libZSservicesZSamazonka-lambdaZSamazonka-lambda
Copyright(c) 2013-2021 Brendan Hay
LicenseMozilla Public License, v. 2.0.
MaintainerBrendan Hay <brendan.g.hay+amazonka@gmail.com>
Stabilityauto-generated
Portabilitynon-portable (GHC extensions)
Safe HaskellNone

Amazonka.Lambda.AddPermission

Description

Grants an Amazon Web Services service or another account permission to use a function. You can apply the policy at the function level, or specify a qualifier to restrict access to a single version or alias. If you use a qualifier, the invoker must use the full Amazon Resource Name (ARN) of that version or alias to invoke the function. Note: Lambda does not support adding policies to version $LATEST.

To grant permission to another account, specify the account ID as the Principal. For Amazon Web Services services, the principal is a domain-style identifier defined by the service, like s3.amazonaws.com or sns.amazonaws.com. For Amazon Web Services services, you can also specify the ARN of the associated resource as the SourceArn. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function.

This action adds a statement to a resource-based permissions policy for the function. For more information about function policies, see Lambda Function Policies.

Synopsis

Creating a Request

data AddPermission Source #

See: newAddPermission smart constructor.

Constructors

AddPermission' 

Fields

  • sourceAccount :: Maybe Text

    For Amazon S3, the ID of the account that owns the resource. Use this together with SourceArn to ensure that the resource is owned by the specified account. It is possible for an Amazon S3 bucket to be deleted by its owner and recreated by another account.

  • eventSourceToken :: Maybe Text

    For Alexa Smart Home functions, a token that must be supplied by the invoker.

  • sourceArn :: Maybe Text

    For Amazon Web Services services, the ARN of the Amazon Web Services resource that invokes the function. For example, an Amazon S3 bucket or Amazon SNS topic.

    Note that Lambda configures the comparison using the StringLike operator.

  • qualifier :: Maybe Text

    Specify a version or alias to add permissions to a published version of the function.

  • revisionId :: Maybe Text

    Only update the policy if the revision ID matches the ID that's specified. Use this option to avoid modifying a policy that has changed since you last read it.

  • functionName :: Text

    The name of the Lambda function, version, or alias.

    Name formats

    • Function name - my-function (name-only), my-function:v1 (with alias).
    • Function ARN - arn:aws:lambda:us-west-2:123456789012:function:my-function.
    • Partial ARN - 123456789012:function:my-function.

    You can append a version number or alias to any of the formats. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.

  • statementId :: Text

    A statement identifier that differentiates the statement from others in the same policy.

  • action :: Text

    The action that the principal can use on the function. For example, lambda:InvokeFunction or lambda:GetFunction.

  • principal :: Text

    The Amazon Web Services service or account that invokes the function. If you specify a service, use SourceArn or SourceAccount to limit who can invoke the function through that service.

Instances

Instances details
Eq AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Read AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Show AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Generic AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Associated Types

type Rep AddPermission :: Type -> Type #

NFData AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Methods

rnf :: AddPermission -> () #

Hashable AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

ToJSON AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

AWSRequest AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Associated Types

type AWSResponse AddPermission #

ToHeaders AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

ToPath AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

ToQuery AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

type Rep AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

type AWSResponse AddPermission Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

newAddPermission Source #

Create a value of AddPermission with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:sourceAccount:AddPermission', addPermission_sourceAccount - For Amazon S3, the ID of the account that owns the resource. Use this together with SourceArn to ensure that the resource is owned by the specified account. It is possible for an Amazon S3 bucket to be deleted by its owner and recreated by another account.

$sel:eventSourceToken:AddPermission', addPermission_eventSourceToken - For Alexa Smart Home functions, a token that must be supplied by the invoker.

$sel:sourceArn:AddPermission', addPermission_sourceArn - For Amazon Web Services services, the ARN of the Amazon Web Services resource that invokes the function. For example, an Amazon S3 bucket or Amazon SNS topic.

Note that Lambda configures the comparison using the StringLike operator.

$sel:qualifier:AddPermission', addPermission_qualifier - Specify a version or alias to add permissions to a published version of the function.

$sel:revisionId:AddPermission', addPermission_revisionId - Only update the policy if the revision ID matches the ID that's specified. Use this option to avoid modifying a policy that has changed since you last read it.

