@mapbox/cloudfriend 7.0.0 → 7.0.1-1

package/lib/shortcuts/hookshot.js

@@ -7,6 +7,16 @@ const merge = require('../merge');
 
 const random = crypto.randomBytes(4).toString('hex');
 
+function assertNodeVersion(runtime) {
+  if (runtime.match(/^nodejs[\d+]+.x$/)) {
+    const version = runtime.match(/\d+/)[0];
+    if (Number(version) < 18)
+      throw new Error(`Only nodejs runtimes >= 18 are supported for hookshot lambdas, received: '${runtime}'`);
+  } else {
+    throw new Error(`Only valid nodejs runtimes are supported for hookshot lambdas, received: '${runtime}'`);
+  }
+}
+
 /**
  * The hookshot.Passthrough class defines resources that set up a single API Gateway
  * endpoint that responds to `POST` and `OPTIONS` requests. You are expected to
@@ -86,6 +96,8 @@ class Passthrough {
       WebhookSecret
     } = options;
 
+    if (options.Runtime) assertNodeVersion(options.Runtime);
+
     let {
       LoggingLevel = 'OFF'
     } = options;
@@ -260,10 +272,9 @@ class Passthrough {
   code() {
     return {
       'Fn::Sub': redent(`
-        'use strict';
 
-        const AWS = require('aws-sdk');
-        const lambda = new AWS.Lambda();
+        const { InvokeCommand, LambdaClient } = require('@aws-sdk/client-lambda');
+        const client = new LambdaClient();
 
         module.exports.lambda = (event, context, callback) => {
           if (event.httpMethod === 'OPTIONS') {
@@ -280,17 +291,17 @@ class Passthrough {
             return callback(null, response);
           }
 
-          const lambdaParams = {
+          const command = new InvokeCommand({
             FunctionName: '\${${this.PassthroughTo}}',
             Payload: JSON.stringify(event)
-          };
+          });
 
-          lambda.invoke(lambdaParams).promise()
+          client.send(command)
             .then((response) => {
               if (!response || !response.Payload)
                 return callback(new Error('Your Lambda function ${this.PassthroughTo} did not provide a payload'));
 
-              var payload = JSON.parse(response.Payload);
+              var payload = JSON.parse(Buffer.from(response.Payload).toString());
               payload.headers = payload.headers || {};
               payload.headers['Access-Control-Allow-Origin'] = '*';
               callback(null, payload);
@@ -420,8 +431,8 @@ class Github extends Passthrough {
           'use strict';
 
           const crypto = require('crypto');
-          const AWS = require('aws-sdk');
-          const lambda = new AWS.Lambda();
+          const { InvokeCommand, LambdaClient } = require('@aws-sdk/client-lambda');
+          const client = new LambdaClient();
           const secret = '\${WebhookSecret}';
 
           module.exports.lambda = (event, context, callback) => {
@@ -436,13 +447,13 @@ class Github extends Passthrough {
 
             if (body.zen) return callback(null, 'ignored ping request');
 
-            const lambdaParams = {
+            const command = new InvokeCommand({
               FunctionName: '\${${this.PassthroughTo}}',
               Payload: JSON.stringify(event.body),
               InvocationType: 'Event'
-            };
+            });
 
-            lambda.invoke(lambdaParams).promise()
+            client.send(command)
               .then(() => callback(null, 'success'))
               .catch((err) => callback(err));
           };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mapbox/cloudfriend",
-  "version": "7.0.0",
+  "version": "7.0.1-1",
   "description": "Helper functions for assembling CloudFormation templates in JavaScript",
   "main": "index.js",
   "engines": {

package/test/fixtures/shortcuts/hookshot-github-compatible-legacy-node-runtimes.json

@@ -0,0 +1,423 @@
+{
+  "AWSTemplateFormatVersion": "2010-09-09",
+  "Metadata": {},
+  "Parameters": {},
+  "Rules": {},
+  "Mappings": {},
+  "Conditions": {},
+  "Resources": {
+    "PassApi": {
+      "Type": "AWS::ApiGateway::RestApi",
+      "Properties": {
+        "Name": {
+          "Fn::Sub": "${AWS::StackName}-webhook"
+        },
+        "FailOnWarnings": true,
+        "EndpointConfiguration": {
+          "Types": [
+            "REGIONAL"
+          ]
+        }
+      }
+    },
+    "PassStage": {
+      "Type": "AWS::ApiGateway::Stage",
+      "Properties": {
+        "DeploymentId": {
+          "Ref": "PassDeployment5dcf4ca7"
+        },
+        "StageName": "hookshot",
+        "RestApiId": {
+          "Ref": "PassApi"
+        },
+        "MethodSettings": [
+          {
+            "HttpMethod": "*",
+            "ResourcePath": "/*",
+            "ThrottlingBurstLimit": 20,
+            "ThrottlingRateLimit": 5,
+            "LoggingLevel": "OFF",
+            "DataTraceEnabled": false,
+            "MetricsEnabled": false
+          }
+        ]
+      }
+    },
+    "PassDeployment5dcf4ca7": {
+      "Type": "AWS::ApiGateway::Deployment",
+      "DependsOn": "PassMethod",
+      "Properties": {
+        "RestApiId": {
+          "Ref": "PassApi"
+        },
+        "StageName": "unused"
+      }
+    },
+    "PassResource": {
+      "Type": "AWS::ApiGateway::Resource",
+      "Properties": {
+        "ParentId": {
+          "Fn::GetAtt": [
+            "PassApi",
+            "RootResourceId"
+          ]
+        },
+        "RestApiId": {
+          "Ref": "PassApi"
+        },
+        "PathPart": "webhook"
+      }
+    },
+    "PassMethod": {
+      "Type": "AWS::ApiGateway::Method",
+      "Properties": {
+        "RestApiId": {
+          "Ref": "PassApi"
+        },
+        "ResourceId": {
+          "Ref": "PassResource"
+        },
+        "ApiKeyRequired": false,
+        "AuthorizationType": "NONE",
+        "HttpMethod": "POST",
+        "Integration": {
+          "Type": "AWS",
+          "IntegrationHttpMethod": "POST",
+          "IntegrationResponses": [
+            {
+              "StatusCode": "200"
+            },
+            {
+              "StatusCode": "500",
+              "SelectionPattern": "^error.*"
+            },
+            {
+              "StatusCode": "403",
+              "SelectionPattern": "^invalid.*"
+            }
+          ],
+          "Uri": {
+            "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${PassFunction.Arn}/invocations"
+          },
+          "RequestTemplates": {
+            "application/json": "{\"signature\":\"$input.params('X-Hub-Signature')\",\"body\":$input.json('$')}"
+          }
+        },
+        "MethodResponses": [
+          {
+            "StatusCode": "200",
+            "ResponseModels": {
+              "application/json": "Empty"
+            }
+          },
+          {
+            "StatusCode": "500",
+            "ResponseModels": {
+              "application/json": "Empty"
+            }
+          },
+          {
+            "StatusCode": "403",
+            "ResponseModels": {
+              "application/json": "Empty"
+            }
+          }
+        ]
+      }
+    },
+    "PassPermission": {
+      "Type": "AWS::Lambda::Permission",
+      "Properties": {
+        "FunctionName": {
+          "Ref": "PassFunction"
+        },
+        "Action": "lambda:InvokeFunction",
+        "Principal": "apigateway.amazonaws.com",
+        "SourceArn": {
+          "Fn::Sub": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${PassApi}/*"
+        }
+      }
+    },
+    "PassFunctionLogs": {
+      "Type": "AWS::Logs::LogGroup",
+      "Properties": {
+        "LogGroupName": {
+          "Fn::Sub": [
+            "/aws/lambda/${name}",
+            {
+              "name": {
+                "Fn::Sub": "${AWS::StackName}-Pass"
+              }
+            }
+          ]
+        },
+        "RetentionInDays": 14
+      }
+    },
+    "PassFunction": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "ZipFile": {
+            "Fn::Sub": [
+              "'use strict';\n\nconst crypto = require('crypto');\nconst { InvokeCommand, LambdaClient } = require('@aws-sdk/client-lambda');\nconst client = new LambdaClient();\nconst secret = '${WebhookSecret}';\n\nmodule.exports.lambda = (event, context, callback) => {\n  const body = event.body;\n  const hash = 'sha1=' + crypto\n    .createHmac('sha1', secret)\n    .update(new Buffer(JSON.stringify(body)))\n    .digest('hex');\n\n  if (event.signature !== hash)\n    return callback('invalid: signature does not match');\n\n  if (body.zen) return callback(null, 'ignored ping request');\n\n  const command = new InvokeCommand({\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event.body),\n    InvocationType: 'Event'\n  });\n\n  client.send(command)\n    .then(() => callback(null, 'success'))\n    .catch((err) => callback(err));\n};",
+              {
+                "WebhookSecret": "abc123"
+              }
+            ]
+          }
+        },
+        "Description": {
+          "Fn::Sub": "Passthrough function for ${AWS::StackName}"
+        },
+        "FunctionName": {
+          "Fn::Sub": "${AWS::StackName}-Pass"
+        },
+        "Handler": "index.lambda",
+        "MemorySize": 128,
+        "Runtime": "nodejs16.x",
+        "Timeout": 30,
+        "Role": {
+          "Fn::GetAtt": [
+            "PassFunctionRole",
+            "Arn"
+          ]
+        }
+      }
+    },
+    "PassFunctionErrorAlarm": {
+      "Type": "AWS::CloudWatch::Alarm",
+      "Properties": {
+        "AlarmName": {
+          "Fn::Sub": "${AWS::StackName}-PassFunction-Errors-${AWS::Region}"
+        },
