@adobe/helix-deploy 13.3.2 → 13.4.0

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+# [13.4.0](https://github.com/adobe/helix-deploy/compare/v13.3.3...v13.4.0) (2026-03-09)
+
+
+### Features
+
+* add VPC subnet and security group properties to AWSConfig ([#897](https://github.com/adobe/helix-deploy/issues/897)) ([15cd4fe](https://github.com/adobe/helix-deploy/commit/15cd4feb74b1a9b9e238c6a821d342bf2a1db8d4))
+* add VpcConfig to functionConfig and cross-field validation ([#897](https://github.com/adobe/helix-deploy/issues/897)) ([54599c7](https://github.com/adobe/helix-deploy/commit/54599c7b88a2ddf5898a33227c4cd9ee43a528fc))
+
+## [13.3.3](https://github.com/adobe/helix-deploy/compare/v13.3.2...v13.3.3) (2026-03-05)
+
+
+### Bug Fixes
+
+* README update for aws-ephemeral-storage option ([#894](https://github.com/adobe/helix-deploy/issues/894)) ([8b11fa9](https://github.com/adobe/helix-deploy/commit/8b11fa94c16aeae9b9be1ce62fd0b2bbba91063d))
+
 ## [13.3.2](https://github.com/adobe/helix-deploy/compare/v13.3.1...v13.3.2) (2026-03-03)
 
 

package/README.md

@@ -145,6 +145,9 @@ AWS Deployment Options
       --aws-extra-permissions     A list of additional invoke permissions to add to the lambda function in the form <SourceARN>@<Principal>. Optionally, you can use <SourceARN>@<Principal>:<Alias> if you want to scope the permission to a specific alias.  [array]
       --aws-tags                  A list of additional tags to attach to the lambda function in the form key=value. To remove a tag, use key= (i.e. without a value).  [array]
       --aws-handler               Set custom lambda Handler. For example, set if an AWS layer provides another function entry point.  [string]
+      --aws-ephemeral-storage     Size of the Lambda /tmp ephemeral storage in MB (512-10240).  [number] [default: 512]
+      --aws-vpc-subnet-ids          List of VPC subnet IDs to attach the Lambda function to.  [array]
+      --aws-vpc-security-group-ids  List of VPC security group IDs to attach the Lambda function to.  [array]
 
 Google Deployment Options
       --google-project-id  the Google Cloud project to deploy to. Optional when the key file is a JSON file  [string] [default: ""]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-deploy",
-  "version": "13.3.2",
+  "version": "13.4.0",
   "description": "Library and Commandline Tools to build and deploy OpenWhisk Actions",
   "license": "Apache-2.0",
   "homepage": "https://github.com/adobe/helix-deploy#readme",

package/src/deploy/AWSConfig.js

@@ -13,6 +13,29 @@
 // eslint-disable-next-line no-template-curly-in-string
 const DEFAULT_LAMBDA_FORMAT = '${packageName}--${baseName}';
 
+// VPC IDs are validated more strictly than other array options (e.g. --aws-layers)
+// because VPC misconfiguration silently breaks Lambda networking with no obvious
+// symptoms, and ${env.VAR} substitution failures are a common CI footgun.
+function validateVpcIds(value, flagName, prefix) {
+  if (!Array.isArray(value)) {
+    throw new Error(`${flagName} must be an array`);
+  }
+  for (const id of value) {
+    if (typeof id !== 'string') {
+      throw new Error(`${flagName} contains a non-string element: ${JSON.stringify(id)}`);
+    }
+    if (id === '') {
+      throw new Error(`${flagName} contains an empty string - check that the corresponding environment variable is set`);
+    }
+    if (/\$\{env\./.test(id)) {
+      throw new Error(`${flagName} contains an unresolved \${env.} reference: "${id}"`);
+    }
+    if (!id.startsWith(prefix)) {
+      throw new Error(`invalid ${flagName} entry "${id}" - must start with "${prefix}"`);
+    }
+  }
+}
+
 export default class AWSConfig {
   constructor() {
     Object.assign(this, {
@@ -38,6 +61,8 @@ export default class AWSConfig {
       tags: undefined,
       handler: undefined,
       ephemeralStorage: undefined,
+      vpcSubnetIds: undefined,
+      vpcSecurityGroupIds: undefined,
     });
   }
 
@@ -64,7 +89,9 @@ export default class AWSConfig {
       .withAWSExtraPermissions(argv.awsExtraPermissions)
       .withAWSTags(argv.awsTags)
       .withAWSHandler(argv.awsHandler)
-      .withAWSEphemeralStorage(argv.awsEphemeralStorage);
+      .withAWSEphemeralStorage(argv.awsEphemeralStorage)
+      .withAWSVpcSubnetIds(argv.awsVpcSubnetIds)
+      .withAWSVpcSecurityGroupIds(argv.awsVpcSecurityGroupIds);
   }
 
   withAWSRegion(value) {
@@ -189,6 +216,22 @@ export default class AWSConfig {
     return this;
   }
 
