From ce1f1e59b56d902f0c83ced77c5ee1c07cf35f1f Mon Sep 17 00:00:00 2001 From: JanSkn Date: Mon, 8 Jun 2026 21:19:09 +0200 Subject: [PATCH 1/9] fix(infra): missing permission to pull images --- infra/template.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/infra/template.yml b/infra/template.yml index 1a72be9..8482c36 100644 --- a/infra/template.yml +++ b/infra/template.yml @@ -354,6 +354,18 @@ Resources: ] } + Statement: + - Sid: AllowLambdaServiceToPullImages + Effect: Allow + Principal: + Service: lambda.amazonaws.com + Action: + - ecr:BatchGetImage + - ecr:GetDownloadUrlForLayer + Condition: + StringLike: + aws:sourceArn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*" + # Execution role assigned to every user-deployed Lambda (app-*). The function-deployer # hardcodes this exact role name (LambdaDeploymentRepository.java: role/UserFunctionRole). # Intentionally minimal: untrusted user code only gets CloudWatch Logs access. @@ -405,6 +417,8 @@ Resources: Effect: Allow Action: - lambda:CreateFunction + - lambda:GetFunction + - lambda:UpdateFunctionCode - lambda:CreateFunctionUrlConfig - lambda:AddPermission Resource: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:app-*" From b3e104fb63fb1baedf73a6c5275c12ff64cb41c0 Mon Sep 17 00:00:00 2001 From: JanSkn Date: Mon, 8 Jun 2026 21:27:21 +0200 Subject: [PATCH 2/9] fix --- infra/template.yml | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/infra/template.yml b/infra/template.yml index 8482c36..e27b84b 100644 --- a/infra/template.yml +++ b/infra/template.yml @@ -354,17 +354,23 @@ Resources: ] } - Statement: - - Sid: AllowLambdaServiceToPullImages - Effect: Allow - Principal: - Service: lambda.amazonaws.com - Action: - - ecr:BatchGetImage - - ecr:GetDownloadUrlForLayer - Condition: - StringLike: - aws:sourceArn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*" + EcrRepositoryPolicy: + Type: AWS::ECR::RepositoryPolicy + Properties: + RepositoryName: !Ref EcrRepository + PolicyDocument: + Version: "2012-10-17" + Statement: + - Sid: AllowLambdaServiceToPullImages + Effect: Allow + Principal: + Service: lambda.amazonaws.com + Action: + - ecr:BatchGetImage + - ecr:GetDownloadUrlForLayer + Condition: + StringLike: + aws:sourceArn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:app-*" # Execution role assigned to every user-deployed Lambda (app-*). The function-deployer # hardcodes this exact role name (LambdaDeploymentRepository.java: role/UserFunctionRole). From d0e1e5fb22f12099e8a672bb25f8d776619e60d0 Mon Sep 17 00:00:00 2001 From: JanSkn Date: Mon, 8 Jun 2026 21:35:16 +0200 Subject: [PATCH 3/9] fix --- infra/template.yml | 31 +++++++++++++------------------ 1 file changed, 13 insertions(+), 18 deletions(-) diff --git a/infra/template.yml b/infra/template.yml index e27b84b..8bb98ee 100644 --- a/infra/template.yml +++ b/infra/template.yml @@ -332,6 +332,19 @@ Resources: Type: AWS::ECR::Repository Properties: RepositoryName: !Ref EcrRepositoryName + RepositoryPolicyText: + Version: "2012-10-17" + Statement: + - Sid: AllowLambdaServiceToPullImages + Effect: Allow + Principal: + Service: lambda.amazonaws.com + Action: + - ecr:BatchGetImage + - ecr:GetDownloadUrlForLayer + Condition: + StringLike: + aws:sourceArn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:app-*" # max. deployments per user handled in backend-api-lambda LifecyclePolicy: # rule would only apply if updated image with same tag @@ -354,24 +367,6 @@ Resources: ] } - EcrRepositoryPolicy: - Type: AWS::ECR::RepositoryPolicy - Properties: - RepositoryName: !Ref EcrRepository - PolicyDocument: - Version: "2012-10-17" - Statement: - - Sid: AllowLambdaServiceToPullImages - Effect: Allow - Principal: - Service: lambda.amazonaws.com - Action: - - ecr:BatchGetImage - - ecr:GetDownloadUrlForLayer - Condition: - StringLike: - aws:sourceArn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:app-*" - # Execution role assigned to every user-deployed Lambda (app-*). The function-deployer # hardcodes this exact role name (LambdaDeploymentRepository.java: role/UserFunctionRole). # Intentionally minimal: untrusted user code only