@ashishpandeyone/cdk-lambda-web-function 0.1.4 → 0.1.5

package/API.md

@@ -51,6 +51,7 @@ new NodejsWebFunction(scope: Construct, id: string, props: NodejsWebFunctionProp
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.with">with</a></code> | Applies one or more mixins to this construct. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.applyCrossStackReferenceStrength">applyCrossStackReferenceStrength</a></code> | Override the cross-stack reference strength for this resource. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.applyRemovalPolicy">applyRemovalPolicy</a></code> | Apply the given removal policy to this resource. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToResourcePolicy">addToResourcePolicy</a></code> | Adds a statement to the function's resource policy, e.g. to let another account manage the function. For invoking, prefer `addPermission` or `grantInvoke`. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.grantInvoke">grantInvoke</a></code> | Allows `grantee` to call the endpoint. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.metric">metric</a></code> | A metric of this function's execution environments in `AWS/Lambda/Web` (dimension `FunctionName`), across all endpoints. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.metricActiveTime">metricActiveTime</a></code> | Time the execution environments were active (`EnvironmentActiveTime`). |
@@ -60,6 +61,7 @@ new NodejsWebFunction(scope: Construct, id: string, props: NodejsWebFunctionProp
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.metricResponseBytes">metricResponseBytes</a></code> | Bytes sent in responses (`ResponseBytes`). |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addEndpoint">addEndpoint</a></code> | Adds an endpoint (up to 10 per function), e.g. a public one next to an IAM-only one, or one pinned to an earlier revision. Each endpoint has its own URL, authentication, regions and limits. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addEnvironment">addEnvironment</a></code> | Adds an environment variable. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addPermission">addPermission</a></code> | Allows a principal in another account, an AWS service or an organization to call the function's endpoints, through the function's resource policy. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToRolePolicy">addToRolePolicy</a></code> | Adds a statement to the execution role's policy. |
 
 ---
@@ -135,6 +137,24 @@ account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
 
 ---
 
+##### `addToResourcePolicy` <a name="addToResourcePolicy" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToResourcePolicy"></a>
+
+```typescript
+public addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult
+```
+
+Adds a statement to the function's resource policy, e.g. to let another account manage the function. For invoking, prefer `addPermission` or `grantInvoke`.
+
+The function has one resource policy (`AWS::Lambda::ResourcePolicy`), created on the first statement. This stack
+is its only writer: another stack or template can't also attach one, and changes made outside CloudFormation
+are overwritten by the next update of the policy.
+
+###### `statement`<sup>Required</sup> <a name="statement" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToResourcePolicy.parameter.statement"></a>
+
+- *Type:* aws-cdk-lib.aws_iam.PolicyStatement
+
+---
+
 ##### `grantInvoke` <a name="grantInvoke" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.grantInvoke"></a>
 
 ```typescript
@@ -293,6 +313,30 @@ Names starting with `AWS_` are reserved.
 
 ---
 
+##### `addPermission` <a name="addPermission" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addPermission"></a>
+
+```typescript
+public addPermission(id: string, permission: WebFunctionPermission): void
+```
+
+Allows a principal in another account, an AWS service or an organization to call the function's endpoints, through the function's resource policy.
+
+For a role in this account, use `grantInvoke`.
+
+###### `id`<sup>Required</sup> <a name="id" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addPermission.parameter.id"></a>
+
+- *Type:* string
+
+the statement ID (`Sid`): letters and digits, unique within the function.
+
+---
+
+###### `permission`<sup>Required</sup> <a name="permission" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addPermission.parameter.permission"></a>
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission">WebFunctionPermission</a>
+
+---
+
 ##### `addToRolePolicy` <a name="addToRolePolicy" id="@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction.addToRolePolicy"></a>
 
 ```typescript
@@ -713,6 +757,7 @@ new WebFunction(scope: Construct, id: string, props: WebFunctionProps)
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.with">with</a></code> | Applies one or more mixins to this construct. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.applyCrossStackReferenceStrength">applyCrossStackReferenceStrength</a></code> | Override the cross-stack reference strength for this resource. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.applyRemovalPolicy">applyRemovalPolicy</a></code> | Apply the given removal policy to this resource. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToResourcePolicy">addToResourcePolicy</a></code> | Adds a statement to the function's resource policy, e.g. to let another account manage the function. For invoking, prefer `addPermission` or `grantInvoke`. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.grantInvoke">grantInvoke</a></code> | Allows `grantee` to call the endpoint. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.metric">metric</a></code> | A metric of this function's execution environments in `AWS/Lambda/Web` (dimension `FunctionName`), across all endpoints. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.metricActiveTime">metricActiveTime</a></code> | Time the execution environments were active (`EnvironmentActiveTime`). |
@@ -722,6 +767,7 @@ new WebFunction(scope: Construct, id: string, props: WebFunctionProps)
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.metricResponseBytes">metricResponseBytes</a></code> | Bytes sent in responses (`ResponseBytes`). |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addEndpoint">addEndpoint</a></code> | Adds an endpoint (up to 10 per function), e.g. a public one next to an IAM-only one, or one pinned to an earlier revision. Each endpoint has its own URL, authentication, regions and limits. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addEnvironment">addEnvironment</a></code> | Adds an environment variable. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addPermission">addPermission</a></code> | Allows a principal in another account, an AWS service or an organization to call the function's endpoints, through the function's resource policy. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToRolePolicy">addToRolePolicy</a></code> | Adds a statement to the execution role's policy. |
 
 ---
@@ -797,6 +843,24 @@ account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
 
 ---
 
+##### `addToResourcePolicy` <a name="addToResourcePolicy" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToResourcePolicy"></a>
+
+```typescript
+public addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult
+```
+
+Adds a statement to the function's resource policy, e.g. to let another account manage the function. For invoking, prefer `addPermission` or `grantInvoke`.
+
+The function has one resource policy (`AWS::Lambda::ResourcePolicy`), created on the first statement. This stack
+is its only writer: another stack or template can't also attach one, and changes made outside CloudFormation
+are overwritten by the next update of the policy.
+
+###### `statement`<sup>Required</sup> <a name="statement" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToResourcePolicy.parameter.statement"></a>
+
+- *Type:* aws-cdk-lib.aws_iam.PolicyStatement
+
+---
+
 ##### `grantInvoke` <a name="grantInvoke" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.grantInvoke"></a>
 
 ```typescript
@@ -955,6 +1019,30 @@ Names starting with `AWS_` are reserved.
 
 ---
 
+##### `addPermission` <a name="addPermission" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addPermission"></a>
+
+```typescript
+public addPermission(id: string, permission: WebFunctionPermission): void
+```
+
+Allows a principal in another account, an AWS service or an organization to call the function's endpoints, through the function's resource policy.
+
+For a role in this account, use `grantInvoke`.
+
+###### `id`<sup>Required</sup> <a name="id" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addPermission.parameter.id"></a>
+
+- *Type:* string
+
+the statement ID (`Sid`): letters and digits, unique within the function.
+
+---
+
+###### `permission`<sup>Required</sup> <a name="permission" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addPermission.parameter.permission"></a>
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission">WebFunctionPermission</a>
+
+---
+
 ##### `addToRolePolicy` <a name="addToRolePolicy" id="@ashishpandeyone/cdk-lambda-web-function.WebFunction.addToRolePolicy"></a>
 
 ```typescript
@@ -1369,6 +1457,7 @@ new WebFunctionBase(scope: Construct, id: string, props?: ResourceProps)
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.with">with</a></code> | Applies one or more mixins to this construct. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.applyCrossStackReferenceStrength">applyCrossStackReferenceStrength</a></code> | Override the cross-stack reference strength for this resource. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.applyRemovalPolicy">applyRemovalPolicy</a></code> | Apply the given removal policy to this resource. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.addToResourcePolicy">addToResourcePolicy</a></code> | Adds a statement to the function's resource policy (not added for an imported function). |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.grantInvoke">grantInvoke</a></code> | Allows `grantee` to call the function's endpoint. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.metric">metric</a></code> | A metric of this function's execution environments in `AWS/Lambda/Web` (dimension `FunctionName`), across all endpoints. |
 | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.metricActiveTime">metricActiveTime</a></code> | Time the execution environments were active (`EnvironmentActiveTime`). |
@@ -1450,6 +1539,20 @@ account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
 
 ---
 
+##### `addToResourcePolicy` <a name="addToResourcePolicy" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.addToResourcePolicy"></a>
+
+```typescript
+public addToResourcePolicy(statement: PolicyStatement): AddToResourcePolicyResult
+```
+
+Adds a statement to the function's resource policy (not added for an imported function).
+
+###### `statement`<sup>Required</sup> <a name="statement" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.addToResourcePolicy.parameter.statement"></a>
+
+- *Type:* aws-cdk-lib.aws_iam.PolicyStatement
+
+---
+
 ##### `grantInvoke` <a name="grantInvoke" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase.grantInvoke"></a>
 
 ```typescript
@@ -3635,6 +3738,84 @@ Renaming a function replaces it, and its endpoint gets a new URL.
 
 ---
 
+### WebFunctionPermission <a name="WebFunctionPermission" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission"></a>
+
+Permission for a principal outside this account, an AWS service or an organization to call a function's endpoints.
+
+#### Initializer <a name="Initializer" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.Initializer"></a>
+
+```typescript
+import { WebFunctionPermission } from '@ashishpandeyone/cdk-lambda-web-function'
+
+const webFunctionPermission: WebFunctionPermission = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.principal">principal</a></code> | <code>aws-cdk-lib.aws_iam.IPrincipal</code> | Who may call: an account (`iam.AccountPrincipal`), a role or user (`iam.ArnPrincipal`), an AWS service (`iam.ServicePrincipal`, with `sourceArn` or `sourceAccount`) or an organization (`iam.OrganizationPrincipal`). |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.endpoint">endpoint</a></code> | <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint">WebFunctionEndpoint</a></code> | The endpoint the principal may call. |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.sourceAccount">sourceAccount</a></code> | <code>string</code> | For an AWS service: the account that owns the resource calling on its behalf (condition `aws:SourceAccount`). |
+| <code><a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.sourceArn">sourceArn</a></code> | <code>string</code> | For an AWS service: the ARN of the resource calling on its behalf (condition `aws:SourceArn`, `ArnLike`), e.g. a CloudFront distribution. Without it or `sourceAccount`, any account's use of the service could call the endpoint. |
+
+---
+
+##### `principal`<sup>Required</sup> <a name="principal" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.principal"></a>
+
+```typescript
+public readonly principal: IPrincipal;
+```
+
+- *Type:* aws-cdk-lib.aws_iam.IPrincipal
+
+Who may call: an account (`iam.AccountPrincipal`), a role or user (`iam.ArnPrincipal`), an AWS service (`iam.ServicePrincipal`, with `sourceArn` or `sourceAccount`) or an organization (`iam.OrganizationPrincipal`).
+
+A principal in another account also needs `lambda:InvokeWebFunctionEndpoint` in its own IAM policy.
+
+---
+
+##### `endpoint`<sup>Optional</sup> <a name="endpoint" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.endpoint"></a>
+
+```typescript
+public readonly endpoint: WebFunctionEndpoint;
+```
+
+- *Type:* <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionEndpoint">WebFunctionEndpoint</a>
+- *Default:* every endpoint of the function, including ones added later
+
+The endpoint the principal may call.
+
+It must belong to this function.
+
+---
+
+##### `sourceAccount`<sup>Optional</sup> <a name="sourceAccount" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.sourceAccount"></a>
+
+```typescript
+public readonly sourceAccount: string;
+```
+
+- *Type:* string
+- *Default:* no condition
+
+For an AWS service: the account that owns the resource calling on its behalf (condition `aws:SourceAccount`).
+
+---
+
+##### `sourceArn`<sup>Optional</sup> <a name="sourceArn" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionPermission.property.sourceArn"></a>
+
+```typescript
+public readonly sourceArn: string;
+```
+
+- *Type:* string
+- *Default:* no condition
+
+For an AWS service: the ARN of the resource calling on its behalf (condition `aws:SourceArn`, `ArnLike`), e.g. a CloudFront distribution. Without it or `sourceAccount`, any account's use of the service could call the endpoint.
+
+---
+
 ### WebFunctionProps <a name="WebFunctionProps" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionProps"></a>
 
 Properties for a `WebFunction`.
@@ -4169,6 +4350,9 @@ Allows `grantee` to call the endpoint (`lambda:InvokeWebFunctionEndpoint`).
 The grant is on the endpoint's home-region ARN, which IAM evaluates for every region the
 endpoint serves from, including a MULTI_REGION global URL.
 
+A grantee in the function's account gets an IAM policy statement. Another account or an AWS service also gets
+a statement in the function's resource policy (not for an imported function's endpoints).
+
 ###### `grantee`<sup>Required</sup> <a name="grantee" id="@ashishpandeyone/cdk-lambda-web-function.WebFunctionGrants.invoke.parameter.grantee"></a>
 
 - *Type:* aws-cdk-lib.aws_iam.IGrantable
@@ -4182,12 +4366,16 @@ endpoint serves from, including a MULTI_REGION global URL.
 
 ### IWebFunction <a name="IWebFunction" id="@ashishpandeyone/cdk-lambda-web-function.IWebFunction"></a>
 
-- *Extends:* aws-cdk-lib.IResource, aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef
+- *Extends:* aws-cdk-lib.IResource, aws-cdk-lib.interfaces.aws_lambda.IWebFunctionRef, aws-cdk-lib.aws_iam.IResourceWithPolicy
 
 - *Implemented By:* <a href="#@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction">NodejsWebFunction</a>, <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunction">WebFunction</a>, <a href="#@ashishpandeyone/cdk-lambda-web-function.WebFunctionBase">WebFunctionBase</a>, <a href="#@ashishpandeyone/cdk-lambda-web-function.IWebFunction">IWebFunction</a>
 
 A Lambda Web Function, created in this app (`WebFunction`) or imported (`WebFunction.fromWebFunctionArn`).
 
+`addToResourcePolicy` adds to the function's resource policy (who else may call or manage it). A `WebFunction` has
+one, created by its stack on the first statement. An imported function's policy belongs to the stack that created
+it, so the statement isn't added (`statementAdded: false`).
+
 #### Methods <a name="Methods" id="Methods"></a>
 
 | **Name** | **Description** |
@@ -4212,7 +4400,9 @@ Allows `grantee` to call the function's endpoint (`lambda:InvokeWebFunctionEndpo
 
 for an imported function, the endpoint named in its attributes, or every endpoint.
 
-This adds to the grantee's IAM policy. For a function in another account, its resource policy must also allow the grantee.
+For a `WebFunction`, a grantee in this account gets an IAM policy statement; another account or an AWS service
+also gets a statement in the function's resource policy. For an imported function, only the grantee's IAM policy
+changes: across accounts, the function's own resource policy must also allow the grantee.
 [disable-awslint:no-grants]
 
 ###### `grantee`<sup>Required</sup> <a name="grantee" id="@ashishpandeyone/cdk-lambda-web-function.IWebFunction.grantInvoke.parameter.grantee"></a>

package/README.md

@@ -16,7 +16,7 @@
 
 <!--END STABILITY BANNER-->
 
-[AWS Lambda Web Functions](https://aws.amazon.com/lambda/) run an ordinary Node.js HTTP server (Express, Fastify, Hono, `node:http`) on Lambda and give it an HTTPS endpoint, optionally served from several regions. `WebFunction` deploys one, following the conventions of `aws-cdk-lib/aws-lambda` where the two services overlap.
+[AWS Lambda Web Functions](https://docs.aws.amazon.com/lambda/latest/dg/web-functions.html) run an ordinary Node.js HTTP server (Express, Fastify, Hono, `node:http`) on Lambda and give it an HTTPS endpoint, optionally served from several regions. `WebFunction` deploys one, following the conventions of `aws-cdk-lib/aws-lambda` where the two services overlap.
 
 ```ts fixture=bare
 import * as lambda from 'aws-cdk-lib/aws-lambda';
@@ -37,10 +37,18 @@ new CfnOutput(this, 'Url', { value: fn.endpoint.url }); // https://<id>.lambda-w
 
 The stack's region is the function's **home region**. Multi-region endpoints need a stack with an explicit `env.region`.
 
+## Installation
+
+```bash
+npm install @ashishpandeyone/cdk-lambda-web-function
+```
+
+It needs `aws-cdk-lib` 2.273.0 or later and `constructs` 10.5.1 or later (peer dependencies), and Node.js 22 or later. The package is published for TypeScript and JavaScript only.
+
 ## Writing the server
 
 1. Listen on the host and port in **`AWS_LAMBDA_HTTP_ENDPOINT`** (`0.0.0.0:3000` today). `PORT` is not set.
-2. Start listening within **about 9 seconds**, or initialisation fails with `Application.TimeoutListenError`.
+2. Start listening within **10 seconds**, or initialisation fails with `Application.TimeoutListenError`.
 3. Put the entry file at the root of your bundle as **`index.js`**, or set `entrypoint`.
 4. The runtime has **no AWS SDK**: bundle the clients you import.
 5. Code runs on **arm64**.
@@ -148,6 +156,7 @@ import { SignatureV4a } from '@smithy/signature-v4a';
 import { Sha256 } from '@aws-crypto/sha256-js';
 import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
 
+const host = new URL(url).hostname; // url: the endpoint's URL
 const signer = new SignatureV4a({ service: 'lambda', region: '*', sha256: Sha256, credentials: fromNodeProviderChain() });
 const signed = await signer.sign(
   { method: 'GET', protocol: 'https:', hostname: host, path: '/', headers: { host } },
@@ -156,6 +165,32 @@ const signed = await signer.sign(
 const response = await fetch(`https://${host}/`, { headers: signed.headers });
 ```
 
+### Other accounts and AWS services
+
+A caller in another account needs permission twice: in its own IAM policy, and in the function's **resource policy**. `grantInvoke` handles the function's side: a role in the function's account only gets an IAM policy statement, while a principal in another account or an AWS service also gets a statement in the resource policy.
+
+```ts
+fn.grantInvoke(iam.Role.fromRoleArn(this, 'Partner', 'arn:aws:iam::444455556666:role/caller'));
+```
+
+For principals you can't grant to (a whole account, an organization, an AWS service with conditions), use `addPermission`. The `id` becomes the statement's `Sid`:
+
+```ts
+fn.addPermission('PartnerAccount', { principal: new iam.AccountPrincipal('444455556666') });
+fn.addPermission('MyOrg', { principal: new iam.OrganizationPrincipal('o-a1b2c3d4e5'), endpoint: fn.endpoint });
+fn.addPermission('Cdn', {
+  principal: new iam.ServicePrincipal('cloudfront.amazonaws.com'),
+  sourceArn: `arn:aws:cloudfront::${this.account}:distribution/EDFDVBD6EXAMPLE`,
+});
+```
+
+`addPermission` allows calling every endpoint unless you pass `endpoint`. For other actions, such as letting another account create revisions, use `fn.addToResourcePolicy(statement)`. Statements use the endpoint ARN for invoking and the function ARN for actions on the function.
+
+- **One resource policy per function, written by the function's stack.** The construct creates it (`AWS::Lambda::ResourcePolicy`) with the first statement. CloudFormation can't attach a second one: another stack, or a `CfnResourcePolicy` of your own on the function, fails at change-set validation with "already exists". If you attached one yourself, move its statements into `addPermission` or `addToResourcePolicy`. Each update of the policy replaces any statements added outside CloudFormation.
+- **Public policies are rejected.** Lambda refuses a policy that lets anyone call the function, and the construct fails synthesis first. A `*` principal is only accepted with a condition that pins the caller, such as `aws:PrincipalOrgID` (`iam.OrganizationPrincipal`) or `aws:SourceAccount`. For a public endpoint, use `authType: NONE`.
+- **Scope AWS services to your resource.** Lambda accepts a service principal with no condition, which would let that service call the endpoint on behalf of any account. The construct warns unless you give `sourceArn` or `sourceAccount` (or an `aws:SourceArn`, `aws:SourceAccount`, `aws:SourceOrgID` or `aws:SourceOrgPaths` condition).
+- Lambda copies the policy to every region the function's endpoints serve from. The copy is eventually consistent, and in tests changes applied in every region within seconds.
+
 ### Functions defined elsewhere
 
 Import a Web Function defined in another stack or app to grant access to it, read its metrics, or reference its revisions:
@@ -173,7 +208,7 @@ live.metricConcurrentRequests().createAlarm(this, 'Busy', { threshold: 60, evalu
 
 An imported function's metrics default to its own region. Its endpoints, revisions and log groups stay with the stack that defines it.
 
-`grantInvoke` adds to the caller's IAM policy, which is all a caller in the function's account needs. A caller in another account also needs the function's resource policy to allow it, which this library doesn't manage yet.
+An imported function's `grantInvoke` adds to the caller's IAM policy only, which is all a caller in the function's account needs. A caller in another account also needs the function's resource policy to allow it, which only the function's own stack can change: `addToResourcePolicy` on an imported function adds nothing and warns.
 
 ## Configuration
 
@@ -194,6 +229,7 @@ api.addEnvironment('FEATURE_FLAG', 'on');
 table.grantReadWriteData(api);           // the default role trusts lambda.amazonaws.com
 ```
 
