Network.AWS.Lambda.AddPermission

Adds a permission to the resource policy associated with the specified AWS Lambda function. You use resource policies to grant permissions to event sources that use push model. In a push model, event sources (such as Amazon S3 and custom applications) invoke your Lambda function. Each permission you add to the resource policy allows an event source, permission to invoke the Lambda function.

For information about the push model, see AWS Lambda: How it Works .

If you are using versioning, the permissions you add are specific to the Lambda function version or alias you specify in the AddPermission request via the Qualifier parameter. For more information about versioning, see AWS Lambda Function Versioning and Aliases .

This operation requires permission for the lambda:AddPermission action.

Creating a Request

addPermission

Arguments

:: Text

apFunctionName

-> Text

apStatementId

-> Text

apAction

-> Text

apPrincipal

-> AddPermission

Creates a value of AddPermission with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• apSourceAccount - This parameter is used for S3 and SES. The AWS account ID (without a hyphen) of the source owner. For example, if the SourceArn identifies a bucket, then this is the bucket owner's account ID. You can use this additional condition to ensure the bucket you specify is owned by a specific account (it is possible the bucket owner deleted the bucket and some other AWS account created the bucket). You can also use this condition to specify all sources (that is, you don't specify the SourceArn ) owned by a specific account.
• apEventSourceToken - A unique token that must be supplied by the principal invoking the function. This is currently only used for Alexa Smart Home functions.
• apSourceARN - This is optional; however, when granting permission to invoke your function, you should specify this field with the Amazon Resource Name (ARN) as its value. This ensures that only events generated from the specified source can invoke the function. Important: If you add a permission without providing the source ARN, any AWS account that creates a mapping to your function ARN can send events to invoke your Lambda function.
• apQualifier - You can use this optional query parameter to describe a qualified ARN using a function version or an alias name. The permission will then apply to the specific qualified ARN. For example, if you specify function version 2 as the qualifier, then permission applies only when request is made using qualified function ARN: arn:aws:lambda:aws-region:acct-id:function:function-name:2 If you specify an alias name, for example PROD , then the permission is valid only for requests made using the alias ARN: arn:aws:lambda:aws-region:acct-id:function:function-name:PROD If the qualifier is not specified, the permission is valid only when requests is made using unqualified function ARN. arn:aws:lambda:aws-region:acct-id:function:function-name
• apFunctionName - Name of the Lambda function whose resource policy you are updating by adding a new permission. You can specify a function name (for example, Thumbnail ) or you can specify Amazon Resource Name (ARN) of the function (for example, arn:aws:lambda:us-west-2:account-id:function:ThumbNail ). AWS Lambda also allows you to specify partial ARN (for example, account-id:Thumbnail ). Note that the length constraint applies only to the ARN. If you specify only the function name, it is limited to 64 characters in length.
• apStatementId - A unique statement identifier.
• apAction - The AWS Lambda action you want to allow in this statement. Each Lambda action is a string starting with lambda: followed by the API name . For example, lambda:CreateFunction . You can use wildcard (lambda:* ) to grant permission for all AWS Lambda actions.
• apPrincipal - The principal who is getting this permission. It can be Amazon S3 service Principal (s3.amazonaws.com ) if you want Amazon S3 to invoke the function, an AWS account ID if you are granting cross-account permission, or any valid AWS service principal such as sns.amazonaws.com . For example, you might want to allow a custom application in another AWS account to push events to AWS Lambda by invoking your function.

data AddPermission

See: addPermission smart constructor.

Instances

Eq AddPermission

Methods

(==) :: AddPermission -> AddPermission -> Bool

(/=) :: AddPermission -> AddPermission -> Bool

Data AddPermission

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> AddPermission -> c AddPermission

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c AddPermission

toConstr :: AddPermission -> Constr

dataTypeOf :: AddPermission -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c AddPermission)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c AddPermission)

gmapT :: (forall b. Data b => b -> b) -> AddPermission -> AddPermission

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> AddPermission -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> AddPermission -> r

gmapQ :: (forall d. Data d => d -> u) -> AddPermission -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> AddPermission -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> AddPermission -> m AddPermission

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> AddPermission -> m AddPermission

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> AddPermission -> m AddPermission

Read AddPermission

Methods

readsPrec :: Int -> ReadS AddPermission

readList :: ReadS [AddPermission]

readPrec :: ReadPrec AddPermission

readListPrec :: ReadPrec [AddPermission]

