Skip to content

Gate AWS Lambda role/external-id requirement behind --aws-lambda-skip-role-and-external-id #1140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mani-j9 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Gate AWS Lambda role/external-id requirement behind --aws-lambda-skip-role-and-external-id #1140

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 31 additions & 27 deletions internal/temporalcli/commands.gen.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3669,17 +3669,18 @@ type TemporalWorkerDeploymentCreateVersionCommand struct {
Parent *TemporalWorkerDeploymentCommand
Command cobra.Command
DeploymentVersionOptions
AwsLambdaFunctionArn string
AwsLambdaAssumeRoleArn string
AwsLambdaAssumeRoleExternalId string
GcpCloudRunProject string
GcpCloudRunRegion string
GcpCloudRunWorkerPool string
GcpCloudRunServiceAccount string
GcpCloudRunMinInstances int
GcpCloudRunMaxInstances int
GcpCloudRunInitialInstances int
GcpCloudRunUtilizationTarget float32
AwsLambdaFunctionArn string
AwsLambdaAssumeRoleArn string
AwsLambdaAssumeRoleExternalId string
AwsLambdaSkipRoleAndExternalId bool
GcpCloudRunProject string
GcpCloudRunRegion string
GcpCloudRunWorkerPool string
GcpCloudRunServiceAccount string
GcpCloudRunMinInstances int
GcpCloudRunMaxInstances int
GcpCloudRunInitialInstances int
GcpCloudRunUtilizationTarget float32
}

func NewTemporalWorkerDeploymentCreateVersionCommand(cctx *CommandContext, parent *TemporalWorkerDeploymentCommand) *TemporalWorkerDeploymentCreateVersionCommand {
Expand All @@ -3695,8 +3696,9 @@ func NewTemporalWorkerDeploymentCreateVersionCommand(cctx *CommandContext, paren
}
s.Command.Args = cobra.NoArgs
s.Command.Flags().StringVar(&s.AwsLambdaFunctionArn, "aws-lambda-function-arn", "", "Qualified (contains version suffix) or unqualified AWS Lambda function ARN to invoke when there are no active pollers for task queue targets in the Worker Deployment.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified. This requirement can be ignored with the option --aws-lambda-skip-role-and-external-id.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified. This requirement can be ignored with the option --aws-lambda-skip-role-and-external-id.")
s.Command.Flags().BoolVar(&s.AwsLambdaSkipRoleAndExternalId, "aws-lambda-skip-role-and-external-id", false, "Permit omitting --aws-lambda-assume-role-arn and --aws-lambda-assume-role-external-id when --aws-lambda-function-arn is specified. Both are required unless this flag is passed.")
s.Command.Flags().StringVar(&s.GcpCloudRunProject, "gcp-cloud-run-project", "", "GCP project ID hosting the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
s.Command.Flags().StringVar(&s.GcpCloudRunRegion, "gcp-cloud-run-region", "", "Region of the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
s.Command.Flags().StringVar(&s.GcpCloudRunWorkerPool, "gcp-cloud-run-worker-pool", "", "GCP Cloud Run worker pool name to scale when there are no active pollers for task queue targets in the Worker Deployment.")
Expand Down Expand Up @@ -4008,18 +4010,19 @@ type TemporalWorkerDeploymentUpdateVersionComputeConfigCommand struct {
Parent *TemporalWorkerDeploymentCommand
Command cobra.Command
DeploymentVersionOptions
AwsLambdaFunctionArn string
AwsLambdaAssumeRoleArn string
AwsLambdaAssumeRoleExternalId string
GcpCloudRunProject string
GcpCloudRunRegion string
GcpCloudRunWorkerPool string
GcpCloudRunServiceAccount string
GcpCloudRunMinInstances int
GcpCloudRunMaxInstances int
GcpCloudRunInitialInstances int
GcpCloudRunUtilizationTarget float32
Remove bool
AwsLambdaFunctionArn string
AwsLambdaAssumeRoleArn string
AwsLambdaAssumeRoleExternalId string
AwsLambdaSkipRoleAndExternalId bool
GcpCloudRunProject string
GcpCloudRunRegion string
GcpCloudRunWorkerPool string
GcpCloudRunServiceAccount string
GcpCloudRunMinInstances int
GcpCloudRunMaxInstances int
GcpCloudRunInitialInstances int
GcpCloudRunUtilizationTarget float32
Remove bool
}

func NewTemporalWorkerDeploymentUpdateVersionComputeConfigCommand(cctx *CommandContext, parent *TemporalWorkerDeploymentCommand) *TemporalWorkerDeploymentUpdateVersionComputeConfigCommand {
Expand All @@ -4035,8 +4038,9 @@ func NewTemporalWorkerDeploymentUpdateVersionComputeConfigCommand(cctx *CommandC
}
s.Command.Args = cobra.NoArgs
s.Command.Flags().StringVar(&s.AwsLambdaFunctionArn, "aws-lambda-function-arn", "", "Qualified (contains version suffix) or unqualified AWS Lambda function ARN to invoke when there are no active pollers for task queue targets in the Worker Deployment.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified. This requirement can be ignored with the option --aws-lambda-skip-role-and-external-id.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified. This requirement can be ignored with the option --aws-lambda-skip-role-and-external-id.")
s.Command.Flags().BoolVar(&s.AwsLambdaSkipRoleAndExternalId, "aws-lambda-skip-role-and-external-id", false, "Permit omitting --aws-lambda-assume-role-arn and --aws-lambda-assume-role-external-id when --aws-lambda-function-arn is specified. Both are required unless this flag is passed.")
s.Command.Flags().StringVar(&s.GcpCloudRunProject, "gcp-cloud-run-project", "", "GCP project ID hosting the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
s.Command.Flags().StringVar(&s.GcpCloudRunRegion, "gcp-cloud-run-region", "", "Region of the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
s.Command.Flags().StringVar(&s.GcpCloudRunWorkerPool, "gcp-cloud-run-worker-pool", "", "GCP Cloud Run worker pool name to scale when there are no active pollers for task queue targets in the Worker Deployment.")
Expand Down
18 changes: 15 additions & 3 deletions internal/temporalcli/commands.worker.deployment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -989,8 +989,15 @@ func (c *TemporalWorkerDeploymentManagerIdentityUnsetCommand) run(cctx *CommandC
return nil
}

func validateAWSLambdaProviderDetails(details map[string]any) error {
for _, key := range []string{"arn", "role", "role_external_id"} {
func validateAWSLambdaProviderDetails(details map[string]any, skipRoleAndExternalID bool) error {
keys := []string{"arn"}
if !skipRoleAndExternalID {
// The server governs whether these are mandatory via its
// require_role_and_external_id setting; --aws-lambda-skip-role-and-external-id
// opts out of the client-side check for servers where it is disabled.
keys = append(keys, "role", "role_external_id")
}
for _, key := range keys {
if _, ok := details[key]; !ok {
return fmt.Errorf("missing required AWS Lambda provider detail: %s", key)
}
Expand All @@ -1004,6 +1011,7 @@ func awsLambdaProviderDetailsPayload(
functionARN string,
assumeRoleARN string,
assumeRoleExternalID string,
skipRoleAndExternalID bool,
) (*commonpb.Payload, error) {
// Map keys from temporal-auto-scaled-workers:
// https://github.com/temporalio/temporal-auto-scaled-workers/blob/c4a7e69b6504365d7e5326b0b8e6cd95e3293f96/wci/workflow/compute_provider/aws_lambda.go#L16-L20
Expand All @@ -1016,7 +1024,7 @@ func awsLambdaProviderDetailsPayload(
if assumeRoleExternalID != "" {
providerDetails["role_external_id"] = assumeRoleExternalID
}
err := validateAWSLambdaProviderDetails(providerDetails)
err := validateAWSLambdaProviderDetails(providerDetails, skipRoleAndExternalID)
if err != nil {
return nil, err
}
Expand Down Expand Up @@ -1069,6 +1077,7 @@ func computeProviderConfig(
awsLambdaFunctionARN string,
awsLambdaAssumeRoleARN string,
awsLambdaAssumeRoleExternalID string,
awsLambdaSkipRoleAndExternalID bool,
gcpCloudRunProject string,
gcpCloudRunRegion string,
gcpCloudRunWorkerPool string,
Expand All @@ -1086,6 +1095,7 @@ func computeProviderConfig(
awsLambdaFunctionARN,
awsLambdaAssumeRoleARN,
awsLambdaAssumeRoleExternalID,
awsLambdaSkipRoleAndExternalID,
)
return "aws-lambda", p, err
case gcpCloudRunWorkerPool != "":
Expand Down Expand Up @@ -1230,6 +1240,7 @@ func (c *TemporalWorkerDeploymentCreateVersionCommand) run(cctx *CommandContext,
c.AwsLambdaFunctionArn,
c.AwsLambdaAssumeRoleArn,
c.AwsLambdaAssumeRoleExternalId,
c.AwsLambdaSkipRoleAndExternalId,
c.GcpCloudRunProject,
c.GcpCloudRunRegion,
c.GcpCloudRunWorkerPool,
Expand Down Expand Up @@ -1329,6 +1340,7 @@ func (c *TemporalWorkerDeploymentUpdateVersionComputeConfigCommand) run(cctx *Co
c.AwsLambdaFunctionArn,
c.AwsLambdaAssumeRoleArn,
c.AwsLambdaAssumeRoleExternalId,
c.AwsLambdaSkipRoleAndExternalId,
c.GcpCloudRunProject,
c.GcpCloudRunRegion,
c.GcpCloudRunWorkerPool,
Expand Down
16 changes: 16 additions & 0 deletions internal/temporalcli/commands.worker.deployment_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1315,6 +1315,22 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() {
s.Error(res.Err)
s.ErrorContains(res.Err, "missing required AWS Lambda provider detail: role")

// --aws-lambda-skip-role-and-external-id bypasses the client-side check, so
// the request reaches the server, which enforces its own
// require_role_and_external_id policy (enabled by default here).
skipRoleAndIDBuildID := uuid.NewString()

res = s.Execute(
"worker", "deployment", "create-version",
"--address", s.Address(),
"--deployment-name", deploymentName,
"--build-id", skipRoleAndIDBuildID,
"--aws-lambda-function-arn", invokeARN,
"--aws-lambda-skip-role-and-external-id",
)
s.Error(res.Err)
s.ErrorContains(res.Err, `AWS Lambda compute provider requires "role" to be configured`)

// --gcp-cloud-run-worker-pool requires project, region, and
// service-account; the first missing detail key is reported.
missingGCPProjectBuildID := uuid.NewString()
Expand Down
24 changes: 20 additions & 4 deletions internal/temporalcli/commands.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1136,14 +1136,22 @@ commands:
AWS IAM role ARN that the Temporal server will assume when invoking
the Lambda function that spawns a new Worker in this Worker
Deployment Version. Required when --aws-lambda-function-arn is
specified.
specified. This requirement can be ignored with the option
--aws-lambda-skip-role-and-external-id.
- name: aws-lambda-assume-role-external-id
type: string
description: |
Temporal server will enforce that the AWS IAM trust policy associated
with the AWS IAM role specified in --aws-lambda-assume-role-arn has
an aws:ExternalId condition that matches the supplied value. Required
when --aws-lambda-function-arn is specified.
when --aws-lambda-function-arn is specified. This requirement can be
ignored with the option --aws-lambda-skip-role-and-external-id.
- name: aws-lambda-skip-role-and-external-id
type: bool
description: |
Permit omitting --aws-lambda-assume-role-arn and
--aws-lambda-assume-role-external-id when --aws-lambda-function-arn
is specified. Both are required unless this flag is passed.
- name: gcp-cloud-run-project
type: string
description: |
Expand Down Expand Up @@ -1487,14 +1495,22 @@ commands:
AWS IAM role ARN that the Temporal server will assume when invoking
the Lambda function that spawns a new Worker in this Worker
Deployment Version. Required when --aws-lambda-function-arn is
specified.
specified. This requirement can be ignored with the option
--aws-lambda-skip-role-and-external-id.
- name: aws-lambda-assume-role-external-id
type: string
description: |
Temporal server will enforce that the AWS IAM trust policy associated
with the AWS IAM role specified in --aws-lambda-assume-role-arn has
an aws:ExternalId condition that matches the supplied value. Required
when --aws-lambda-function-arn is specified.
when --aws-lambda-function-arn is specified. This requirement can be
ignored with the option --aws-lambda-skip-role-and-external-id.
- name: aws-lambda-skip-role-and-external-id
type: bool
description: |
Permit omitting --aws-lambda-assume-role-arn and
--aws-lambda-assume-role-external-id when --aws-lambda-function-arn
is specified. Both are required unless this flag is passed.
- name: gcp-cloud-run-project
type: string
description: |
Expand Down