+- **Each execution environment has 2 vCPUs and 2 GB of memory.** There's no memory setting as on Lambda functions; scale with `maxConcurrencyPerEnvironment` and more environments instead.
 - Requests handled by one environment share module-level state, so keep handlers concurrency-safe.
 - Environment variable names starting with `AWS_` are reserved.
 - **Renaming the function replaces it and changes its URL.** A generated name depends on the construct path, so moving the construct renames it too.
@@ -228,7 +264,7 @@ new NodejsWebFunction(this, 'Api', {
 
 Lambda Web Functions download code as the `lambda.amazonaws.com` service principal, from a **versioned** bucket, and the CDK bootstrap bucket allows neither. So each stack gets a small code bucket, and the code is copied into it on deploy. The bucket is emptied and deleted with the stack.
 
-Code copies, log groups in other regions, revision cleanup and the bucket's emptying run in one custom resource Lambda per stack. Its logs go to a log group the stack owns, kept for a month and deleted with the stack.
+Copying code, managing the function's log groups in every region, looking up regional URLs, cleaning up old revisions, creating rollback alarms in other regions and emptying the code bucket all run in one custom resource Lambda per stack. Its logs go to a log group the stack owns, kept for a month and deleted with the stack.
 
 ## Revisions
 
@@ -364,7 +400,7 @@ Web Functions log in two tiers:
  └──────────────────┘              └──────────────────────────────────────────┘
 ```
 
-**Query `fn.logGroup`**, the home-region group that receives every region's logs. The service would create missing groups without retention and never delete them, so the construct creates and owns all of them: both home-region groups, and `<group>.local` in every other region of the endpoint.
+**Query `fn.logGroup`**, the home-region group that receives every region's logs. The service would create missing groups without retention and never delete them, so the construct creates and owns all of them: both home-region groups, and `<group>.local` in every other region any of its endpoints serves from.
 
 ```ts
 new WebFunction(this, 'Api', {
@@ -385,8 +421,9 @@ new WebFunction(this, 'Api', {
 
 ## Limitations
 
-- Not yet supported: VPC access (network connectors), resource-policy permissions, KMS encryption, tracing, and a CloudFront origin.
-- `cdk deploy --hotswap` and `cdk watch` don't support Web Functions.
+- Not yet supported: VPC access (network connectors), KMS encryption, tracing, and a CloudFront origin.
+- **Hotswap skips Web Functions without a warning.** `cdk deploy --hotswap` and `cdk watch`, which hotswaps by default, report `(no changes)` for a code or configuration change and the endpoint keeps serving the old revision. Use `cdk watch --hotswap-fallback` (or `cdk deploy --hotswap-fallback`): it deploys Web Function changes through CloudFormation, in about 40 seconds for a home-region endpoint.
+- Fixed limits: 512 MB of code (unzipped) and 32 KB of environment variables per revision, 512 MB of `/tmp` per execution environment, and 128 KiB of headers per request.
 - Quotas: 10 endpoints and about 50 revisions per function (Lambda cleans up older revisions automatically), and 10,000 requests per second per endpoint. Per account and region: 100,000 requests per second and 2,000 Arm64 vCPUs (each execution environment uses 2). The account quotas are adjustable, and new accounts start lower. See [Lambda quotas](https://docs.aws.amazon.com/lambda/latest/dg/gettingstarted-limits.html).
 
 ## Development

package/lib/nodejs-web-function.js

@@ -49,7 +49,7 @@ const web_function_1 = require("./web-function");
  * bundle, and `NODE_OPTIONS=--enable-source-maps` when source maps are on.
  */
 class NodejsWebFunction extends web_function_1.WebFunction {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction", version: "0.1.4" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.NodejsWebFunction", version: "0.1.5" };
     constructor(scope, id, props) {
         const runtime = props.runtime ?? lambda.Runtime.NODEJS_24_X;
         const entry = (0, bundling_1.resolveEntry)(props.entry);

package/lib/private/resource-policy.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Checks on a Web Function's resource policy, run at synthesis on the resolved document.
+ *
+ * Lambda rejects a public policy at deploy time ("Lambda blocked the creation of this policy because it would grant
+ * public access"): a `*` principal is only accepted when a trusted condition key pins the caller. A service principal
+ * without a source condition is accepted, but lets any account's use of that service call the endpoint.
+ */
+export interface ResourcePolicyFindings {
+    /** Statements Lambda would reject as public. */
+    readonly errors: string[];
+    /** Service principals allowed without a source condition. */
+    readonly unscopedServices: string[];
+}
+/** Inspects a resolved policy document (`{ Statement: [...] }`). */
+export declare function inspectResourcePolicy(document: any): ResourcePolicyFindings;

