fix(custom-resource): provider framework lambda missing GetFunction permission

[moelasmar]

Issue # (if applicable)

Closes #26838.

Reason for this change

In the Provider Framework lambda code, there is a logic to catch error arise from invoking the User Defined handler lambda. Upon error, it polls the state of the User Defined handler until it is in ACTIVE state (#22612 added this logic):

aws-cdk/packages/aws-cdk-lib/custom-resources/lib/provider-framework/runtime/outbound.ts

Lines 66 to 80 in 64b865b

	} catch {
	/**
	* The status of the Lambda function is checked every second for up to 300 seconds.
	* Exits the loop on 'Active' state and throws an error on 'Inactive' or 'Failed'.
	*
	* And now we wait.
	*/
	await waitUntilFunctionActiveV2({
	client: lambda,
	maxWaitTime: 300,
	}, {
	FunctionName: req.FunctionName,
	});
	return lambda.invoke(req);
	}

The polling uses the AWS SDK waitUntilFunctionActiveV2 function, which calls the Lambda GetFunction API:
https://github.com/aws/aws-sdk-js-v3/blob/6858c7e04730a2b524b06355969e4076c28ae863/clients/client-lambda/src/waiters/waitForFunctionActiveV2.ts#L57

However, the Provider Framework lambda does not have the lambda:GetFunction permission.

Why is the issue saying the lambda:GetFunctionConfiguration is needed instead of lambda:GetFunction?

At some point in time, the retry logic used waitUntilFunctionActive for polling, which use the GetFunctionConfiguration. But this is no longer the case after c3a4b7b#diff-85920270c638d83b082246e0026f1a316dd39aaa3cd8720fdaeb3d526e438f7fR66

Description of changes

Added the lambda:GetFunction permission on the role used by the Provider Framework lambda.

Describe any new or updated permissions being added

The lambda:GetFunction permission is added.

Description of how you validated changes

There isn't a straight forward way to test the INACTIVE lambda scenario as one need to wait 14 days for a Lambda function to become INACTIVE. Therefore, I am not able to create an integ test.

What I did was locally changing the Provider Framework lambda code to throw an error such that it executes the catch block. Then I verified in CloudTrail that the Provider Framework lambda called GetFunction successfully and then it was also able to invoke the User Defined Handler lambda.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.83%. Comparing base (bc82f57) to head (49d950d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33315   +/-   ##
=======================================
  Coverage   80.83%   80.83%           
=======================================
  Files         236      236           
  Lines       14253    14253           
  Branches     2490     2490           
=======================================
  Hits        11522    11522           
  Misses       2446     2446           
  Partials      285      285           

Flag	Coverage Δ
suite.unit	80.83% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	79.57% <ø> (ø)
packages/aws-cdk-lib/core	82.20% <ø> (ø)

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 49d950d
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

This pull request has been removed from the queue for the following reason: pull request dequeued.

Pull request #33315 has been dequeued. The pull request rule doesn't match anymore. The following conditions don't match anymore:

• -label~=(blocked|do-not-merge|no-squash|two-approvers)
• status-success=validate-pr
• any of: [🔀 queue conditions]
  • all of: [📌 queue conditions of queue default-squash]
    • any of: [🛡 GitHub branch protection]
      • check-neutral = validate-pr
      • check-skipped = validate-pr
      • check-success = validate-pr

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.

If you want to requeue this pull request, you need to post a comment with the text: @mergifyio requeue

[shikha372]

@Mergifyio update

[mergify]

update

☑️ Nothing to do

• #commits-behind > 0 [📌 update requirement]
• -closed [📌 update requirement]
• -conflict [📌 update requirement]
• queue-position = -1 [📌 update requirement]

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[shikha372]

@Mergifyio requeue priority-squash

[mergify]

requeue priority-squash

☑️ This pull request is already queued

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[shikha372]

@Mergifyio dequeue

[mergify]

This pull request has been removed from the queue for the following reason: pull request dequeued.

Pull request #33315 has been dequeued by a dequeue command

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.

If you want to requeue this pull request, you need to post a comment with the text: @mergifyio requeue

[mergify]

dequeue

✅ The pull request has been removed from the queue default-squash

[shikha372]

@Mergifyio queue priority-squash

[mergify]

queue priority-squash

🛑 The pull request has been removed from the queue priority-squash

Pull request #33315 has been dequeued by a dequeue command.

You can take a look at Queue: Embarked in merge queue check runs for more details.

In case of a failure due to a flaky test, you should first retrigger the CI.
Then, re-embark the pull request into the merge queue by posting the comment
@mergifyio refresh on the pull request.

[shikha372]

@Mergifyio refresh

[mergify]

refresh

✅ Pull request refreshed

[shikha372]

@Mergifyio queue priority-squash

[mergify]

queue priority-squash

✅ The pull request has been merged automatically

The pull request has been merged automatically at 80217f1

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.