cdk-factory 0.8.5__tar.gz → 0.8.7__tar.gz

cdk_factory-0.8.7/LAMBDA_PERMISSION_FIX_SUMMARY.md

@@ -0,0 +1,56 @@
+# Lambda Permission Fix - Quick Summary
+
+## The Problem
+```
+Execution failed due to configuration error: Invalid permissions on Lambda function
+```
+
+## The Root Cause
+When importing Lambda from SSM (`lambda_name` or `lambda_arn_ssm_path`), API Gateway didn't have permission to invoke it.
+
+## The Fix (One Line Change)
+Changed from:
+```python
+lambda_fn = _lambda.Function.from_function_arn(self, id, lambda_arn)
+```
+
+To:
+```python
+lambda_fn = _lambda.Function.from_function_attributes(
+    self, id,
+    function_arn=lambda_arn,
+    same_environment=True  # ← This is the key!
+)
+```
+
+Plus adding explicit permission:
+```python
+_lambda.CfnPermission(
+    self, f"lambda-permission-{suffix}",
+    action="lambda:InvokeFunction",
+    function_name=lambda_fn.function_arn,
+    principal="apigateway.amazonaws.com",
+    source_arn=f"arn:aws:execute-api:{region}:{account}:{api_id}/*/{method}{path}"
+)
+```
+
+## Why `same_environment=True`?
+- Tells CDK the Lambda is in the same account/region
+- Allows adding `CfnPermission` without validation errors
+- `from_function_arn()` creates read-only references that block permissions
+
+## What Gets Created
+A CloudFormation `AWS::Lambda::Permission` resource that grants your API Gateway invoke access to the Lambda.
+
+## Files Changed
+- `src/cdk_factory/stack_library/api_gateway/api_gateway_stack.py` - The fix
+- `tests/unit/test_api_gateway_lambda_permission.py` - New tests
+- `docs/api_gateway_lambda_permissions_fix.md` - Full documentation
+
+## Applies To
+✅ Routes with `lambda_name` (SSM auto-discovery)
+✅ Routes with `lambda_arn_ssm_path` (explicit SSM path)
+❌ Routes with `src` (inline Lambda - already works)
+
+## Deployment
+Just redeploy your API Gateway stack - no Lambda stack changes needed!

{cdk_factory-0.8.5 → cdk_factory-0.8.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cdk_factory
-Version: 0.8.5
+Version: 0.8.7
 Summary: CDK Factory. A QuickStarter and best practices setup for CDK projects
 Author-email: Eric Wilson <eric.wilson@geekcafe.com>
 License: MIT License

{cdk_factory-0.8.5 → cdk_factory-0.8.7}/pyproject.toml

@@ -33,7 +33,7 @@ markers = [
 [project]
 
 name = "cdk_factory"
-version = "0.8.5"
+version = "0.8.7"
 authors = [
   { name="Eric Wilson", email="eric.wilson@geekcafe.com" }
 ]

{cdk_factory-0.8.5 → cdk_factory-0.8.7}/src/cdk_factory/configurations/resources/cognito.py

@@ -243,3 +243,66 @@ class CognitoConfig(EnhancedBaseConfig):
     def ssm(self) -> Dict[str, Any]:
         """Whether to export the user pool name (default: False)"""
         return self.__config.get("ssm", {})
+
+    @property
+    def app_clients(self) -> list | None:
+        """
+        App clients for the user pool.
+        Supports multiple clients with different auth flows and OAuth settings.
+        
+        Structure:
+            [{
+                "name": "web-client",
+                "generate_secret": False,
+                "auth_flows": {
+                    "user_password": True,
+                    "user_srp": True,
+                    "custom": False,
+                    "admin_user_password": False
+                },
+                "oauth": {
+                    "flows": {
+                        "authorization_code_grant": True,
+                        "implicit_code_grant": False,
+                        "client_credentials": False
+                    },
+                    "scopes": ["email", "openid", "profile"],
+                    "callback_urls": ["https://example.com/callback"],
+                    "logout_urls": ["https://example.com/logout"]
+                },
+                "supported_identity_providers": ["COGNITO"],
+                "prevent_user_existence_errors": True,
+                "enable_token_revocation": True,
+                "access_token_validity": {"minutes": 60},
+                "id_token_validity": {"minutes": 60},
+                "refresh_token_validity": {"days": 30},
+                "read_attributes": ["email", "name"],
+                "write_attributes": ["name"]
+            }]
+        
+        Example:
+            [
+                {
+                    "name": "web-app",
+                    "generate_secret": False,
+                    "auth_flows": {
+                        "user_password": True,
+                        "user_srp": True
+                    }
+                },
+                {
+                    "name": "backend-service",
+                    "generate_secret": True,
+                    "oauth": {
+                        "flows": {
+                            "client_credentials": True
+                        },
+                        "scopes": ["api/read", "api/write"]
+                    }
+                }
+            ]
+        
+        Returns:
+            list: List of app client configurations
+        """
+        return self.__config.get("app_clients")

{cdk_factory-0.8.5 → cdk_factory-0.8.7}/src/cdk_factory/stack_library/api_gateway/api_gateway_stack.py

@@ -365,6 +365,7 @@ class ApiGatewayStack(IStack, EnhancedSsmParameterMixin):
         This is the NEW PATTERN for separating Lambda and API Gateway stacks.
         """
         route_path = route["path"]
+        method = route.get("method", "GET").upper()
         suffix = self._get_route_suffix(route)  # Use shared method for consistent suffix calculation
         
         # Get Lambda ARN from SSM Parameter Store
@@ -376,15 +377,30 @@ class ApiGatewayStack(IStack, EnhancedSsmParameterMixin):
                 f"Ensure Lambda stack has deployed and exported ARN to SSM."
             )
         
-        # Import Lambda function from ARN
-        lambda_fn = _lambda.Function.from_function_arn(
+        # Import Lambda function from ARN using fromFunctionAttributes
+        # This allows us to add permissions even for imported functions
+        lambda_fn = _lambda.Function.from_function_attributes(
             self,
             f"{api_id}-imported-lambda-{suffix}",
-            lambda_arn
+            function_arn=lambda_arn,
+            same_environment=True  # Allow permission grants for same-account imports
         )
         
         logger.info(f"Imported Lambda for route {route_path}: {lambda_arn}")
         
+        # Add explicit resource-based permission for this specific API Gateway
+        # This is CRITICAL for cross-stack Lambda integrations
+        _lambda.CfnPermission(
+            self,
+            f"lambda-permission-{suffix}",
+            action="lambda:InvokeFunction",
+            function_name=lambda_fn.function_arn,
+            principal="apigateway.amazonaws.com",
+            source_arn=f"arn:aws:execute-api:{self.region}:{self.account}:{api_gateway.rest_api_id}/*/{method}{route_path}"
+        )
+        
+        logger.info(f"Granted API Gateway invoke permissions for Lambda: {lambda_arn}")
+        
         # Setup API Gateway resource
         resource = (
             api_gateway.root.resource_for_path(route_path)