package/lib/private/resource-policy.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * Checks on a Web Function's resource policy, run at synthesis on the resolved document.
+ *
+ * Lambda rejects a public policy at deploy time ("Lambda blocked the creation of this policy because it would grant
+ * public access"): a `*` principal is only accepted when a trusted condition key pins the caller. A service principal
+ * without a source condition is accepted, but lets any account's use of that service call the endpoint.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectResourcePolicy = inspectResourcePolicy;
+/** Condition keys Lambda accepts to make a `*` principal non-public (Lambda Web Function permissions docs, 2026-10). */
+const TRUSTED_KEYS = [
+    'aws:PrincipalAccount', 'aws:PrincipalArn', 'aws:PrincipalOrgID', 'aws:PrincipalOrgPaths', 'aws:SourceAccount', 'aws:SourceArn',
+    'aws:SourceOrgID', 'aws:SourceOrgPaths', 'aws:SourceVpc', 'aws:SourceVpcArn', 'aws:SourceVpce', 'aws:VpceAccount', 'aws:VpceOrgID',
+    'aws:VpceOrgPaths', 'aws:Ec2InstanceSourceVpc', 'aws:UserId', 'aws:PrincipalServiceName', 'aws:PrincipalServiceNamesList',
+    'aws:PrincipalIsAWSService', 'lambda:SourceFunctionArn',
+].map((k) => k.toLowerCase());
+/** Condition keys that tie a service principal to the resource or account calling on its behalf. */
+const SOURCE_KEYS = ['aws:SourceArn', 'aws:SourceAccount', 'aws:SourceOrgID', 'aws:SourceOrgPaths'].map((k) => k.toLowerCase());
+/** Inspects a resolved policy document (`{ Statement: [...] }`). */
+function inspectResourcePolicy(document) {
+    const errors = [];
+    const unscopedServices = [];
+    for (const [i, s] of (document?.Statement ?? []).entries()) {
+        if (s.Effect !== 'Allow')
+            continue;
+        const keys = conditionKeys(s.Condition);
+        const name = s.Sid ? `statement '${s.Sid}'` : `statement ${i + 1}`;
+        if (isWildcard(s.Principal) && !keys.some((k) => TRUSTED_KEYS.includes(k))) {
+            errors.push(`${name} allows principal '*': Lambda rejects public resource policies. Pin the caller with a condition such as aws:PrincipalOrgID or aws:SourceAccount (e.g. iam.OrganizationPrincipal), or name the accounts`);
+        }
+        const services = list(s.Principal?.Service).map(String);
+        if (services.length > 0 && !keys.some((k) => SOURCE_KEYS.includes(k))) {
+            unscopedServices.push(...services);
+        }
+    }
+    return { errors, unscopedServices };
+}
+function isWildcard(principal) {
+    return principal === '*' || list(principal?.AWS).includes('*');
+}
+function conditionKeys(condition) {
+    return Object.values(condition ?? {}).flatMap((byKey) => Object.keys(byKey ?? {})).map((k) => k.toLowerCase());
+}
+function list(value) {
+    return value === undefined ? [] : Array.isArray(value) ? value : [value];