gets CloudWatch Logs access. From 9d53dae7217d85ced69b26cdc94daee853a2f30a Mon Sep 17 00:00:00 2001 From: JanSkn Date: Tue, 9 Jun 2026 13:34:28 +0200 Subject: [PATCH 4/9] test: error linting --- infra/template.yml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/infra/template.yml b/infra/template.yml index 8bb98ee..0c2ef86 100644 --- a/infra/template.yml +++ b/infra/template.yml @@ -332,19 +332,19 @@ Resources: Type: AWS::ECR::Repository Properties: RepositoryName: !Ref EcrRepositoryName - RepositoryPolicyText: - Version: "2012-10-17" - Statement: - - Sid: AllowLambdaServiceToPullImages - Effect: Allow - Principal: - Service: lambda.amazonaws.com - Action: - - ecr:BatchGetImage - - ecr:GetDownloadUrlForLayer - Condition: - StringLike: - aws:sourceArn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:app-*" + # RepositoryPolicyText: + # Version: "2012-10-17" + # Statement: + # - Sid: AllowLambdaServiceToPullImages + # Effect: Allow + # Principal: + # Service: lambda.amazonaws.com + # Action: + # - ecr:BatchGetImage + # - ecr:GetDownloadUrlForLayer + # Condition: + # StringLike: + # aws:sourceArn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:app-*" # max. deployments per user handled in backend-api-lambda LifecyclePolicy: # rule would only apply if updated image with same tag From 72b87f6ae8b4d0b65583b0dd4a29ab20db3b7cdf Mon Sep 17 00:00:00 2001 From: JanSkn Date: Tue, 9 Jun 2026 13:41:48 +0200 Subject: [PATCH 5/9] fix: delete block --- infra/template.yml | 38 +++++++++++++------------------------- 1 file changed, 13 insertions(+), 25 deletions(-) diff --git a/infra/template.yml b/infra/template.yml index 9f31772..8bb98ee 100644 --- a/infra/template.yml +++ b/infra/template.yml @@ -332,19 +332,19 @@ Resources: Type: AWS::ECR::Repository Properties: RepositoryName: !Ref EcrRepositoryName - # RepositoryPolicyText: - # Version: "2012-10-17" - # Statement: - # - Sid: AllowLambdaServiceToPullImages - # Effect: Allow - # Principal: - # Service: lambda.amazonaws.com - # Action: - # - ecr:BatchGetImage - # - ecr:GetDownloadUrlForLayer - # Condition: - # StringLike: - # aws:sourceArn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:app-*" + RepositoryPolicyText: + Version: "2012-10-17" + Statement: + - Sid: AllowLambdaServiceToPullImages + Effect: Allow + Principal: + Service: lambda.amazonaws.com + Action: + - ecr:BatchGetImage + - ecr:GetDownloadUrlForLayer + Condition: + StringLike: + aws:sourceArn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:app-*" # max. deployments per user handled in backend-api-lambda LifecyclePolicy: # rule would only apply if updated image with same tag @@ -367,18 +367,6 @@ Resources: ] } - Statement: - - Sid: AllowLambdaServiceToPullImages - Effect: Allow - Principal: - Service: lambda.amazonaws.com - Action: - - ecr:BatchGetImage - - ecr:GetDownloadUrlForLayer - Condition: - StringLike: - aws:sourceArn: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*" - # Execution role assigned to every user-deployed Lambda (app-*). The function-deployer # hardcodes this exact role name (LambdaDeploymentRepository.java: role/UserFunctionRole). # Intentionally minimal: untrusted user code only gets CloudWatch Logs access. From 10bd95a4a5b6a47e84083729890047025ed80480 Mon Sep 17 00:00:00 2001 From: JanSkn Date: Tue, 9 Jun 2026 14:50:55 +0200 Subject: [PATCH 6/9] fix: architecture --- infra/template.yml | 6 ++++-- .../java/com/hosting/common/config/UserLambdaConfig.java | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/infra/template.yml b/infra/template.yml index 8bb98ee..976bafe 100644 --- a/infra/template.yml +++ b/infra/template.yml @@ -311,9 +311,9 @@ Resources: Artifacts: Type: NO_ARTIFACTS Environment: - Type: LINUX_CONTAINER + Type: LINUX_ARM_CONTAINER # architecture should match the architecture in UserLambdaConfig ComputeType: BUILD_GENERAL1_SMALL - Image: "aws/codebuild/amazonlinux2-x86_64-standard:5.0" + Image: "aws/codebuild/amazonlinux2-aarch64-standard:3.0" # architecture should match the architecture in UserLambdaConfig PrivilegedMode: true # required für Docker builds Source: # override in