+        "AlarmDescription": {
+          "Fn::Sub": [
+            "Error alarm for ${name} lambda function in ${AWS::StackName} stack",
+            {
+              "name": {
+                "Fn::Sub": "${AWS::StackName}-Pass"
+              }
+            }
+          ]
+        },
+        "AlarmActions": [],
+        "Period": 60,
+        "EvaluationPeriods": 1,
+        "DatapointsToAlarm": 1,
+        "Statistic": "Sum",
+        "Threshold": 0,
+        "ComparisonOperator": "GreaterThanThreshold",
+        "TreatMissingData": "notBreaching",
+        "Namespace": "AWS/Lambda",
+        "Dimensions": [
+          {
+            "Name": "FunctionName",
+            "Value": {
+              "Ref": "PassFunction"
+            }
+          }
+        ],
+        "MetricName": "Errors"
+      }
+    },
+    "PassFunctionLogPolicy": {
+      "Type": "AWS::IAM::Policy",
+      "DependsOn": "PassFunctionRole",
+      "Properties": {
+        "PolicyName": "lambda-log-access",
+        "Roles": [
+          {
+            "Ref": "PassFunctionRole"
+          }
+        ],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Action": "logs:*",
+              "Resource": {
+                "Fn::GetAtt": [
+                  "PassFunctionLogs",
+                  "Arn"
+                ]
+              }
+            }
+          ]
+        }
+      }
+    },
+    "PassFunctionRole": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Action": "sts:AssumeRole",
+              "Principal": {
+                "Service": {
+                  "Fn::Sub": "lambda.amazonaws.com"
+                }
+              }
+            }
+          ]
+        },
+        "Policies": [
+          {
+            "PolicyName": "main",
+            "PolicyDocument": {
+              "Version": "2012-10-17",
+              "Statement": [
+                {
+                  "Effect": "Allow",
+                  "Action": "lambda:InvokeFunction",
+                  "Resource": {
+                    "Fn::GetAtt": [
+                      "Destination",
+                      "Arn"
+                    ]
+                  }
+                }
+              ]
+            }
+          }
+        ]
+      }
+    },
+    "DestinationLogs": {
+      "Type": "AWS::Logs::LogGroup",
+      "Properties": {
+        "LogGroupName": {
+          "Fn::Sub": [
+            "/aws/lambda/${name}",
+            {
+              "name": {
+                "Fn::Sub": "${AWS::StackName}-Destination"
+              }
+            }
+          ]
+        },
+        "RetentionInDays": 14
+      }
+    },
+    "Destination": {
+      "Type": "AWS::Lambda::Function",
+      "Properties": {
+        "Code": {
+          "ZipFile": "module.exports.handler = (e, c, cb) => cb();"
+        },
+        "Description": {
+          "Fn::Sub": "Destination in the ${AWS::StackName} stack"
+        },
+        "FunctionName": {
+          "Fn::Sub": "${AWS::StackName}-Destination"
+        },
+        "Handler": "index.handler",
+        "MemorySize": 128,
+        "Runtime": "nodejs18.x",
+        "Timeout": 300,
+        "Role": {
+          "Fn::GetAtt": [
+            "DestinationRole",
+            "Arn"
+          ]
+        }
+      }
+    },
+    "DestinationErrorAlarm": {
+      "Type": "AWS::CloudWatch::Alarm",
+      "Properties": {
+        "AlarmName": {
+          "Fn::Sub": "${AWS::StackName}-Destination-Errors-${AWS::Region}"
+        },
+        "AlarmDescription": {
+          "Fn::Sub": [
+            "Error alarm for ${name} lambda function in ${AWS::StackName} stack",
+            {
+              "name": {
+                "Fn::Sub": "${AWS::StackName}-Destination"
+              }
+            }
+          ]
+        },
+        "AlarmActions": [],
+        "Period": 60,
+        "EvaluationPeriods": 5,
+        "DatapointsToAlarm": 1,
+        "Statistic": "Sum",
+        "Threshold": 0,
+        "ComparisonOperator": "GreaterThanThreshold",
+        "TreatMissingData": "notBreaching",
+        "Namespace": "AWS/Lambda",
+        "Dimensions": [
+          {
+            "Name": "FunctionName",
+            "Value": {
+              "Ref": "Destination"
+            }
+          }
+        ],
+        "MetricName": "Errors"
+      }
+    },
+    "DestinationLogPolicy": {
+      "Type": "AWS::IAM::Policy",
+      "DependsOn": "DestinationRole",
+      "Properties": {
+        "PolicyName": "lambda-log-access",
+        "Roles": [
+          {
+            "Ref": "DestinationRole"
+          }
+        ],
+        "PolicyDocument": {
+          "Version": "2012-10-17",
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Action": "logs:*",
+              "Resource": {
+                "Fn::GetAtt": [
+                  "DestinationLogs",
+                  "Arn"
+                ]
+              }
+            }
+          ]
+        }
+      }
+    },
+    "DestinationRole": {
+      "Type": "AWS::IAM::Role",
+      "Properties": {
+        "AssumeRolePolicyDocument": {
+          "Statement": [
+            {
+              "Effect": "Allow",
+              "Action": "sts:AssumeRole",
+              "Principal": {
+                "Service": {
+                  "Fn::Sub": "lambda.amazonaws.com"
+                }
+              }
+            }
+          ]
+        }
+      }
+    }
+  },
+  "Outputs": {
+    "PassEndpointOutput": {
+      "Description": "The HTTPS endpoint used to send github webhooks",
+      "Value": {
+        "Fn::Sub": "https://${PassApi}.execute-api.${AWS::Region}.amazonaws.com/hookshot/webhook"
+      }
+    },
+    "PassSecretOutput": {
+      "Description": "A secret key to give Github to use when signing webhook requests",
+      "Value": "abc123"
+    }
+  }
+}