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVzb3VyY2UtcG9saWN5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3ByaXZhdGUvcmVzb3VyY2UtcG9saWN5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7QUFBQTs7Ozs7O0dBTUc7O0FBcUJILHNEQWdCQztBQW5DRCx3SEFBd0g7QUFDeEgsTUFBTSxZQUFZLEdBQUc7SUFDbkIsc0JBQXNCLEVBQUUsa0JBQWtCLEVBQUUsb0JBQW9CLEVBQUUsdUJBQXVCLEVBQUUsbUJBQW1CLEVBQUUsZUFBZTtJQUMvSCxpQkFBaUIsRUFBRSxvQkFBb0IsRUFBRSxlQUFlLEVBQUUsa0JBQWtCLEVBQUUsZ0JBQWdCLEVBQUUsaUJBQWlCLEVBQUUsZUFBZTtJQUNsSSxrQkFBa0IsRUFBRSwwQkFBMEIsRUFBRSxZQUFZLEVBQUUsMEJBQTBCLEVBQUUsK0JBQStCO0lBQ3pILDJCQUEyQixFQUFFLDBCQUEwQjtDQUN4RCxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7QUFFOUIsb0dBQW9HO0FBQ3BHLE1BQU0sV0FBVyxHQUFHLENBQUMsZUFBZSxFQUFFLG1CQUFtQixFQUFFLGlCQUFpQixFQUFFLG9CQUFvQixDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQztBQVNoSSxvRUFBb0U7QUFDcEUsU0FBZ0IscUJBQXFCLENBQUMsUUFBYTtJQUNqRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxnQkFBZ0IsR0FBYSxFQUFFLENBQUM7SUFDdEMsS0FBSyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFNBQVMsSUFBSSxFQUFFLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQzNELElBQUksQ0FBQyxDQUFDLE1BQU0sS0FBSyxPQUFPO1lBQUUsU0FBUztRQUNuQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3hDLE1BQU0sSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQyxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUMsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNuRSxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSx3TUFBd00sQ0FBQyxDQUFDO1FBQy9OLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDeEQsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3RFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxHQUFHLFFBQVEsQ0FBQyxDQUFDO1FBQ3JDLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO0FBQ3RDLENBQUM7QUFFRCxTQUFTLFVBQVUsQ0FBQyxTQUFjO0lBQ2hDLE9BQU8sU0FBUyxLQUFLLEdBQUcsSUFBSSxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztBQUNqRSxDQUFDO0FBRUQsU0FBUyxhQUFhLENBQUMsU0FBYztJQUNuQyxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQVUsRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0FBQ3RILENBQUM7QUFFRCxTQUFTLElBQUksQ0FBQyxLQUFjO0lBQzFCLE9BQU8sS0FBSyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDM0UsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQ2hlY2tzIG9uIGEgV2ViIEZ1bmN0aW9uJ3MgcmVzb3VyY2UgcG9saWN5LCBydW4gYXQgc3ludGhlc2lzIG9uIHRoZSByZXNvbHZlZCBkb2N1bWVudC5cbiAqXG4gKiBMYW1iZGEgcmVqZWN0cyBhIHB1YmxpYyBwb2xpY3kgYXQgZGVwbG95IHRpbWUgKFwiTGFtYmRhIGJsb2NrZWQgdGhlIGNyZWF0aW9uIG9mIHRoaXMgcG9saWN5IGJlY2F1c2UgaXQgd291bGQgZ3JhbnRcbiAqIHB1YmxpYyBhY2Nlc3NcIik6IGEgYCpgIHByaW5jaXBhbCBpcyBvbmx5IGFjY2VwdGVkIHdoZW4gYSB0cnVzdGVkIGNvbmRpdGlvbiBrZXkgcGlucyB0aGUgY2FsbGVyLiBBIHNlcnZpY2UgcHJpbmNpcGFsXG4gKiB3aXRob3V0IGEgc291cmNlIGNvbmRpdGlvbiBpcyBhY2NlcHRlZCwgYnV0IGxldHMgYW55IGFjY291bnQncyB1c2Ugb2YgdGhhdCBzZXJ2aWNlIGNhbGwgdGhlIGVuZHBvaW50LlxuICovXG5cbi8qKiBDb25kaXRpb24ga2V5cyBMYW1iZGEgYWNjZXB0cyB0byBtYWtlIGEgYCpgIHByaW5jaXBhbCBub24tcHVibGljIChMYW1iZGEgV2ViIEZ1bmN0aW9uIHBlcm1pc3Npb25zIGRvY3MsIDIwMjYtMTApLiAqL1xuY29uc3QgVFJVU1RFRF9LRVlTID0gW1xuICAnYXdzOlByaW5jaXBhbEFjY291bnQnLCAnYXdzOlByaW5jaXBhbEFybicsICdhd3M6UHJpbmNpcGFsT3JnSUQnLCAnYXdzOlByaW5jaXBhbE9yZ1BhdGhzJywgJ2F3czpTb3VyY2VBY2NvdW50JywgJ2F3czpTb3VyY2VBcm4nLFxuICAnYXdzOlNvdXJjZU9yZ0lEJywgJ2F3czpTb3VyY2VPcmdQYXRocycsICdhd3M6U291cmNlVnBjJywgJ2F3czpTb3VyY2VWcGNBcm4nLCAnYXdzOlNvdXJjZVZwY2UnLCAnYXdzOlZwY2VBY2NvdW50JywgJ2F3czpWcGNlT3JnSUQnLFxuICAnYXdzOlZwY2VPcmdQYXRocycsICdhd3M6RWMySW5zdGFuY2VTb3VyY2VWcGMnLCAnYXdzOlVzZXJJZCcsICdhd3M6UHJpbmNpcGFsU2VydmljZU5hbWUnLCAnYXdzOlByaW5jaXBhbFNlcnZpY2VOYW1lc0xpc3QnLFxuICAnYXdzOlByaW5jaXBhbElzQVdTU2VydmljZScsICdsYW1iZGE6U291cmNlRnVuY3Rpb25Bcm4nLFxuXS5tYXAoKGspID0+IGsudG9Mb3dlckNhc2UoKSk7XG5cbi8qKiBDb25kaXRpb24ga2V5cyB0aGF0IHRpZSBhIHNlcnZpY2UgcHJpbmNpcGFsIHRvIHRoZSByZXNvdXJjZSBvciBhY2NvdW50IGNhbGxpbmcgb24gaXRzIGJlaGFsZi4gKi9cbmNvbnN0IFNPVVJDRV9LRVlTID0gWydhd3M6U291cmNlQXJuJywgJ2F3czpTb3VyY2VBY2NvdW50JywgJ2F3czpTb3VyY2VPcmdJRCcsICdhd3M6U291cmNlT3JnUGF0aHMnXS5tYXAoKGspID0+IGsudG9Mb3dlckNhc2UoKSk7XG5cbmV4cG9ydCBpbnRlcmZhY2UgUmVzb3VyY2VQb2xpY3lGaW5kaW5ncyB7XG4gIC8qKiBTdGF0ZW1lbnRzIExhbWJkYSB3b3VsZCByZWplY3QgYXMgcHVibGljLiAqL1xuICByZWFkb25seSBlcnJvcnM6IHN0cmluZ1tdO1xuICAvKiogU2VydmljZSBwcmluY2lwYWxzIGFsbG93ZWQgd2l0aG91dCBhIHNvdXJjZSBjb25kaXRpb24uICovXG4gIHJlYWRvbmx5IHVuc2NvcGVkU2VydmljZXM6IHN0cmluZ1tdO1xufVxuXG4vKiogSW5zcGVjdHMgYSByZXNvbHZlZCBwb2xpY3kgZG9jdW1lbnQgKGB7IFN0YXRlbWVudDogWy4uLl0gfWApLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGluc3BlY3RSZXNvdXJjZVBvbGljeShkb2N1bWVudDogYW55KTogUmVzb3VyY2VQb2xpY3lGaW5kaW5ncyB7XG4gIGNvbnN0IGVycm9yczogc3RyaW5nW10gPSBbXTtcbiAgY29uc3QgdW5zY29wZWRTZXJ2aWNlczogc3RyaW5nW10gPSBbXTtcbiAgZm9yIChjb25zdCBbaSwgc10gb2YgKGRvY3VtZW50Py5TdGF0ZW1lbnQgPz8gW10pLmVudHJpZXMoKSkge1xuICAgIGlmIChzLkVmZmVjdCAhPT0gJ0FsbG93JykgY29udGludWU7XG4gICAgY29uc3Qga2V5cyA9IGNvbmRpdGlvbktleXMocy5Db25kaXRpb24pO1xuICAgIGNvbnN0IG5hbWUgPSBzLlNpZCA/IGBzdGF0ZW1lbnQgJyR7cy5TaWR9J2AgOiBgc3RhdGVtZW50ICR7aSArIDF9YDtcbiAgICBpZiAoaXNXaWxkY2FyZChzLlByaW5jaXBhbCkgJiYgIWtleXMuc29tZSgoaykgPT4gVFJVU1RFRF9LRVlTLmluY2x1ZGVzKGspKSkge1xuICAgICAgZXJyb3JzLnB1c2goYCR7bmFtZX0gYWxsb3dzIHByaW5jaXBhbCAnKic6IExhbWJkYSByZWplY3RzIHB1YmxpYyByZXNvdXJjZSBwb2xpY2llcy4gUGluIHRoZSBjYWxsZXIgd2l0aCBhIGNvbmRpdGlvbiBzdWNoIGFzIGF3czpQcmluY2lwYWxPcmdJRCBvciBhd3M6U291cmNlQWNjb3VudCAoZS5nLiBpYW0uT3JnYW5pemF0aW9uUHJpbmNpcGFsKSwgb3IgbmFtZSB0aGUgYWNjb3VudHNgKTtcbiAgICB9XG4gICAgY29uc3Qgc2VydmljZXMgPSBsaXN0KHMuUHJpbmNpcGFsPy5TZXJ2aWNlKS5tYXAoU3RyaW5nKTtcbiAgICBpZiAoc2VydmljZXMubGVuZ3RoID4gMCAmJiAha2V5cy5zb21lKChrKSA9PiBTT1VSQ0VfS0VZUy5pbmNsdWRlcyhrKSkpIHtcbiAgICAgIHVuc2NvcGVkU2VydmljZXMucHVzaCguLi5zZXJ2aWNlcyk7XG4gICAgfVxuICB9XG4gIHJldHVybiB7IGVycm9ycywgdW5zY29wZWRTZXJ2aWNlcyB9O1xufVxuXG5mdW5jdGlvbiBpc1dpbGRjYXJkKHByaW5jaXBhbDogYW55KTogYm9vbGVhbiB7XG4gIHJldHVybiBwcmluY2lwYWwgPT09ICcqJyB8fCBsaXN0KHByaW5jaXBhbD8uQVdTKS5pbmNsdWRlcygnKicpO1xufVxuXG5mdW5jdGlvbiBjb25kaXRpb25LZXlzKGNvbmRpdGlvbjogYW55KTogc3RyaW5nW10ge1xuICByZXR1cm4gT2JqZWN0LnZhbHVlcyhjb25kaXRpb24gPz8ge30pLmZsYXRNYXAoKGJ5S2V5OiBhbnkpID0+IE9iamVjdC5rZXlzKGJ5S2V5ID8/IHt9KSkubWFwKChrKSA9PiBrLnRvTG93ZXJDYXNlKCkpO1xufVxuXG5mdW5jdGlvbiBsaXN0KHZhbHVlOiB1bmtub3duKTogdW5rbm93bltdIHtcbiAgcmV0dXJuIHZhbHVlID09PSB1bmRlZmluZWQgPyBbXSA6IEFycmF5LmlzQXJyYXkodmFsdWUpID8gdmFsdWUgOiBbdmFsdWVdO1xufVxuIl19

package/lib/web-function-deployment.js

@@ -11,7 +11,7 @@ const MAX_STEPS = 20;
  * How an endpoint moves its traffic to a new revision.
  */
 class WebFunctionDeployment {
-    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment", version: "0.1.4" };
+    static [JSII_RTTI_SYMBOL_1] = { fqn: "@ashishpandeyone/cdk-lambda-web-function.WebFunctionDeployment", version: "0.1.5" };
     /**
      * All traffic moves to the new revision at once, as soon as it's ready (the default).
      */