Show AddPermission

Methods

showsPrec :: Int -> AddPermission -> ShowS

show :: AddPermission -> String

showList :: [AddPermission] -> ShowS

Generic AddPermission

Associated Types

type Rep AddPermission :: * -> *

Methods

from :: AddPermission -> Rep AddPermission x

to :: Rep AddPermission x -> AddPermission

Hashable AddPermission

Methods

hashWithSalt :: Int -> AddPermission -> Int

hash :: AddPermission -> Int

ToJSON AddPermission

Methods

toJSON :: AddPermission -> Value

toEncoding :: AddPermission -> Encoding

toJSONList :: [AddPermission] -> Value

toEncodingList :: [AddPermission] -> Encoding

NFData AddPermission

Methods

rnf :: AddPermission -> ()

AWSRequest AddPermission

Associated Types

type Rs AddPermission :: *

Methods

request :: AddPermission -> Request AddPermission

response :: MonadResource m => Logger -> Service -> Proxy * AddPermission -> ClientResponse -> m (Response AddPermission)

ToQuery AddPermission

Methods

toQuery :: AddPermission -> QueryString

ToPath AddPermission

Methods

toPath :: AddPermission -> ByteString

ToHeaders AddPermission

Methods

toHeaders :: AddPermission -> [Header]

type Rep AddPermission

type Rep AddPermission = D1 (MetaData "AddPermission" "Network.AWS.Lambda.AddPermission" "amazonka-lambda-1.5.0-L3a8zfumEyl9xoJg9e0UyS" False) (C1 (MetaCons "AddPermission'" PrefixI True) ((:*:) ((:*:) ((:*:) (S1 (MetaSel (Just Symbol "_apSourceAccount") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text))) (S1 (MetaSel (Just Symbol "_apEventSourceToken") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text)))) ((:*:) (S1 (MetaSel (Just Symbol "_apSourceARN") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text))) (S1 (MetaSel (Just Symbol "_apQualifier") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text))))) ((:*:) ((:*:) (S1 (MetaSel (Just Symbol "_apFunctionName") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)) (S1 (MetaSel (Just Symbol "_apStatementId") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text))) ((:*:) (S1 (MetaSel (Just Symbol "_apAction") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)) (S1 (MetaSel (Just Symbol "_apPrincipal") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text))))))

type Rs AddPermission

type Rs AddPermission = AddPermissionResponse

Request Lenses

apSourceAccount :: Lens' AddPermission (Maybe Text)

This parameter is used for S3 and SES. The AWS account ID (without a hyphen) of the source owner. For example, if the SourceArn identifies a bucket, then this is the bucket owner's account ID. You can use this additional condition to ensure the bucket you specify is owned by a specific account (it is possible the bucket owner deleted the bucket and some other AWS account created the bucket). You can also use this condition to specify all sources (that is, you don't specify the SourceArn ) owned by a specific account.

apEventSourceToken :: Lens' AddPermission (Maybe Text)

A unique token that must be supplied by the principal invoking the function. This is currently only used for Alexa Smart Home functions.

apSourceARN :: Lens' AddPermission (Maybe Text)

This is optional; however, when granting permission to invoke your function, you should specify this field with the Amazon Resource Name (ARN) as its value. This ensures that only events generated from the specified source can invoke the function. Important: If you add a permission without providing the source ARN, any AWS account that creates a mapping to your function ARN can send events to invoke your Lambda function.

apQualifier :: Lens' AddPermission (Maybe Text)

You can use this optional query parameter to describe a qualified ARN using a function version or an alias name. The permission will then apply to the specific qualified ARN. For example, if you specify function version 2 as the qualifier, then permission applies only when request is made using qualified function ARN: arn:aws:lambda:aws-region:acct-id:function:function-name:2 If you specify an alias name, for example PROD , then the permission is valid only for requests made using the alias ARN: arn:aws:lambda:aws-region:acct-id:function:function-name:PROD If the qualifier is not specified, the permission is valid only when requests is made using unqualified function ARN. arn:aws:lambda:aws-region:acct-id:function:function-name

apFunctionName :: Lens' AddPermission Text

Name of the Lambda function whose resource policy you are updating by adding a new permission. You can specify a function name (for example, Thumbnail ) or you can specify Amazon Resource Name (ARN) of the function (for example, arn:aws:lambda:us-west-2:account-id:function:ThumbNail ). AWS Lambda also allows you to specify partial ARN (for example, account-id:Thumbnail ). Note that the length constraint applies only to the ARN. If you specify only the function name, it is limited to 64 characters in length.

apStatementId :: Lens' AddPermission Text

A unique statement identifier.

apAction :: Lens' AddPermission Text

The AWS Lambda action you want to allow in this statement. Each Lambda action is a string starting with lambda: followed by the API name . For example, lambda:CreateFunction . You can use wildcard (lambda:* ) to grant permission for all AWS Lambda actions.

apPrincipal :: Lens' AddPermission Text

The principal who is getting this permission. It can be Amazon S3 service Principal (s3.amazonaws.com ) if you want Amazon S3 to invoke the function, an AWS account ID if you are granting cross-account permission, or any valid AWS service principal such as sns.amazonaws.com . For example, you might want to allow a custom application in another AWS account to push events to AWS Lambda by invoking your function.