package/test/fixtures/shortcuts/hookshot-github-secret-ref.json

@@ -28,7 +28,7 @@
       "Type": "AWS::ApiGateway::Stage",
       "Properties": {
         "DeploymentId": {
-          "Ref": "PassDeployment0e352c83"
+          "Ref": "PassDeployment467809dc"
         },
         "StageName": "hookshot",
         "RestApiId": {
@@ -47,7 +47,7 @@
         ]
       }
     },
-    "PassDeployment0e352c83": {
+    "PassDeployment467809dc": {
       "Type": "AWS::ApiGateway::Deployment",
       "DependsOn": "PassMethod",
       "Properties": {
@@ -164,7 +164,7 @@
         "Code": {
           "ZipFile": {
             "Fn::Sub": [
-              "'use strict';\n\nconst crypto = require('crypto');\nconst AWS = require('aws-sdk');\nconst lambda = new AWS.Lambda();\nconst secret = '${WebhookSecret}';\n\nmodule.exports.lambda = (event, context, callback) => {\n  const body = event.body;\n  const hash = 'sha1=' + crypto\n    .createHmac('sha1', secret)\n    .update(new Buffer(JSON.stringify(body)))\n    .digest('hex');\n\n  if (event.signature !== hash)\n    return callback('invalid: signature does not match');\n\n  if (body.zen) return callback(null, 'ignored ping request');\n\n  const lambdaParams = {\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event.body),\n    InvocationType: 'Event'\n  };\n\n  lambda.invoke(lambdaParams).promise()\n    .then(() => callback(null, 'success'))\n    .catch((err) => callback(err));\n};",
+              "'use strict';\n\nconst crypto = require('crypto');\nconst { InvokeCommand, LambdaClient } = require('@aws-sdk/client-lambda');\nconst client = new LambdaClient();\nconst secret = '${WebhookSecret}';\n\nmodule.exports.lambda = (event, context, callback) => {\n  const body = event.body;\n  const hash = 'sha1=' + crypto\n    .createHmac('sha1', secret)\n    .update(new Buffer(JSON.stringify(body)))\n    .digest('hex');\n\n  if (event.signature !== hash)\n    return callback('invalid: signature does not match');\n\n  if (body.zen) return callback(null, 'ignored ping request');\n\n  const command = new InvokeCommand({\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event.body),\n    InvocationType: 'Event'\n  });\n\n  client.send(command)\n    .then(() => callback(null, 'success'))\n    .catch((err) => callback(err));\n};",
               {
                 "WebhookSecret": {
                   "Ref": "SomeParameter"

