diff --git a/packages/@aws-cdk/aws-scheduler-targets-alpha/lib/lambda-invoke.ts b/packages/@aws-cdk/aws-scheduler-targets-alpha/lib/lambda-invoke.ts index 69c26048c701f..bbd986780b6bd 100644 --- a/packages/@aws-cdk/aws-scheduler-targets-alpha/lib/lambda-invoke.ts +++ b/packages/@aws-cdk/aws-scheduler-targets-alpha/lib/lambda-invoke.ts @@ -1,34 +1,23 @@ import { ISchedule, IScheduleTarget } from '@aws-cdk/aws-scheduler-alpha'; -import { Names } from 'aws-cdk-lib'; import { IRole } from 'aws-cdk-lib/aws-iam'; import * as lambda from 'aws-cdk-lib/aws-lambda'; import { ScheduleTargetBase, ScheduleTargetBaseProps } from './target'; -import { sameEnvDimension } from './util'; /** * Use an AWS Lambda function as a target for AWS EventBridge Scheduler. */ export class LambdaInvoke extends ScheduleTargetBase implements IScheduleTarget { + private readonly func: lambda.IFunction; + constructor( - private readonly func: lambda.IFunction, - private readonly props: ScheduleTargetBaseProps, + func: lambda.IFunction, + props: ScheduleTargetBaseProps, ) { super(props, func.functionArn); + this.func = func; } - protected addTargetActionToRole(schedule: ISchedule, role: IRole): void { - if (!sameEnvDimension(this.func.env.region, schedule.env.region)) { - throw new Error(`Cannot assign function in region ${this.func.env.region} to the schedule ${Names.nodeUniqueId(schedule.node)} in region ${schedule.env.region}. Both the schedule and the function must be in the same region.`); - } - - if (!sameEnvDimension(this.func.env.account, schedule.env.account)) { - throw new Error(`Cannot assign function in account ${this.func.env.account} to the schedule ${Names.nodeUniqueId(schedule.node)} in account ${schedule.env.region}. Both the schedule and the function must be in the same account.`); - } - - if (this.props.role && !sameEnvDimension(this.props.role.env.account, this.func.env.account)) { - throw new Error(`Cannot grant permission to execution role in account ${this.props.role.env.account} to invoke target ${Names.nodeUniqueId(this.func.node)} in account ${this.func.env.account}. Both the target and the execution role must be in the same account.`); - } - + protected addTargetActionToRole(_schedule: ISchedule, role: IRole): void { this.func.grantInvoke(role); } } \ No newline at end of file diff --git a/packages/@aws-cdk/aws-scheduler-targets-alpha/test/lambda-invoke.test.ts b/packages/@aws-cdk/aws-scheduler-targets-alpha/test/lambda-invoke.test.ts index 8439776023afd..2fcb2a8d30629 100644 --- a/packages/@aws-cdk/aws-scheduler-targets-alpha/test/lambda-invoke.test.ts +++ b/packages/@aws-cdk/aws-scheduler-targets-alpha/test/lambda-invoke.test.ts @@ -319,42 +319,38 @@ describe('schedule target', () => { }); }); - test('throws when lambda function is imported from different account', () => { - const importedFunc = lambda.Function.fromFunctionArn(stack, 'ImportedFunction', 'arn:aws:lambda:us-east-1:234567890123:function/somefunc'); - - const lambdaTarget = new LambdaInvoke(importedFunc, {}); - - expect(() => - new Schedule(stack, 'MyScheduleDummy', { - schedule: expr, - target: lambdaTarget, - })).toThrow(/Both the schedule and the function must be in the same account/); - }); - - test('throws when lambda function is imported from different region', () => { - const importedFunc = lambda.Function.fromFunctionArn(stack, 'ImportedFunction', 'arn:aws:lambda:us-west-2:123456789012:function/somefunc'); + test('using imported lambda function should not throw', () => { + const lambdaFuncArn = 'arn:aws:lambda:us-east-1:234567890123:function/somefunc'; + const importedFunc = lambda.Function.fromFunctionAttributes( + stack, + 'ImportedLambdaFunction', + { + functionArn: lambdaFuncArn, + skipPermissions: true, + }, + ); const lambdaTarget = new LambdaInvoke(importedFunc, {}); - - expect(() => - new Schedule(stack, 'MyScheduleDummy', { - schedule: expr, - target: lambdaTarget, - })).toThrow(/Both the schedule and the function must be in the same region/); - }); - - test('throws when IAM role is imported from different account', () => { - const importedRole = Role.fromRoleArn(stack, 'ImportedRole', 'arn:aws:iam::234567890123:role/someRole'); - - const lambdaTarget = new LambdaInvoke(func, { - role: importedRole, + new Schedule(stack, 'MyScheduleDummy', { + schedule: expr, + target: lambdaTarget, }); - expect(() => - new Schedule(stack, 'MyScheduleDummy', { - schedule: expr, - target: lambdaTarget, - })).toThrow(/Both the target and the execution role must be in the same account/); + Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', { + PolicyDocument: { + Statement: [ + { + Action: 'lambda:InvokeFunction', + Effect: 'Allow', + Resource: [ + lambdaFuncArn, + `${lambdaFuncArn}:*`, + ], + }, + ], + }, + Roles: [{ Ref: 'SchedulerRoleForTargetfdfcef0FF637F7' }], + }); }); test('adds permissions to DLQ', () => {