Destructuring the Response

addPermissionResponse

Arguments

:: Int

aprsResponseStatus

-> AddPermissionResponse

Creates a value of AddPermissionResponse with the minimum fields required to make a request.

Use one of the following lenses to modify other fields as desired:

• aprsStatement - The permission statement you specified in the request. The response returns the same as a string using a backslash ("") as an escape character in the JSON.
• aprsResponseStatus - -- | The response status code.

data AddPermissionResponse

See: addPermissionResponse smart constructor.

Instances

Eq AddPermissionResponse

Methods

(==) :: AddPermissionResponse -> AddPermissionResponse -> Bool

(/=) :: AddPermissionResponse -> AddPermissionResponse -> Bool

Data AddPermissionResponse

Methods

gfoldl :: (forall d b. Data d => c (d -> b) -> d -> c b) -> (forall g. g -> c g) -> AddPermissionResponse -> c AddPermissionResponse

gunfold :: (forall b r. Data b => c (b -> r) -> c r) -> (forall r. r -> c r) -> Constr -> c AddPermissionResponse

toConstr :: AddPermissionResponse -> Constr

dataTypeOf :: AddPermissionResponse -> DataType

dataCast1 :: Typeable (* -> *) t => (forall d. Data d => c (t d)) -> Maybe (c AddPermissionResponse)

dataCast2 :: Typeable (* -> * -> *) t => (forall d e. (Data d, Data e) => c (t d e)) -> Maybe (c AddPermissionResponse)

gmapT :: (forall b. Data b => b -> b) -> AddPermissionResponse -> AddPermissionResponse

gmapQl :: (r -> r' -> r) -> r -> (forall d. Data d => d -> r') -> AddPermissionResponse -> r

gmapQr :: (r' -> r -> r) -> r -> (forall d. Data d => d -> r') -> AddPermissionResponse -> r

gmapQ :: (forall d. Data d => d -> u) -> AddPermissionResponse -> [u]

gmapQi :: Int -> (forall d. Data d => d -> u) -> AddPermissionResponse -> u

gmapM :: Monad m => (forall d. Data d => d -> m d) -> AddPermissionResponse -> m AddPermissionResponse

gmapMp :: MonadPlus m => (forall d. Data d => d -> m d) -> AddPermissionResponse -> m AddPermissionResponse

gmapMo :: MonadPlus m => (forall d. Data d => d -> m d) -> AddPermissionResponse -> m AddPermissionResponse

Read AddPermissionResponse

Methods

readsPrec :: Int -> ReadS AddPermissionResponse

readList :: ReadS [AddPermissionResponse]

readPrec :: ReadPrec AddPermissionResponse

readListPrec :: ReadPrec [AddPermissionResponse]

Show AddPermissionResponse

Methods

showsPrec :: Int -> AddPermissionResponse -> ShowS

show :: AddPermissionResponse -> String

showList :: [AddPermissionResponse] -> ShowS

Generic AddPermissionResponse

Associated Types

type Rep AddPermissionResponse :: * -> *

Methods

from :: AddPermissionResponse -> Rep AddPermissionResponse x

to :: Rep AddPermissionResponse x -> AddPermissionResponse

NFData AddPermissionResponse

Methods

rnf :: AddPermissionResponse -> ()

type Rep AddPermissionResponse

type Rep AddPermissionResponse = D1 (MetaData "AddPermissionResponse" "Network.AWS.Lambda.AddPermission" "amazonka-lambda-1.5.0-L3a8zfumEyl9xoJg9e0UyS" False) (C1 (MetaCons "AddPermissionResponse'" PrefixI True) ((:*:) (S1 (MetaSel (Just Symbol "_aprsStatement") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Text))) (S1 (MetaSel (Just Symbol "_aprsResponseStatus") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Int))))

Response Lenses

aprsStatement :: Lens' AddPermissionResponse (Maybe Text)

The permission statement you specified in the request. The response returns the same as a string using a backslash ("") as an escape character in the JSON.

aprsResponseStatus :: Lens' AddPermissionResponse Int

• - | The response status code.