package/test/fixtures/shortcuts/hookshot-github-secret-string.json

@@ -24,7 +24,7 @@
       "Type": "AWS::ApiGateway::Stage",
       "Properties": {
         "DeploymentId": {
-          "Ref": "PassDeployment0e352c83"
+          "Ref": "PassDeployment467809dc"
         },
         "StageName": "hookshot",
         "RestApiId": {
@@ -43,7 +43,7 @@
         ]
       }
     },
-    "PassDeployment0e352c83": {
+    "PassDeployment467809dc": {
       "Type": "AWS::ApiGateway::Deployment",
       "DependsOn": "PassMethod",
       "Properties": {
@@ -160,7 +160,7 @@
         "Code": {
           "ZipFile": {
             "Fn::Sub": [
-              "'use strict';\n\nconst crypto = require('crypto');\nconst AWS = require('aws-sdk');\nconst lambda = new AWS.Lambda();\nconst secret = '${WebhookSecret}';\n\nmodule.exports.lambda = (event, context, callback) => {\n  const body = event.body;\n  const hash = 'sha1=' + crypto\n    .createHmac('sha1', secret)\n    .update(new Buffer(JSON.stringify(body)))\n    .digest('hex');\n\n  if (event.signature !== hash)\n    return callback('invalid: signature does not match');\n\n  if (body.zen) return callback(null, 'ignored ping request');\n\n  const lambdaParams = {\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event.body),\n    InvocationType: 'Event'\n  };\n\n  lambda.invoke(lambdaParams).promise()\n    .then(() => callback(null, 'success'))\n    .catch((err) => callback(err));\n};",
+              "'use strict';\n\nconst crypto = require('crypto');\nconst { InvokeCommand, LambdaClient } = require('@aws-sdk/client-lambda');\nconst client = new LambdaClient();\nconst secret = '${WebhookSecret}';\n\nmodule.exports.lambda = (event, context, callback) => {\n  const body = event.body;\n  const hash = 'sha1=' + crypto\n    .createHmac('sha1', secret)\n    .update(new Buffer(JSON.stringify(body)))\n    .digest('hex');\n\n  if (event.signature !== hash)\n    return callback('invalid: signature does not match');\n\n  if (body.zen) return callback(null, 'ignored ping request');\n\n  const command = new InvokeCommand({\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event.body),\n    InvocationType: 'Event'\n  });\n\n  client.send(command)\n    .then(() => callback(null, 'success'))\n    .catch((err) => callback(err));\n};",
               {
                 "WebhookSecret": "abc123"
               }

