Skip to content

feat(aws): expose L2 refs for Lambda alias + S3 server-access-log integrations#1102

Merged
despock merged 3 commits into
mainfrom
feat/expose-l2-for-grant-attachment
Jun 16, 2026
Merged

feat(aws): expose L2 refs for Lambda alias + S3 server-access-log integrations#1102
despock merged 3 commits into
mainfrom
feat/expose-l2-for-grant-attachment

Conversation

@despock

@despock despock commented Jun 16, 2026

Copy link
Copy Markdown
Member

Summary

  • createLambdaFunction now stashes the created Alias instances on the returned Function under .lambdaAliases (keyed by aliasName), exposed via a new FunctionWithAliases type. Lets downstream constructs (e.g. LambdaIntegration) consume the alias L2 directly instead of re-importing by ARN — which triggered UnclearLambdaEnvironment warnings and silently dropped addPermission() invokes when CDK couldn't prove same-env.
  • S3BucketProps accepts an optional logBucket?: IBucket alongside the existing logBucketName?: string. When the caller owns the log destination (created in the same stack), passing the L2 lets CDK attach the log-delivery BucketPolicy directly — clearing the accessLogsPolicyNotAdded warning and removing an unnecessary Bucket.fromBucketName import. logBucketName remains supported for genuine cross-stack imports where only the destination name is known.
  • StaticSite.createSiteBucket now passes the just-created siteLogBucket L2 down to the source-bucket creation so consumers get the wiring fix without any code changes on their side.

Notes

  • logBucket takes precedence over logBucketName when both are set.
  • Backwards-compatible: existing callers using logBucketName or no log bucket at all see no behavioral change.
  • The FunctionWithAliases type widens createLambdaFunction's return; existing assignment to Function keeps working via structural compatibility.

Changeset included.

despock added 3 commits June 16, 2026 16:05
createLambdaFunction now stashes any aliases it created on the returned
function instance under .lambdaAliases, keyed by aliasName. The new
FunctionWithAliases type makes this discoverable.

Downstream constructs that previously had to import the alias by ARN
via Function.fromFunctionArn (which triggers UnclearLambdaEnvironment
and silently drops addPermission() invokes) can now consume the real
Alias L2 directly, e.g. for LambdaIntegration.
S3BucketProps gains an optional logBucket?: IBucket field alongside the
existing logBucketName?: string. When the caller already owns the log
destination (created in the same stack), passing the L2 lets CDK attach
the log-delivery BucketPolicy directly — clearing the
accessLogsPolicyNotAdded warning and eliminating an unnecessary
Bucket.fromBucketName import.

StaticSite is updated to pass its just-created siteLogBucket through
so consumers get this for free. logBucketName remains supported for
genuine cross-stack imports where only the destination name is known.
@despock despock merged commit 8b9134a into main Jun 16, 2026
8 checks passed
@despock despock deleted the feat/expose-l2-for-grant-attachment branch June 16, 2026 15:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant