@ashishpandeyone/cdk-lambda-web-function 0.1.10 → 0.1.11

package/API.md

@@ -63,6 +63,7 @@ new NodejsWebFunction(scope: Construct, id: string, props: NodejsWebFunctionProp
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addEnvironment">addEnvironment</a></code> | Adds an environment variable. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addPermission">addPermission</a></code> | Allows a principal in another account, an AWS service or an organization to call the function's endpoints, through the function's resource policy. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToRolePolicy">addToRolePolicy</a></code> | Adds a statement to the execution role's policy. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.encryptionKeyPolicyStatement">encryptionKeyPolicyStatement</a></code> | The key-policy statement Lambda needs to start this function's environments with `encryptionKey`: `kms:Decrypt` for `lambda.amazonaws.com`, limited to this function's revisions (`aws:SourceArn` and the encryption context Lambda sets). |
 
 ---
 
@@ -351,6 +352,17 @@ Adds a statement to the execution role's policy.
 
 ---
 
+##### `encryptionKeyPolicyStatement` <a name="encryptionKeyPolicyStatement" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.encryptionKeyPolicyStatement"></a>
+
+```typescript
+public encryptionKeyPolicyStatement(): PolicyStatement
+```
+
+The key-policy statement Lambda needs to start this function's environments with `encryptionKey`: `kms:Decrypt` for `lambda.amazonaws.com`, limited to this function's revisions (`aws:SourceArn` and the encryption context Lambda sets).
+
+It's added to `encryptionKey` when the key is defined in this app. Add it to every replica of a multi-Region key
+yourself: replicas don't share their primary's policy.
+
 #### Static Functions <a name="Static Functions" id="Static Functions"></a>
 
 | **Name** | **Description** |
@@ -529,6 +541,7 @@ Imports an existing Web Function in this stack's account and region by its name.
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.property.logGroup">logGroup</a></code> | <code>aws-cdk-lib.aws_logs.ILogGroup</code> | The home-region log group that receives the logs of every region the function serves from. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.property.revisionId">revisionId</a></code> | <code>string</code> | The ID of the current revision. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.property.role">role</a></code> | <code>aws-cdk-lib.aws_iam.IRole</code> | The execution role. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.property.encryptionKey">encryptionKey</a></code> | <code>aws-cdk-lib.aws_kms.IKey</code> | The customer managed key of the function's revisions, if any. |
 
 ---
 
@@ -702,6 +715,18 @@ The execution role.
 
 ---
 
+##### `encryptionKey`<sup>Optional</sup> <a name="encryptionKey" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.property.encryptionKey"></a>
+
+```typescript
+public readonly encryptionKey: IKey;
+```
+
+- *Type:* aws-cdk-lib.aws_kms.IKey
+
+The customer managed key of the function's revisions, if any.
+
+---
+
 #### Constants <a name="Constants" id="Constants"></a>
 
 | **Name** | **Type** | **Description** |
@@ -788,6 +813,7 @@ new WebFunction(scope: Construct, id: string, props: WebFunctionProps)
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addEnvironment">addEnvironment</a></code> | Adds an environment variable. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addPermission">addPermission</a></code> | Allows a principal in another account, an AWS service or an organization to call the function's endpoints, through the function's resource policy. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToRolePolicy">addToRolePolicy</a></code> | Adds a statement to the execution role's policy. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.encryptionKeyPolicyStatement">encryptionKeyPolicyStatement</a></code> | The key-policy statement Lambda needs to start this function's environments with `encryptionKey`: `kms:Decrypt` for `lambda.amazonaws.com`, limited to this function's revisions (`aws:SourceArn` and the encryption context Lambda sets). |
 
 ---
 
@@ -1076,6 +1102,17 @@ Adds a statement to the execution role's policy.
 
 ---
 
+##### `encryptionKeyPolicyStatement` <a name="encryptionKeyPolicyStatement" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.encryptionKeyPolicyStatement"></a>
+
+```typescript
+public encryptionKeyPolicyStatement(): PolicyStatement
+```
+
+The key-policy statement Lambda needs to start this function's environments with `encryptionKey`: `kms:Decrypt` for `lambda.amazonaws.com`, limited to this function's revisions (`aws:SourceArn` and the encryption context Lambda sets).
+
+It's added to `encryptionKey` when the key is defined in this app. Add it to every replica of a multi-Region key
+yourself: replicas don't share their primary's policy.
+
 #### Static Functions <a name="Static Functions" id="Static Functions"></a>
 
 | **Name** | **Description** |
@@ -1254,6 +1291,7 @@ Imports an existing Web Function in this stack's account and region by its name.
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.property.logGroup">logGroup</a></code> | <code>aws-cdk-lib.aws_logs.ILogGroup</code> | The home-region log group that receives the logs of every region the function serves from. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.property.revisionId">revisionId</a></code> | <code>string</code> | The ID of the current revision. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.property.role">role</a></code> | <code>aws-cdk-lib.aws_iam.IRole</code> | The execution role. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.property.encryptionKey">encryptionKey</a></code> | <code>aws-cdk-lib.aws_kms.IKey</code> | The customer managed key of the function's revisions, if any. |
 
 ---
 
@@ -1427,6 +1465,18 @@ The execution role.
 
 ---
 
+##### `encryptionKey`<sup>Optional</sup> <a name="encryptionKey" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.property.encryptionKey"></a>
+
+```typescript
+public readonly encryptionKey: IKey;
+```
+
+- *Type:* aws-cdk-lib.aws_kms.IKey
+
+The customer managed key of the function's revisions, if any.
+
+---
+
 #### Constants <a name="Constants" id="Constants"></a>
 
 | **Name** | **Type** | **Description** |
@@ -2965,6 +3015,7 @@ const nodejsWebFunctionProps: NodejsWebFunctionProps = { ... }
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps.property.authType">authType</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType">WebFunctionAuthType</a></code> | How callers of the endpoint are authenticated. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps.property.applicationLogLevelV2">applicationLogLevelV2</a></code> | <code>aws-cdk-lib.aws_lambda.ApplicationLogLevel</code> | The minimum level of application logs to keep. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps.property.description">description</a></code> | <code>string</code> | A description of the function's code and configuration. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps.property.encryptionKey">encryptionKey</a></code> | <code>aws-cdk-lib.aws_kms.IKey</code> | A customer managed KMS key for the function's revisions: their code and environment variables. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps.property.endpoint">endpoint</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpointOptions">WebFunctionEndpointOptions</a></code> | The default endpoint (`fn.endpoint`): where it serves from, its name and limits. It serves the current revision; route it elsewhere with `fn.endpoint.routeTraffic()`. Add more endpoints with `addEndpoint`. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps.property.environment">environment</a></code> | <code>{[ key: string ]: string}</code> | Environment variables. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps.property.logRemovalPolicy">logRemovalPolicy</a></code> | <code>aws-cdk-lib.RemovalPolicy</code> | What happens to the log groups when the function is removed: RETAIN or DESTROY. |
@@ -3021,6 +3072,27 @@ A description of the function's code and configuration.
 
 ---
 
+##### `encryptionKey`<sup>Optional</sup> <a name="encryptionKey" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps.property.encryptionKey"></a>
+
+```typescript
+public readonly encryptionKey: IKey;
+```
+
+- *Type:* aws-cdk-lib.aws_kms.IKey
+- *Default:* an AWS owned key
+
+A customer managed KMS key for the function's revisions: their code and environment variables.
+
+A `PER_REGION` or `MULTI_REGION` endpoint needs a **multi-Region key** with a replica in every region it serves
+from, and each replica's policy must allow Lambda to decrypt (see `encryptionKeyPolicyStatement()`). A key defined
+in this app gets that statement added to its own policy.
+
+Changing the key creates a new revision. Earlier revisions, including the ones kept as rollback targets, still
+need their key.
+[disable-awslint:prefer-ref-interface]
+
+---
+
 ##### `endpoint`<sup>Optional</sup> <a name="endpoint" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunctionProps.property.endpoint"></a>
 
 ```typescript
@@ -3613,6 +3685,7 @@ const webFunctionOptions: WebFunctionOptions = { ... }
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions.property.authType">authType</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType">WebFunctionAuthType</a></code> | How callers of the endpoint are authenticated. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions.property.applicationLogLevelV2">applicationLogLevelV2</a></code> | <code>aws-cdk-lib.aws_lambda.ApplicationLogLevel</code> | The minimum level of application logs to keep. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions.property.description">description</a></code> | <code>string</code> | A description of the function's code and configuration. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions.property.encryptionKey">encryptionKey</a></code> | <code>aws-cdk-lib.aws_kms.IKey</code> | A customer managed KMS key for the function's revisions: their code and environment variables. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions.property.endpoint">endpoint</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpointOptions">WebFunctionEndpointOptions</a></code> | The default endpoint (`fn.endpoint`): where it serves from, its name and limits. It serves the current revision; route it elsewhere with `fn.endpoint.routeTraffic()`. Add more endpoints with `addEndpoint`. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions.property.environment">environment</a></code> | <code>{[ key: string ]: string}</code> | Environment variables. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions.property.logRemovalPolicy">logRemovalPolicy</a></code> | <code>aws-cdk-lib.RemovalPolicy</code> | What happens to the log groups when the function is removed: RETAIN or DESTROY. |
@@ -3664,6 +3737,27 @@ A description of the function's code and configuration.
 
 ---
 
+##### `encryptionKey`<sup>Optional</sup> <a name="encryptionKey" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions.property.encryptionKey"></a>
+
+```typescript
+public readonly encryptionKey: IKey;
+```
+
+- *Type:* aws-cdk-lib.aws_kms.IKey
+- *Default:* an AWS owned key
+
+A customer managed KMS key for the function's revisions: their code and environment variables.
+
+A `PER_REGION` or `MULTI_REGION` endpoint needs a **multi-Region key** with a replica in every region it serves
+from, and each replica's policy must allow Lambda to decrypt (see `encryptionKeyPolicyStatement()`). A key defined
+in this app gets that statement added to its own policy.
+
+Changing the key creates a new revision. Earlier revisions, including the ones kept as rollback targets, still
+need their key.
+[disable-awslint:prefer-ref-interface]
+
+---
+
 ##### `endpoint`<sup>Optional</sup> <a name="endpoint" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionOptions.property.endpoint"></a>
 
 ```typescript
@@ -4372,6 +4466,7 @@ const webFunctionProps: WebFunctionProps = { ... }
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps.property.authType">authType</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionAuthType">WebFunctionAuthType</a></code> | How callers of the endpoint are authenticated. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps.property.applicationLogLevelV2">applicationLogLevelV2</a></code> | <code>aws-cdk-lib.aws_lambda.ApplicationLogLevel</code> | The minimum level of application logs to keep. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps.property.description">description</a></code> | <code>string</code> | A description of the function's code and configuration. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps.property.encryptionKey">encryptionKey</a></code> | <code>aws-cdk-lib.aws_kms.IKey</code> | A customer managed KMS key for the function's revisions: their code and environment variables. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps.property.endpoint">endpoint</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpointOptions">WebFunctionEndpointOptions</a></code> | The default endpoint (`fn.endpoint`): where it serves from, its name and limits. It serves the current revision; route it elsewhere with `fn.endpoint.routeTraffic()`. Add more endpoints with `addEndpoint`. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps.property.environment">environment</a></code> | <code>{[ key: string ]: string}</code> | Environment variables. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps.property.logRemovalPolicy">logRemovalPolicy</a></code> | <code>aws-cdk-lib.RemovalPolicy</code> | What happens to the log groups when the function is removed: RETAIN or DESTROY. |
@@ -4426,6 +4521,27 @@ A description of the function's code and configuration.
 
 ---
 
+##### `encryptionKey`<sup>Optional</sup> <a name="encryptionKey" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps.property.encryptionKey"></a>
+
+```typescript
+public readonly encryptionKey: IKey;
+```
+
+- *Type:* aws-cdk-lib.aws_kms.IKey
+- *Default:* an AWS owned key
+
+A customer managed KMS key for the function's revisions: their code and environment variables.
+
+A `PER_REGION` or `MULTI_REGION` endpoint needs a **multi-Region key** with a replica in every region it serves
+from, and each replica's policy must allow Lambda to decrypt (see `encryptionKeyPolicyStatement()`). A key defined
+in this app gets that statement added to its own policy.
+
+Changing the key creates a new revision. Earlier revisions, including the ones kept as rollback targets, still
+need their key.
+[disable-awslint:prefer-ref-interface]
+
+---
+
 ##### `endpoint`<sup>Optional</sup> <a name="endpoint" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps.property.endpoint"></a>
 
 ```typescript

package/README.md

@@ -279,6 +279,41 @@ table.grantReadWriteData(api);           // the default role trusts lambda.amazo
 - **The default execution role can only write to the function's own log groups**: the home region's, and the `.local` copy in every region it serves from. That's the minimum AWS documents for Web Functions. It doesn't use `AWSLambdaBasicExecutionRole`, which can also create any log group. Pass `role` to use your own, and include those log permissions.
 - **Renaming the function replaces it and changes its URL.** A generated name depends on the construct path, so moving the construct renames it too.
 
+### Encryption
+
+Lambda encrypts each revision's code and environment variables with an AWS owned key. To use your own key, pass `encryptionKey`:
+
+```ts
+declare const keyStack: Stack;     // deploys first
+declare const replicaStack: Stack; // in us-east-1, deploys before this stack
+
+const key = new kms.Key(keyStack, 'Key', { multiRegion: true });
+const api = new WebFunction(this, 'Api', {
+  runtime: lambda.Runtime.NODEJS_24_X,
+  code: lambda.Code.fromAsset('build'),
+  authType: WebFunctionAuthType.AWS_IAM,
+  endpoint: { endpointType: WebFunctionEndpointType.PER_REGION, regions: ['us-east-1'] },
+  encryptionKey: key,
+});
+
+// One replica per region the endpoint serves from, with Lambda's statement in its own policy.
+new kms.CfnReplicaKey(replicaStack, 'KeyReplica', {
+  primaryKeyArn: key.keyArn,
+  keyPolicy: new iam.PolicyDocument({
+    statements: [
+      new iam.PolicyStatement({ principals: [new iam.AccountRootPrincipal()], actions: ['kms:*'], resources: ['*'] }),
+      api.encryptionKeyPolicyStatement(),
+    ],
+  }),
+});
+```
+
+- **A key defined in your app gets Lambda's statement automatically.** It allows `kms:Decrypt` for `lambda.amazonaws.com`, limited to this function's revisions through `aws:SourceArn` and the encryption context Lambda sets. For an imported key, add `encryptionKeyPolicyStatement()` to its policy yourself.
+- **`PER_REGION` and `MULTI_REGION` endpoints need a multi-Region key**, with a replica in every region they serve from. The replicas must exist before the endpoint, so put the key and its replicas in stacks that deploy before the function's. Replica policies aren't copied from the primary, so each one needs `encryptionKeyPolicyStatement()`. With a single-Region key, the endpoint fails to activate in its other regions and the whole deployment rolls back. The construct fails synthesis instead, when it can tell: a key in your app without `multiRegion`, or an imported key whose ID doesn't start with `mrk-`.
+- **CloudFormation's role creates the revisions**, so it needs `kms:DescribeKey`, `kms:GenerateDataKey` and `kms:Decrypt` on the key. A key's default policy delegates to IAM, and CDK's default deployment role is allowed.
+- **Changing the key creates a new revision.** Earlier revisions keep their key, including the ones kept as rollback targets (`revisionRetention`). Keep the old key enabled while any of them might serve traffic again.
+- **Disabling the key, or removing Lambda's access, stops new execution environments from starting.** Running ones keep their decrypted copy for a while, so this doesn't contain traffic immediately.
+
 ### Defaults for every function (property injection)
 
 To give every function under a scope the same defaults, register a property injector for `WebFunction.PROPERTY_INJECTION_ID`, as you would for aws-cdk-lib's constructs. For example, a team's log retention:

package/lib/nodejs-web-function.js

@@ -50,7 +50,7 @@ const web_function_1 = require("./web-function");
  * bundle, and `NODE_OPTIONS=--enable-source-maps` when source maps are on.
  */
 class NodejsWebFunction extends web_function_1.WebFunction {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction", version: "0.1.10" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction", version: "0.1.11" };
     /**
      * Identifies this class to property injectors (`PropertyInjectors.of(scope).add(...)`). A `NodejsWebFunction` gets
      * its own injector first, then `WebFunction`'s, as aws-cdk-lib's `NodejsFunction` does with `Function`'s.

package/lib/web-function-deployment.js

@@ -11,7 +11,7 @@ const MAX_STEPS = 20;
  * How an endpoint moves its traffic to a new revision.
  */
 class WebFunctionDeployment {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment", version: "0.1.10" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment", version: "0.1.11" };
     /**
      * All traffic moves to the new revision at once, as soon as it's ready (the default).
      */

package/lib/web-function-endpoint.js

@@ -53,7 +53,7 @@ const web_function_grants_1 = require("./web-function-grants");
  * Endpoints are created only through `WebFunction`, which owns their log groups in every region, so the constructor is private.
  */
 class WebFunctionEndpoint extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint", version: "0.1.10" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint", version: "0.1.11" };
     /**
      * Creates an endpoint of a Web Function. Used by `WebFunction`.
      *

package/lib/web-function-grants.js

@@ -42,7 +42,7 @@ const iam = __importStar(require("aws-cdk-lib/aws-iam"));
 class WebFunctionGrants {
     endpointArns;
     webFunction;
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionGrants", version: "0.1.10" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionGrants", version: "0.1.11" };
     /**
      * @internal
      */

package/lib/web-function-origin.js

@@ -54,7 +54,7 @@ const OPT_IN_REGIONS = [
  * and only your distribution may call the endpoint. `new WebFunctionOrigin(endpoint)` is for a public (`NONE`) endpoint.
  */
 class WebFunctionOrigin extends cloudfront.OriginBase {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin", version: "0.1.10" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionOrigin", version: "0.1.11" };
     /**
      * An origin for an `AWS_IAM` endpoint, with origin access control: CloudFront signs every request to the endpoint
      * (`always-amz-auth`, which keeps the viewer's `Authorization` header for your application), and the function's

package/lib/web-function-revision.js

@@ -11,7 +11,7 @@ const constructs_1 = require("constructs");
  * only revisions within `revisionRetention`, or that an endpoint routes to, are kept.
  */
 class WebFunctionRevision extends constructs_1.Construct {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevision", version: "0.1.10" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionRevision", version: "0.1.11" };
     /**
      * References an existing revision of `webFunction`, e.g. to pin an endpoint to it or split traffic with it.
      */

package/lib/web-function.d.ts

@@ -1,6 +1,7 @@
 import { Duration, type IResource, RemovalPolicy, Resource } from 'aws-cdk-lib';
 import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
 import * as iam from 'aws-cdk-lib/aws-iam';
+import * as kms from 'aws-cdk-lib/aws-kms';
 import * as lambda from 'aws-cdk-lib/aws-lambda';
 import * as logs from 'aws-cdk-lib/aws-logs';
 import { Construct } from 'constructs';
@@ -56,6 +57,20 @@ export interface WebFunctionOptions {
      * @default - a role trusting `lambda.amazonaws.com` with `AWSLambdaBasicExecutionRole`
      */
     readonly role?: iam.IRole;
+    /**
+     * A customer managed KMS key for the function's revisions: their code and environment variables.
+     *
+     * A `PER_REGION` or `MULTI_REGION` endpoint needs a **multi-Region key** with a replica in every region it serves
+     * from, and each replica's policy must allow Lambda to decrypt (see `encryptionKeyPolicyStatement()`). A key defined
+     * in this app gets that statement added to its own policy.
+     *
+     * Changing the key creates a new revision. Earlier revisions, including the ones kept as rollback targets, still
+     * need their key.
+     * [disable-awslint:prefer-ref-interface]
+     *
+     * @default - an AWS owned key
+     */
+    readonly encryptionKey?: kms.IKey;
     /**
      * Environment variables. Names starting with `AWS_` are reserved.
      *
@@ -325,6 +340,8 @@ export declare class WebFunction extends WebFunctionBase implements iam.IGrantab
     readonly grants: WebFunctionGrants;
     /** The execution role. */
     readonly role: iam.IRole;
+    /** The customer managed key of the function's revisions, if any. */
+    readonly encryptionKey?: kms.IKey;
     /** The principal to grant permissions to (the execution role). */
     readonly grantPrincipal: iam.IPrincipal;
     /**
@@ -368,6 +385,16 @@ export declare class WebFunction extends WebFunctionBase implements iam.IGrantab
      * @param id the statement ID (`Sid`): letters and digits, unique within the function
      */
     addPermission(id: string, permission: WebFunctionPermission): void;
+    /**
+     * The key-policy statement Lambda needs to start this function's environments with `encryptionKey`: `kms:Decrypt` for
+     * `lambda.amazonaws.com`, limited to this function's revisions (`aws:SourceArn` and the encryption context Lambda sets).
+     *
+     * It's added to `encryptionKey` when the key is defined in this app. Add it to every replica of a multi-Region key
+     * yourself: replicas don't share their primary's policy.
+     */
+    encryptionKeyPolicyStatement(): iam.PolicyStatement;
+    /** Regional and multi-region endpoints need a multi-Region key: otherwise their other regions fail to activate. */
+    private validateEncryptionKey;
     private createEndpoint;
     /**
      * The default execution role: write to the function's own log groups only (the home region's and every region's