package/test/fixtures/shortcuts/hookshot-github.json

@@ -24,7 +24,7 @@
       "Type": "AWS::ApiGateway::Stage",
       "Properties": {
         "DeploymentId": {
-          "Ref": "PassDeployment0e352c83"
+          "Ref": "PassDeployment467809dc"
         },
         "StageName": "hookshot",
         "RestApiId": {
@@ -43,7 +43,7 @@
         ]
       }
     },
-    "PassDeployment0e352c83": {
+    "PassDeployment467809dc": {
       "Type": "AWS::ApiGateway::Deployment",
       "DependsOn": "PassMethod",
       "Properties": {
@@ -166,7 +166,7 @@
         "Code": {
           "ZipFile": {
             "Fn::Sub": [
-              "'use strict';\n\nconst crypto = require('crypto');\nconst AWS = require('aws-sdk');\nconst lambda = new AWS.Lambda();\nconst secret = '${WebhookSecret}';\n\nmodule.exports.lambda = (event, context, callback) => {\n  const body = event.body;\n  const hash = 'sha1=' + crypto\n    .createHmac('sha1', secret)\n    .update(new Buffer(JSON.stringify(body)))\n    .digest('hex');\n\n  if (event.signature !== hash)\n    return callback('invalid: signature does not match');\n\n  if (body.zen) return callback(null, 'ignored ping request');\n\n  const lambdaParams = {\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event.body),\n    InvocationType: 'Event'\n  };\n\n  lambda.invoke(lambdaParams).promise()\n    .then(() => callback(null, 'success'))\n    .catch((err) => callback(err));\n};",
+              "'use strict';\n\nconst crypto = require('crypto');\nconst { InvokeCommand, LambdaClient } = require('@aws-sdk/client-lambda');\nconst client = new LambdaClient();\nconst secret = '${WebhookSecret}';\n\nmodule.exports.lambda = (event, context, callback) => {\n  const body = event.body;\n  const hash = 'sha1=' + crypto\n    .createHmac('sha1', secret)\n    .update(new Buffer(JSON.stringify(body)))\n    .digest('hex');\n\n  if (event.signature !== hash)\n    return callback('invalid: signature does not match');\n\n  if (body.zen) return callback(null, 'ignored ping request');\n\n  const command = new InvokeCommand({\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event.body),\n    InvocationType: 'Event'\n  });\n\n  client.send(command)\n    .then(() => callback(null, 'success'))\n    .catch((err) => callback(err));\n};",
               {
                 "WebhookSecret": {
                   "Ref": "PassSecret"

package/test/fixtures/shortcuts/hookshot-passthrough-access-log-format.json

@@ -24,7 +24,7 @@
       "Type": "AWS::ApiGateway::Stage",
       "Properties": {
         "DeploymentId": {
-          "Ref": "PassDeployment0e352c83"
+          "Ref": "PassDeployment467809dc"
         },
         "StageName": "hookshot",
         "RestApiId": {
@@ -52,7 +52,7 @@
         }
       }
     },
-    "PassDeployment0e352c83": {
+    "PassDeployment467809dc": {
       "Type": "AWS::ApiGateway::Deployment",
       "DependsOn": "PassMethod",
       "Properties": {
@@ -168,7 +168,7 @@
       "Properties": {
         "Code": {
           "ZipFile": {
-            "Fn::Sub": "'use strict';\n\nconst AWS = require('aws-sdk');\nconst lambda = new AWS.Lambda();\n\nmodule.exports.lambda = (event, context, callback) => {\n  if (event.httpMethod === 'OPTIONS') {\n    const requestHeaders = event.headers['Access-Control-Request-Headers'] || event.headers['access-control-request-headers'];\n    const response = {\n      statusCode: 200,\n      body: '',\n      headers: {\n        'Access-Control-Allow-Headers': requestHeaders,\n        'Access-Control-Allow-Methods': 'POST, OPTIONS',\n        'Access-Control-Allow-Origin': '*'\n      }\n    };\n    return callback(null, response);\n  }\n\n  const lambdaParams = {\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event)\n  };\n\n  lambda.invoke(lambdaParams).promise()\n    .then((response) => {\n      if (!response || !response.Payload)\n        return callback(new Error('Your Lambda function Destination did not provide a payload'));\n\n      var payload = JSON.parse(response.Payload);\n      payload.headers = payload.headers || {};\n      payload.headers['Access-Control-Allow-Origin'] = '*';\n      callback(null, payload);\n    })\n    .catch((err) => callback(err));\n};"
+            "Fn::Sub": "const { InvokeCommand, LambdaClient } = require('@aws-sdk/client-lambda');\nconst client = new LambdaClient();\n\nmodule.exports.lambda = (event, context, callback) => {\n  if (event.httpMethod === 'OPTIONS') {\n    const requestHeaders = event.headers['Access-Control-Request-Headers'] || event.headers['access-control-request-headers'];\n    const response = {\n      statusCode: 200,\n      body: '',\n      headers: {\n        'Access-Control-Allow-Headers': requestHeaders,\n        'Access-Control-Allow-Methods': 'POST, OPTIONS',\n        'Access-Control-Allow-Origin': '*'\n      }\n    };\n    return callback(null, response);\n  }\n\n  const command = new InvokeCommand({\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event)\n  });\n\n  client.send(command)\n    .then((response) => {\n      if (!response || !response.Payload)\n        return callback(new Error('Your Lambda function Destination did not provide a payload'));\n\n      var payload = JSON.parse(Buffer.from(response.Payload).toString());\n      payload.headers = payload.headers || {};\n      payload.headers['Access-Control-Allow-Origin'] = '*';\n      callback(null, payload);\n    })\n    .catch((err) => callback(err));\n};"
           }
         },
         "Description": {