CodeBuildRepository to specific user code, but mandatory field Type: NO_SOURCE @@ -370,6 +370,8 @@ Resources: # Execution role assigned to every user-deployed Lambda (app-*). The function-deployer # hardcodes this exact role name (LambdaDeploymentRepository.java: role/UserFunctionRole). # Intentionally minimal: untrusted user code only gets CloudWatch Logs access. + + # TODO: retention period for user function logs/no logs at all? UserFunctionRole: Type: AWS::IAM::Role Properties: diff --git a/lambda/common-utils/src/main/java/com/hosting/common/config/UserLambdaConfig.java b/lambda/common-utils/src/main/java/com/hosting/common/config/UserLambdaConfig.java index ce3f2f9..78e378f 100644 --- a/lambda/common-utils/src/main/java/com/hosting/common/config/UserLambdaConfig.java +++ b/lambda/common-utils/src/main/java/com/hosting/common/config/UserLambdaConfig.java @@ -10,7 +10,7 @@ private UserLambdaConfig() { } public static final PackageType PACKAGE_TYPE = PackageType.IMAGE; - public static final Architecture ARCHITECTURE = Architecture.ARM64; + public static final Architecture ARCHITECTURE = Architecture.ARM64; // architecture should match the codebuild architecture in the template.yml public static final int TIMEOUT_SECONDS = 30; public static final int MEMORY_SIZE_MB = 128; } From b4fdefd1bdaed2a32c58dab54028189ed736ac11 Mon Sep 17 00:00:00 2001 From: JanSkn Date: Tue, 9 Jun 2026 14:52:19 +0200 Subject: [PATCH 7/9] fix: linting --- .../main/java/com/hosting/common/config/UserLambdaConfig.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lambda/common-utils/src/main/java/com/hosting/common/config/UserLambdaConfig.java b/lambda/common-utils/src/main/java/com/hosting/common/config/UserLambdaConfig.java index 78e378f..2fdd34e 100644 --- a/lambda/common-utils/src/main/java/com/hosting/common/config/UserLambdaConfig.java +++ b/lambda/common-utils/src/main/java/com/hosting/common/config/UserLambdaConfig.java @@ -10,7 +10,8 @@ private UserLambdaConfig() { } public static final PackageType PACKAGE_TYPE = PackageType.IMAGE; - public static final Architecture ARCHITECTURE = Architecture.ARM64; // architecture should match the codebuild architecture in the template.yml + // architecture should match the codebuild architecture in the template.yml + public static final Architecture ARCHITECTURE = Architecture.ARM64; public static final int TIMEOUT_SECONDS = 30; public static final int MEMORY_SIZE_MB = 128; } From 87bea023341467fcea0def5feaf459bf9743d7cc Mon Sep 17 00:00:00 2001 From: JanSkn Date: Tue, 9 Jun 2026 15:01:24 +0200 Subject: [PATCH 8/9] fix --- infra/template.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/infra/template.yml b/infra/template.yml index 976bafe..0462fcd 100644 --- a/infra/template.yml +++ b/infra/template.yml @@ -311,10 +311,11 @@ Resources: Artifacts: Type: NO_ARTIFACTS Environment: - Type: LINUX_ARM_CONTAINER # architecture should match the architecture in UserLambdaConfig + # architecture should match the architecture in UserLambdaConfig + Type: LINUX_ARM_CONTAINER ComputeType: BUILD_GENERAL1_SMALL - Image: "aws/codebuild/amazonlinux2-aarch64-standard:3.0" # architecture should match the architecture in UserLambdaConfig - PrivilegedMode: true # required für Docker builds + Image: "aws/codebuild/amazonlinux-aarch64-standard:2.0" + PrivilegedMode: true # required for Docker builds Source: # override in CodeBuildRepository to specific user code, but mandatory field Type: NO_SOURCE BuildSpec: | From 117aafe20dc97c00b6050fd71ce5af65db765d61 Mon Sep 17 00:00:00 2001 From: JanSkn Date: Tue, 9 Jun 2026 15:11:46 +0200 Subject: [PATCH 9/9] fix --- infra/template.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/template.yml b/infra/template.yml index 0462fcd..b9bb6d5 100644 --- a/infra/template.yml +++ b/infra/template.yml @@ -312,7 +312,7 @@ Resources: Type: NO_ARTIFACTS Environment: # architecture should match the architecture in UserLambdaConfig - Type: LINUX_ARM_CONTAINER + Type: ARM_CONTAINER ComputeType: BUILD_GENERAL1_SMALL Image: "aws/codebuild/amazonlinux-aarch64-standard:2.0" PrivilegedMode: true # required for Docker builds