Found during review of #159.
Alias sets this.functionArn = this.resource.invokeArn (src/aws/compute/function-alias.ts:268). aws_lambda_alias.invoke_arn is the API-Gateway path-style invocation ARN (arn:aws:apigateway:...:lambda:path/2015-03-31/functions/.../invocations), not the alias ARN (aws_lambda_alias.arn).
Any addPermission() targeting an Alias therefore emits that invocation ARN as aws_lambda_permission.function_name, which is not a valid value and fails at terraform apply. This includes the permissions FunctionUrl adds for an alias-qualified public Function URL.
Suggested fix: expose the alias ARN as functionArn (and provide the invoke ARN under a separate property for API Gateway integrations), or have addPermission() resolve the correct ARN/qualifier pair for aliases.
Note: synth-only unit tests pass today because nothing validates the ARN shape — this only surfaces at apply time.
Found during review of #159.
Aliassetsthis.functionArn = this.resource.invokeArn(src/aws/compute/function-alias.ts:268).aws_lambda_alias.invoke_arnis the API-Gateway path-style invocation ARN (arn:aws:apigateway:...:lambda:path/2015-03-31/functions/.../invocations), not the alias ARN (aws_lambda_alias.arn).Any
addPermission()targeting anAliastherefore emits that invocation ARN asaws_lambda_permission.function_name, which is not a valid value and fails atterraform apply. This includes the permissionsFunctionUrladds for an alias-qualified public Function URL.Suggested fix: expose the alias ARN as
functionArn(and provide the invoke ARN under a separate property for API Gateway integrations), or haveaddPermission()resolve the correct ARN/qualifier pair for aliases.Note: synth-only unit tests pass today because nothing validates the ARN shape — this only surfaces at apply time.