package/test/fixtures/shortcuts/hookshot-passthrough-alarms.json

@@ -24,7 +24,7 @@
       "Type": "AWS::ApiGateway::Stage",
       "Properties": {
         "DeploymentId": {
-          "Ref": "PassDeployment0e352c83"
+          "Ref": "PassDeployment467809dc"
         },
         "StageName": "hookshot",
         "RestApiId": {
@@ -43,7 +43,7 @@
         ]
       }
     },
-    "PassDeployment0e352c83": {
+    "PassDeployment467809dc": {
       "Type": "AWS::ApiGateway::Deployment",
       "DependsOn": "PassMethod",
       "Properties": {
@@ -150,7 +150,7 @@
       "Properties": {
         "Code": {
           "ZipFile": {
-            "Fn::Sub": "'use strict';\n\nconst AWS = require('aws-sdk');\nconst lambda = new AWS.Lambda();\n\nmodule.exports.lambda = (event, context, callback) => {\n  if (event.httpMethod === 'OPTIONS') {\n    const requestHeaders = event.headers['Access-Control-Request-Headers'] || event.headers['access-control-request-headers'];\n    const response = {\n      statusCode: 200,\n      body: '',\n      headers: {\n        'Access-Control-Allow-Headers': requestHeaders,\n        'Access-Control-Allow-Methods': 'POST, OPTIONS',\n        'Access-Control-Allow-Origin': '*'\n      }\n    };\n    return callback(null, response);\n  }\n\n  const lambdaParams = {\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event)\n  };\n\n  lambda.invoke(lambdaParams).promise()\n    .then((response) => {\n      if (!response || !response.Payload)\n        return callback(new Error('Your Lambda function Destination did not provide a payload'));\n\n      var payload = JSON.parse(response.Payload);\n      payload.headers = payload.headers || {};\n      payload.headers['Access-Control-Allow-Origin'] = '*';\n      callback(null, payload);\n    })\n    .catch((err) => callback(err));\n};"
+            "Fn::Sub": "const { InvokeCommand, LambdaClient } = require('@aws-sdk/client-lambda');\nconst client = new LambdaClient();\n\nmodule.exports.lambda = (event, context, callback) => {\n  if (event.httpMethod === 'OPTIONS') {\n    const requestHeaders = event.headers['Access-Control-Request-Headers'] || event.headers['access-control-request-headers'];\n    const response = {\n      statusCode: 200,\n      body: '',\n      headers: {\n        'Access-Control-Allow-Headers': requestHeaders,\n        'Access-Control-Allow-Methods': 'POST, OPTIONS',\n        'Access-Control-Allow-Origin': '*'\n      }\n    };\n    return callback(null, response);\n  }\n\n  const command = new InvokeCommand({\n    FunctionName: '${Destination}',\n    Payload: JSON.stringify(event)\n  });\n\n  client.send(command)\n    .then((response) => {\n      if (!response || !response.Payload)\n        return callback(new Error('Your Lambda function Destination did not provide a payload'));\n\n      var payload = JSON.parse(Buffer.from(response.Payload).toString());\n      payload.headers = payload.headers || {};\n      payload.headers['Access-Control-Allow-Origin'] = '*';\n      callback(null, payload);\n    })\n    .catch((err) => callback(err));\n};"
           }
         },
         "Description": {