It seems that if no role / policy is passed into a _CallbackFunction_'s args. then a pile of default ones are added. Fair enough.

Unfortunately, the code in lambdaMixins.ts passes a hard-coded args object,

{callback: handler}

, so it is impossible to pass in a role or policies.

So all EventRuleEventSubscription s have the default managed policies: *

AWSLambda_FullAccess

*

CloudWatchFullAccess

*

CloudWatchEventsFullAccess

*

AmazonS3FullAccess

*

AmazonDynamoDBFullAccess

*

AmazonSQSFullAccess

*

AmazonKinesisFullAccess

*

AWSCloudFormationReadOnlyAccess

*

AmazonCognitoPowerUser

*

AWSXrayWriteOnlyAccess

There are 10 here, and there is a 10-policy-per-role limit. So: no policy configuration is possible.

So I guess I'll change my EventRuleEventSubscription logic to plain-old CallbackFunction logic...

You can pass in your own

policies

to the

CallbackFunction

but if you are using mixin that in turn creates a

CallbackFunction

then

policies

is often not made available to you.

I’ll drop an example into the issue as well

I think that’s what you want — lmk if that helps

I'll try that now, that's a much smaller change than removing the mixin entirely...

How can I mark the CallbackFunction as async?

Oh nmind, I see.

The boilerplate isn't an issue. If the policies parameter worked, then I wouldn't have to create my own RolePolicyAttachment, so that's less boilerplate...

😕

Ah, an args class that extends another one.. hadn't noticed...

Can't see a way around the policies type issue other than to create the CallbackFunction in an apply, which is not recommended...

Hmm.. looks like even the EventRuleEventSubscription would have to be inside the apply(), which means quite a few resources would be created there...

because I don’t think the elements are ever used in any way except passed in to the attachment, which should accept an

Input<string>

for the arn

Nope, doesn't work.

utils.sha1hash(policy)

is complaining in lambdaMixins.ts.

😿

That is indeed unfortunate

And I have no idea how any of the on<eventName> functions work.. the disadvantages of being self-taught 🙂

It's only code in there that's blocking me. If I did the same thing myself, I can pass my own policy.arn in just fine.

I just can't follow the mixin code.

The

CallbackFunction

args should take a

role

argument — which, if provided, will skip the whole

policies

part

So I need to use my own policy with that permission.

I could try the role.

Need to find out how the role looks 🙂

Ok all sorted I think. Preview looks good. Some resources have changed where they are in the tree (e.g. the Function is now a child of my ComponentResource rather than the EventRuleEventSubscription) but it looks correct. Can't

up

to be sure, I've fallen behind trunk branch and there's a few changes I'd undo if I deployed now 🙂 I'll get to it in a few hours, need to get out of here now. Thanks for all your help!