Copyright | (c) 2013-2015 Brendan Hay |
---|---|
License | Mozilla Public License, v. 2.0. |
Maintainer | Brendan Hay <brendan.g.hay@gmail.com> |
Stability | auto-generated |
Portability | non-portable (GHC extensions) |
Safe Haskell | None |
Language | Haskell2010 |
Adds a permission to the resource policy associated with the specified AWS Lambda function. You use resource policies to grant permissions to event sources that use "push" model. In "push" model, event sources (such as Amazon S3 and custom applications) invoke your Lambda function. Each permission you add to the resource policy allows an event source, permission to invoke the Lambda function.
For information about the push model, see AWS Lambda: How it Works.
If you are using versioning feature (see
AWS Lambda Function Versioning and Aliases),
a Lambda function can have multiple ARNs that can be used to invoke the
function. Note that, each permission you add to resource policy using
this API is specific to an ARN, specified using the Qualifier
parameter
This operation requires permission for the 'lambda:AddPermission' action.
See: AWS API Reference for AddPermission.
- addPermission :: Text -> Text -> Text -> Text -> AddPermission
- data AddPermission
- apSourceAccount :: Lens' AddPermission (Maybe Text)
- apSourceARN :: Lens' AddPermission (Maybe Text)
- apQualifier :: Lens' AddPermission (Maybe Text)
- apFunctionName :: Lens' AddPermission Text
- apStatementId :: Lens' AddPermission Text
- apAction :: Lens' AddPermission Text
- apPrincipal :: Lens' AddPermission Text
- addPermissionResponse :: Int -> AddPermissionResponse
- data AddPermissionResponse
- aprsStatement :: Lens' AddPermissionResponse (Maybe Text)
- aprsResponseStatus :: Lens' AddPermissionResponse Int
Creating a Request
Creates a value of AddPermission
with the minimum fields required to make a request.
Use one of the following lenses to modify other fields as desired:
data AddPermission Source
See: addPermission
smart constructor.
Request Lenses
apSourceAccount :: Lens' AddPermission (Maybe Text) Source
The AWS account ID (without a hyphen) of the source owner. For example,
if the SourceArn
identifies a bucket, then this is the bucket owner's
account ID. You can use this additional condition to ensure the bucket
you specify is owned by a specific account (it is possible the bucket
owner deleted the bucket and some other AWS account created the bucket).
You can also use this condition to specify all sources (that is, you
don't specify the SourceArn
) owned by a specific account.
apSourceARN :: Lens' AddPermission (Maybe Text) Source
This is optional; however, when granting Amazon S3 permission to invoke your function, you should specify this field with the bucket Amazon Resource Name (ARN) as its value. This ensures that only events generated from the specified bucket can invoke the function.
If you add a permission for the Amazon S3 principal without providing the source ARN, any AWS account that creates a mapping to your function ARN can send events to invoke your Lambda function from Amazon S3.
apQualifier :: Lens' AddPermission (Maybe Text) Source
You can specify this optional query parameter to specify function version or alias name. The permission will then apply to the specific qualified ARN. For example, if you specify function version 2 as the qualifier, then permission applies only when request is made using qualified function ARN:
'arn:aws:lambda:aws-region:acct-id:function:function-name:2'
If you specify alias name, for example "PROD", then the permission is valid only for requests made using the alias ARN:
'arn:aws:lambda:aws-region:acct-id:function:function-name:PROD'
If the qualifier is not specified, the permission is valid only when requests is made using unqualified function ARN.
'arn:aws:lambda:aws-region:acct-id:function:function-name'
apFunctionName :: Lens' AddPermission Text Source
Name of the Lambda function whose resource policy you are updating by adding a new permission.
You can specify an unqualified function name (for example, "Thumbnail") or you can specify Amazon Resource Name (ARN) of the function (for example, "arn:aws:lambda:us-west-2:account-id:function:ThumbNail"). AWS Lambda also allows you to specify only the account ID qualifier (for example, "account-id:Thumbnail"). Note that the length constraint applies only to the ARN. If you specify only the function name, it is limited to 64 character in length.
apStatementId :: Lens' AddPermission Text Source
A unique statement identifier.
apAction :: Lens' AddPermission Text Source
The AWS Lambda action you want to allow in this statement. Each Lambda action is a string starting with "lambda:" followed by the API name (see Operations). For example, "lambda:CreateFunction". You can use wildcard ("lambda:*") to grant permission for all AWS Lambda actions.
apPrincipal :: Lens' AddPermission Text Source
The principal who is getting this permission. It can be Amazon S3 service Principal ("s3.amazonaws.com") if you want Amazon S3 to invoke the function, an AWS account ID if you are granting cross-account permission, or any valid AWS service principal such as "sns.amazonaws.com". For example, you might want to allow a custom application in another AWS account to push events to AWS Lambda by invoking your function.
Destructuring the Response
Creates a value of AddPermissionResponse
with the minimum fields required to make a request.
Use one of the following lenses to modify other fields as desired:
data AddPermissionResponse Source
See: addPermissionResponse
smart constructor.
Response Lenses
aprsStatement :: Lens' AddPermissionResponse (Maybe Text) Source
The permission statement you specified in the request. The response returns the same as a string using "\" as an escape character in the JSON.
aprsResponseStatus :: Lens' AddPermissionResponse Int Source
The response status code.