+  withAWSVpcSubnetIds(value) {
+    if (value !== undefined) {
+      validateVpcIds(value, 'aws-vpc-subnet-ids', 'subnet-');
+      this.vpcSubnetIds = value;
+    }
+    return this;
+  }
+
+  withAWSVpcSecurityGroupIds(value) {
+    if (value !== undefined) {
+      validateVpcIds(value, 'aws-vpc-security-group-ids', 'sg-');
+      this.vpcSecurityGroupIds = value;
+    }
+    return this;
+  }
+
   static yarg(yargs) {
     return yargs
       .group(['aws-region', 'aws-api', 'aws-role', 'aws-cleanup-buckets', 'aws-cleanup-integrations',
@@ -196,7 +239,7 @@ export default class AWSConfig {
         'aws-lambda-format', 'aws-parameter-manager', 'aws-deploy-template', 'aws-arch', 'aws-update-secrets',
         'aws-deploy-bucket', 'aws-identity-source', 'aws-log-format', 'aws-layers',
         'aws-tracing-mode', 'aws-extra-permissions', 'aws-tags', 'aws-handler',
-        'aws-ephemeral-storage'], 'AWS Deployment Options')
+        'aws-ephemeral-storage', 'aws-vpc-subnet-ids', 'aws-vpc-security-group-ids'], 'AWS Deployment Options')
       .option('aws-region', {
         description: 'the AWS region to deploy lambda functions to',
         type: 'string',
@@ -304,6 +347,16 @@ export default class AWSConfig {
       .option('aws-ephemeral-storage', {
         description: 'Size of the Lambda /tmp ephemeral storage in MB (512-10240). Default is 512 MB.',
         type: 'number',
+      })
+      .option('aws-vpc-subnet-ids', {
+        description: 'List of VPC subnet IDs to attach the Lambda function to.',
+        type: 'string',
+        array: true,
+      })
+      .option('aws-vpc-security-group-ids', {
+        description: 'List of VPC security group IDs to attach the Lambda function to.',
+        type: 'string',
+        array: true,
       });
   }
 }

package/src/deploy/AWSDeployer.js

@@ -150,6 +150,12 @@ export default class AWSDeployer extends BaseDeployer {
     if (req.length) {
       throw Error(`AWS target needs ${req.join(' and ')}`);
     }
+    if (this._cfg.vpcSubnetIds !== undefined && this._cfg.vpcSecurityGroupIds === undefined) {
+      throw Error('--aws-vpc-security-group-ids is required when --aws-vpc-subnet-ids is set');
+    }
+    if (this._cfg.vpcSecurityGroupIds !== undefined && this._cfg.vpcSubnetIds === undefined) {
+      throw Error('--aws-vpc-subnet-ids is required when --aws-vpc-security-group-ids is set');
+    }
   }
 
   async init() {
@@ -255,6 +261,13 @@ export default class AWSDeployer extends BaseDeployer {
       TracingConfig: this._cfg.tracingMode ? { Mode: this._cfg.tracingMode } : undefined,
       EphemeralStorage: this._cfg.ephemeralStorage
         ? { Size: this._cfg.ephemeralStorage } : undefined,
+      // uses strict !== undefined (not falsy check) because [] is a valid value (VPC detach)
+      VpcConfig: this._cfg.vpcSubnetIds !== undefined && this._cfg.vpcSecurityGroupIds !== undefined
+        ? {
+          SubnetIds: this._cfg.vpcSubnetIds,
+          SecurityGroupIds: this._cfg.vpcSecurityGroupIds,
+        }
+        : undefined,
     };
 
     // add additional tags which are not empty
@@ -275,6 +288,12 @@ export default class AWSDeployer extends BaseDeployer {
 
     this.log.info(`--: using lambda role "${this._cfg.role}"`);
 
+    if (Array.isArray(this._cfg.vpcSubnetIds) && this._cfg.vpcSubnetIds.length === 0) {
+      this.log.warn(chalk`{yellow warn:} VPC detach requested - Lambda will lose VPC network access`);
+    } else if (this._cfg.vpcSubnetIds?.length) {
+      this.log.info(chalk`--: VPC config set - ensure Lambda role has {yellow ec2:CreateNetworkInterface}, {yellow ec2:DescribeNetworkInterfaces}, {yellow ec2:DeleteNetworkInterface} permissions`);
+    }
+
     // check if function already exists
     let baseARN;
     try {