fix(deployment): add missing policy (#36)

Author: JanSkn

infra/template.yml

@@ -368,8 +368,7 @@ Resources:
             ]
           }
 
-  # Execution role assigned to every user-deployed Lambda (app-*). The function-deployer
-  # hardcodes this exact role name (LambdaDeploymentRepository.java: role/UserFunctionRole).
+  # Execution role assigned to every user-deployed Lambda (app-*).
   # Intentionally minimal: untrusted user code only gets CloudWatch Logs access.
   #
   # Log retention/cleanup for these functions is handled by the function-deployer at runtime
@@ -379,7 +378,6 @@ Resources:
   UserFunctionRole:
     Type: AWS::IAM::Role
     Properties:
-      RoleName: UserFunctionRole # name is hardcoded in LambdaDeploymentRepository.java
       AssumeRolePolicyDocument:
         Version: '2012-10-17'
         Statement:
@@ -417,6 +415,7 @@ Resources:
             LAMBDA_ENVIRONMENT: "FUNCTION_DEPLOYER_LAMBDA"
             ECR_REPOSITORY_URI: !Sub "${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/${EcrRepositoryName}"
             DEPLOYMENTS_METADATA_TABLE: !Ref DeploymentsMetadataTable
+            FUNCTION_URL_USER_ROLE_ARN: !GetAtt UserFunctionRole.Arn
       Policies:
         # create the user's Lambda from the ECR image and expose it via a public Function URL
         - Statement:

lambda/common-utils/src/main/java/com/hosting/common/aws/repositories/LambdaDeploymentRepository.java

@@ -39,9 +39,8 @@ private String getLogGroupName(String functionName) {
     return "/aws/lambda/" + functionName;
   }
 
-  public void createFunction(String deploymentId, String imageUri, String accountId) {
-    // role name must match the one in template.yml
-    String roleArn = String.format("arn:aws:iam::%s:role/UserFunctionRole", accountId);
+  public void createFunction(String deploymentId, String imageUri) {
+    String roleArn = UserLambdaConfig.FUNCTION_URL_ROLE_ARN;
     String functionName = getFunctionName(deploymentId);
 
     // Pre-create the log group. Otherwise Lambda auto-creates it on first
@@ -81,6 +80,7 @@ public String setupFunctionUrl(String deploymentId) {
 
       LOGGER.info("Created new Function URL: {}", url);
 
+      // see https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html; both permissions required
       lambdaClient.addPermission(
           AddPermissionRequest.builder()
               .functionName(functionName)
@@ -90,6 +90,15 @@ public String setupFunctionUrl(String deploymentId) {
               .functionUrlAuthType(FunctionUrlAuthType.NONE)
               .build());
       LOGGER.info("Added public access permission to Function URL for {}", functionName);
+      lambdaClient.addPermission(
+          AddPermissionRequest.builder()
+              .functionName(functionName)
+              .statementId("PublicFunctionInvokeAccess")
+              .action("lambda:InvokeFunction")
+              .principal("*")
+              .functionUrlAuthType(FunctionUrlAuthType.NONE)
+              .build());
+      LOGGER.info("Added public invoke permission to Function for {}", functionName);
 
       return url;
     } catch (Exception e) {

lambda/common-utils/src/main/java/com/hosting/common/config/UserLambdaConfig.java

@@ -3,7 +3,7 @@
 import software.amazon.awssdk.services.lambda.model.Architecture;
 import software.amazon.awssdk.services.lambda.model.PackageType;
 
-public final class UserLambdaConfig {
+public final class UserLambdaConfig extends BaseConfig {
 
   private UserLambdaConfig() {
     throw new UnsupportedOperationException("This is a utility class and cannot be instantiated");
@@ -12,6 +12,7 @@ private UserLambdaConfig() {
   public static final PackageType PACKAGE_TYPE = PackageType.IMAGE;
   // architecture should match the codebuild architecture in the template.yml
   public static final Architecture ARCHITECTURE = Architecture.ARM64;
-  public static final int TIMEOUT_SECONDS = 30;
+  public static final int TIMEOUT_SECONDS = 5; // short for user code
   public static final int MEMORY_SIZE_MB = 128;
+  public static final String FUNCTION_URL_ROLE_ARN = getOrThrow("FUNCTION_URL_USER_ROLE_ARN");
 }

lambda/function-deployer-lambda/src/main/java/com/hosting/deployer/handler/FunctionDeployerHandler.java

@@ -57,8 +57,7 @@ public Void handleRequest(Map<String, Object> event, Context context) {
 
       LOGGER.info("Processing CodeBuild SUCCEEDED event");
 
-      String accountId = context.getInvokedFunctionArn().split(":")[4];
-      deploymentManagerService.deploy(userId, deploymentId, imageTag, accountId);
+      deploymentManagerService.deploy(userId, deploymentId, imageTag);
 
     } catch (Exception e) {
       LOGGER.error("Failed to process deployment event", e);

lambda/function-deployer-lambda/src/main/java/com/hosting/deployer/service/DeploymentManagerService.java

@@ -18,13 +18,13 @@ public DeploymentManagerService(
     this.deploymentService = deploymentService;
   }
 
-  public void deploy(String userId, String deploymentId, String imageTag, String accountId) {
+  public void deploy(String userId, String deploymentId, String imageTag) {
     LOGGER.info("Starting API deployment");
 
     String repositoryUri = EcrConfig.REPOSITORY_URI;
     String imageUri = repositoryUri + ":" + imageTag;
 
-    lambdaRepository.createFunction(deploymentId, imageUri, accountId);
+    lambdaRepository.createFunction(deploymentId, imageUri);
     String functionUrl = lambdaRepository.setupFunctionUrl(deploymentId);
 
     deploymentService.setApiUri(userId, deploymentId, functionUrl);

web/src/docs/documentation.md

@@ -43,7 +43,7 @@ app.listen(port, () => console.log(`Server running on port ${port}`));
 
 ### Python Setup
 
-1. Your dependency file (**`requirements.txt`** or **`pyproject.toml`**) must be in the **root directory**.
+1. Your dependency file (**`requirements.txt`** or **`pyproject.toml`**) must be in the **root directory**. Note that `uvicorn` as an ASGI server is a required dependency.
 2. Your main application file must be named **`main.py`** and located in the root directory.
 3. Inside `main.py`, your FastAPI instance variable must be named **`app`**.
 
@@ -65,7 +65,7 @@ def read_root():
 
 You can define custom environment variables directly in your project's deployment settings on the APIForge dashboard.
 
-* All variables are encrypted at rest and injected into your runtime environment automatically.
+* Secret variables are encrypted at rest and injected into your runtime environment automatically. Note that they will not be rotated
 * **Never** commit secrets, passwords, or `.env` files to your repository.
 * **Note for Node.js:** The `PORT` variable is reserved by the platform and automatically managed for you.
 
@@ -75,6 +75,6 @@ You can define custom environment variables directly in your project's deploymen
 
 | Resource | Limit | Description |
 | --- | --- | --- |
-| Request Timeout | 30 seconds | Maximum time your API has to respond to an incoming request. |
+| Request Timeout | 5 seconds | Maximum time your API has to respond to an incoming request. |
 | Payload Size | 6 MB | Maximum size for incoming HTTP request bodies and responses. |
 | Concurrency | 1,000 | Maximum number of simultaneous requests handled before throttling. |