terraconstructs 0.1.4 → 0.1.6

package/lib/aws/compute/function.d.ts

@@ -10,10 +10,12 @@ import { AliasOptions, Alias } from "./function-alias";
 import { LambdaFunctionBase, IFunction, FunctionAttributes, IEventSource } from "./function-base";
 import { FunctionUrl, FunctionUrlOptions } from "./function-url";
 import { VpcConfig } from "./function-vpc-config.generated";
+import { Runtime } from "./runtime";
+import { ISecurityGroup } from "./security-group";
+import { IVpc, SubnetSelection } from "./vpc";
 import { Duration } from "../../duration";
 import * as iam from "../iam";
 import { IQueue } from "../notify";
-import { Runtime } from "./runtime";
 export interface FunctionOutputs {
     /**
      * AWS Lambda function name
@@ -131,6 +133,14 @@ export interface FunctionOptions extends EventInvokeConfigOptions {
      * Both supplied and generated roles can always be changed by calling `addToRolePolicy`.
      */
     readonly role?: iam.IRole;
+    /**
+     * Lambda Functions in a public subnet can NOT access the internet.
+     * Use this property to acknowledge this limitation and still place the function in a public subnet.
+     * @see https://stackoverflow.com/questions/52992085/why-cant-an-aws-lambda-function-inside-a-public-subnet-in-a-vpc-connect-to-the/52994841#52994841
+     *
+     * @default false
+     */
+    readonly allowPublicSubnet?: boolean;
     /**
      * Config for network connectivity to AWS resources in a VPC, specify a list
      * of subnet, and optionally security groups, in the VPC.
@@ -141,8 +151,74 @@ export interface FunctionOptions extends EventInvokeConfigOptions {
      * When you connect a function to a VPC, it can only access resources and the internet through that VPC.
      *
      * See [VPC Settings](https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html).
+     *
+     * @deprecated - This property is deprecated, use vpc and other related properties instead
      */
     readonly networkConfig?: VpcConfig;
+    /**
+     * VPC network to place Lambda network interfaces
+     *
+     * Specify this if the Lambda function needs to access resources in a VPC.
+     * This is required when `vpcSubnets` is specified.
+     *
+     * @default - Function is not placed within a VPC.
+     */
+    readonly vpc?: IVpc;
+    /**
+     * Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets.
+     *
+     * Only used if 'vpc' is supplied.
+     *
+     * @default false
+     */
+    readonly ipv6AllowedForDualStack?: boolean;
+    /**
+     * Where to place the network interfaces within the VPC.
+     *
+     * This requires `vpc` to be specified in order for interfaces to actually be
+     * placed in the subnets. If `vpc` is not specify, this will raise an error.
+     *
+     * Note: Internet access for Lambda Functions requires a NAT Gateway, so picking
+     * public subnets is not allowed (unless `allowPublicSubnet` is set to `true`).
+     *
+     * @default - the Vpc default strategy if not specified
+     */
+    readonly vpcSubnets?: SubnetSelection;
+    /**
+     * The list of security groups to associate with the Lambda's network interfaces.
+     *
+     * Only used if 'vpc' is supplied.
+     *
+     * @default - If the function is placed within a VPC and a security group is
+     * not specified, either by this or securityGroup prop, a dedicated security
+     * group will be created for this function.
+     */
+    readonly securityGroups?: ISecurityGroup[];
+    /**
+     * Whether to allow the Lambda to send all network traffic (except ipv6)
+     *
+     * If set to false, you must individually add traffic rules to allow the
+     * Lambda to connect to network targets.
+     *
+     * Do not specify this property if the `securityGroups` or `securityGroup` property is set.
+     * Instead, configure `allowAllOutbound` directly on the security group.
+     *
+     * @default true
+     */
+    readonly allowAllOutbound?: boolean;
+    /**
+     * Whether to allow the Lambda to send all ipv6 network traffic
+     *
+     * If set to true, there will only be a single egress rule which allows all
+     * outbound ipv6 traffic. If set to false, you must individually add traffic rules to allow the
+     * Lambda to connect to network targets using ipv6.
+     *
+     * Do not specify this property if the `securityGroups` or `securityGroup` property is set.
+     * Instead, configure `allowAllIpv6Outbound` directly on the security group.
+     *
+     * @default false
+     */
+    readonly allowAllIpv6Outbound?: boolean;
     /**
      * The SQS DLQ.
      *
@@ -327,6 +403,10 @@ export declare class LambdaFunction extends LambdaFunctionBase implements IFunct
      * Undefined if the function was imported without a role.
      */
     readonly role?: iam.IRole;
+    /**
+     * The runtime configured for this lambda.
+     */
+    readonly runtime: Runtime;
     /**
      * The DLQ (as queue) associated with this Lambda Function (this is an optional attribute).
      */
@@ -415,6 +495,13 @@ export declare class LambdaFunction extends LambdaFunctionBase implements IFunct
      * Optionally create LambdaFunctionVpcConfig
      */
     private parseVpcConfig;
+    /**
+     * If configured, set up the VPC-related properties
+     *
+     * Returns the VpcConfig that should be added to the
+     * Lambda creation properties.
+     */
+    private configureVpc;
     private isQueue;
     private buildDeadLetterQueue;
     /**