudRunProject, "gcp-cloud-run-project", "", "GCP project ID hosting the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.") s.Command.Flags().StringVar(&s.GcpCloudRunRegion, "gcp-cloud-run-region", "", "Region of the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.") s.Command.Flags().StringVar(&s.GcpCloudRunWorkerPool, "gcp-cloud-run-worker-pool", "", "GCP Cloud Run worker pool name to scale when there are no active pollers for task queue targets in the Worker Deployment.") @@ -4008,18 +4010,19 @@ type TemporalWorkerDeploymentUpdateVersionComputeConfigCommand struct { Parent *TemporalWorkerDeploymentCommand Command cobra.Command DeploymentVersionOptions - AwsLambdaFunctionArn string - AwsLambdaAssumeRoleArn string - AwsLambdaAssumeRoleExternalId string - GcpCloudRunProject string - GcpCloudRunRegion string - GcpCloudRunWorkerPool string - GcpCloudRunServiceAccount string - GcpCloudRunMinInstances int - GcpCloudRunMaxInstances int - GcpCloudRunInitialInstances int - GcpCloudRunUtilizationTarget float32 - Remove bool + AwsLambdaFunctionArn string + AwsLambdaAssumeRoleArn string + AwsLambdaAssumeRoleExternalId string + AwsLambdaSkipRoleAndExternalId bool + GcpCloudRunProject string + GcpCloudRunRegion string + GcpCloudRunWorkerPool string + GcpCloudRunServiceAccount string + GcpCloudRunMinInstances int + GcpCloudRunMaxInstances int + GcpCloudRunInitialInstances int + GcpCloudRunUtilizationTarget float32 + Remove bool } func NewTemporalWorkerDeploymentUpdateVersionComputeConfigCommand(cctx *CommandContext, parent *TemporalWorkerDeploymentCommand) *TemporalWorkerDeploymentUpdateVersionComputeConfigCommand { @@ -4035,8 +4038,9 @@ func NewTemporalWorkerDeploymentUpdateVersionComputeConfigCommand(cctx *CommandC } s.Command.Args = cobra.NoArgs s.Command.Flags().StringVar(&s.AwsLambdaFunctionArn, "aws-lambda-function-arn", "", "Qualified (contains version suffix) or unqualified AWS Lambda function ARN to invoke when there are no active pollers for task queue targets in the Worker Deployment.") - s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified.") - s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified.") + s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified. This requirement can be ignored with the option --aws-lambda-skip-role-and-external-id.") + s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified. This requirement can be ignored with the option --aws-lambda-skip-role-and-external-id.") + s.Command.Flags().BoolVar(&s.AwsLambdaSkipRoleAndExternalId, "aws-lambda-skip-role-and-external-id", false, "Permit omitting --aws-lambda-assume-role-arn and --aws-lambda-assume-role-external-id when --aws-lambda-function-arn is specified. Both are required unless this flag is passed.") s.Command.Flags().StringVar(&s.GcpCloudRunProject, "gcp-cloud-run-project", "", "GCP project ID hosting the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.") s.Command.Flags().StringVar(&s.GcpCloudRunRegion, "gcp-cloud-run-region", "", "Region of the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.") s.Command.Flags().StringVar(&s.GcpCloudRunWorkerPool, "gcp-cloud-run-worker-pool", "", "GCP Cloud Run worker pool name to scale when there are no active pollers for task queue targets in the Worker Deployment.") diff --git a/internal/temporalcli/commands.worker.deployment.go b/internal/temporalcli/commands.worker.deployment.go index 2f788ae2f..c97037a9a 100644 --- a/internal/temporalcli/commands.worker.deployment.go +++ b/internal/temporalcli/commands.worker.deployment.go @@ -989,8 +989,15 @@ func (c *TemporalWorkerDeploymentManagerIdentityUnsetCommand) run(cctx *CommandC return nil } -func validateAWSLambdaProviderDetails(details map[string]any) error { - for _, key := range []string{"arn", "role", "role_external_id"} { +func validateAWSLambdaProviderDetails(details map[string]any, skipRoleAndExternalID bool) error { + keys := []string{"arn"} + if !skipRoleAndExternalID { + // The server governs whether these are mandatory via its + // require_role_and_external_id setting; --aws-lambda-skip-role-and-external-id + // opts out of the client-side check for servers where it is disabled. + keys = append(keys, "role", "role_external_id") + } + for _, key := range keys { if _, ok := details[key]; !ok { return fmt.Errorf("missing required AWS Lambda provider detail: %s", key) } @@ -1004,6 +1011,7 @@ func awsLambdaProviderDetailsPayload( functionARN string, assumeRoleARN string, assumeRoleExternalID string, + skipRoleAndExternalID bool, ) (*commonpb.Payload, error) { // Map keys from temporal-auto-scaled-workers: // https://github.com/temporalio/temporal-auto-scaled-workers/blob/c4a7e69b6504365d7e5326b0b8e6cd95e3293f96/wci/workflow/compute_provider/aws_lambda.go#L16-L20 @@ -1016,7 +1024,7 @@ func awsLambdaProviderDetailsPayload( if assumeRoleExternalID != "" { providerDetails["role_external_id"] = assumeRoleExternalID } - err := validateAWSLambdaProviderDetails(providerDetails) + err := validateAWSLambdaProviderDetails(providerDetails, skipRoleAndExternalID) if err != nil { return nil, err } @@ -1069,6 +1077,7 @@ func computeProviderConfig( awsLambdaFunctionARN string, awsLambdaAssumeRoleARN string, awsLambdaAssumeRoleExternalID string, + awsLambdaSkipRoleAndExternalID bool, gcpCloudRunProject string, gcpCloudRunRegion string, gcpCloudRunWorkerPool string, @@ -1086,6 +1095,7 @@ func computeProviderConfig( awsLambdaFunctionARN, awsLambdaAssumeRoleARN, awsLambdaAssumeRoleExternalID, + awsLambdaSkipRoleAndExternalID, ) return "aws-lambda", p, err case gcpCloudRunWorkerPool != "": @@ -1230,6 +1240,7 @@ func (c *TemporalWorkerDeploymentCreateVersionCommand) run(cctx *CommandContext, c.AwsLambdaFunctionArn, c.AwsLambdaAssumeRoleArn, c.AwsLambdaAssumeRoleExternalId, + c.AwsLambdaSkipRoleAndExternalId, c.GcpCloudRunProject, c.GcpCloudRunRegion, c.GcpCloudRunWorkerPool, @@ -1329,6 +1340,7 @@ func (c *TemporalWorkerDeploymentUpdateVersionComputeConfigCommand) run(cctx *Co c.AwsLambdaFunctionArn, c.AwsLambdaAssumeRoleArn, c.AwsLambdaAssumeRoleExternalId, + c.AwsLambdaSkipRoleAndExternalId, c.GcpCloudRunProject, c.GcpCloudRunRegion, c.GcpCloudRunWorkerPool, diff --git a/internal/temporalcli/commands.worker.deployment_test.go b/internal/temporalcli/commands.worker.deployment_test.go index e1a7115b4..b47c3122b 100644 --- a/internal/temporalcli/commands.worker.deployment_test.go +++ b/internal/temporalcli/commands.worker.deployment_test.go @@ -1315,6 +1315,22 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() { s.Error(res.Err) s.ErrorContains(res.Err, "missing required AWS Lambda provider detail: role") + // --aws-lambda-skip-role-and-external-id bypasses the client-side check, so + // the request reaches the server, which enforces its own + // require_role_and_external_id policy (enabled by default here). + skipRoleAndIDBuildID := uuid.NewString() + + res = s.Execute( + "worker", "deployment", "create-version", + "--address", s.Address(), + "--deployment-name", deploymentName, + "--build-id", skipRoleAndIDBuildID, + "--aws-lambda-function-arn", invokeARN, + "--aws-lambda-skip-role-and-external-id", + ) + s.Error(res.Err) + s.ErrorContains(res.Err, `AWS Lambda compute provider requires "role" to be configured`) + // --gcp-cloud-run-worker-pool requires project, region, and // service-account; the first missing detail key is reported. missingGCPProjectBuildID := uuid.NewString() diff --git a/internal/temporalcli/commands.yaml b/internal/temporalcli/commands.yaml index 7dada8c37..d0303158d 100644 --- a/internal/temporalcli/commands.yaml +++ b/internal/temporalcli/commands.yaml @@ -1136,14 +1136,22 @@ commands: AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is - specified. + specified. This requirement can be ignored with the option + --aws-lambda-skip-role-and-external-id. - name: aws-lambda-assume-role-external-id type: string description: | Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required - when --aws-lambda-function-arn is specified. + when --aws-lambda-function-arn is specified. This requirement can be + ignored with the option --aws-lambda-skip-role-and-external-id. + - name: aws-lambda-skip-role-and-external-id + type: bool + description: | + Permit omitting --aws-lambda-assume-role-arn and + --aws-lambda-assume-role-external-id when --aws-lambda-function-arn + is specified. Both are required unless this flag is passed. - name: gcp-cloud-run-project type: string description: | @@ -1487,14 +1495,22 @@ commands: AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is - specified. + specified. This requirement can be ignored with the option + --aws-lambda-skip-role-and-external-id. - name: aws-lambda-assume-role-external-id type: string description: | Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required - when --aws-lambda-function-arn is specified. + when --aws-lambda-function-arn is specified. This requirement can be + ignored with the option --aws-lambda-skip-role-and-external-id. + - name: aws-lambda-skip-role-and-external-id + type: bool + description: | + Permit omitting --aws-lambda-assume-role-arn and + --aws-lambda-assume-role-external-id when --aws-lambda-function-arn + is specified. Both are required unless this flag is passed. - name: gcp-cloud-run-project type: string description: |