$sel:functionName:AddPermission', addPermission_functionName - The name of the Lambda function, version, or alias.

Name formats

  • Function name - my-function (name-only), my-function:v1 (with alias).
  • Function ARN - arn:aws:lambda:us-west-2:123456789012:function:my-function.
  • Partial ARN - 123456789012:function:my-function.

You can append a version number or alias to any of the formats. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.

$sel:statementId:AddPermission', addPermission_statementId - A statement identifier that differentiates the statement from others in the same policy.

$sel:action:AddPermission', addPermission_action - The action that the principal can use on the function. For example, lambda:InvokeFunction or lambda:GetFunction.

$sel:principal:AddPermission', addPermission_principal - The Amazon Web Services service or account that invokes the function. If you specify a service, use SourceArn or SourceAccount to limit who can invoke the function through that service.

Request Lenses

addPermission_sourceAccount :: Lens' AddPermission (Maybe Text) Source #

For Amazon S3, the ID of the account that owns the resource. Use this together with SourceArn to ensure that the resource is owned by the specified account. It is possible for an Amazon S3 bucket to be deleted by its owner and recreated by another account.

addPermission_eventSourceToken :: Lens' AddPermission (Maybe Text) Source #

For Alexa Smart Home functions, a token that must be supplied by the invoker.

addPermission_sourceArn :: Lens' AddPermission (Maybe Text) Source #

For Amazon Web Services services, the ARN of the Amazon Web Services resource that invokes the function. For example, an Amazon S3 bucket or Amazon SNS topic.

Note that Lambda configures the comparison using the StringLike operator.

addPermission_qualifier :: Lens' AddPermission (Maybe Text) Source #

Specify a version or alias to add permissions to a published version of the function.

addPermission_revisionId :: Lens' AddPermission (Maybe Text) Source #

Only update the policy if the revision ID matches the ID that's specified. Use this option to avoid modifying a policy that has changed since you last read it.

addPermission_functionName :: Lens' AddPermission Text Source #

The name of the Lambda function, version, or alias.

Name formats

  • Function name - my-function (name-only), my-function:v1 (with alias).
  • Function ARN - arn:aws:lambda:us-west-2:123456789012:function:my-function.
  • Partial ARN - 123456789012:function:my-function.

You can append a version number or alias to any of the formats. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.

addPermission_statementId :: Lens' AddPermission Text Source #

A statement identifier that differentiates the statement from others in the same policy.

addPermission_action :: Lens' AddPermission Text Source #

The action that the principal can use on the function. For example, lambda:InvokeFunction or lambda:GetFunction.

addPermission_principal :: Lens' AddPermission Text Source #

The Amazon Web Services service or account that invokes the function. If you specify a service, use SourceArn or SourceAccount to limit who can invoke the function through that service.

Destructuring the Response

data AddPermissionResponse Source #

See: newAddPermissionResponse smart constructor.

Constructors

AddPermissionResponse' 

Fields

Instances

Instances details
Eq AddPermissionResponse Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Read AddPermissionResponse Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Show AddPermissionResponse Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Generic AddPermissionResponse Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Associated Types

type Rep AddPermissionResponse :: Type -> Type #

NFData AddPermissionResponse Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

Methods

rnf :: AddPermissionResponse -> () #

type Rep AddPermissionResponse Source # 
Instance details

Defined in Amazonka.Lambda.AddPermission

type Rep AddPermissionResponse = D1 ('MetaData "AddPermissionResponse" "Amazonka.Lambda.AddPermission" "libZSservicesZSamazonka-lambdaZSamazonka-lambda" 'False) (C1 ('MetaCons "AddPermissionResponse'" 'PrefixI 'True) (S1 ('MetaSel ('Just "statement") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "httpStatus") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Int)))

newAddPermissionResponse Source #

Create a value of AddPermissionResponse with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:statement:AddPermissionResponse', addPermissionResponse_statement - The permission statement that's added to the function policy.

$sel:httpStatus:AddPermissionResponse', addPermissionResponse_httpStatus - The response's http status code.

Response Lenses

addPermissionResponse_statement :: Lens' AddPermissionResponse (Maybe Text) Source #

The permission statement that's added to the function policy.