newrelic-lambda-cli 0.9.9__tar.gz → 0.9.11__tar.gz

{newrelic_lambda_cli-0.9.9 → newrelic_lambda_cli-0.9.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: newrelic-lambda-cli
-Version: 0.9.9
+Version: 0.9.11
 Summary: A CLI to install the New Relic AWS Lambda integration and layers.
 Home-page: https://github.com/newrelic/newrelic-lambda-cli
 Author: New Relic
@@ -126,6 +126,9 @@ newrelic-lambda integrations install \
 | `--nr-api-key` or `-k` | Yes | Your [New Relic User API Key](https://docs.newrelic.com/docs/apis/get-started/intro-apis/types-new-relic-api-keys#user-api-key). Can also use the `NEW_RELIC_API_KEY` environment variable. |
 | `--linked-account-name` or `-n` | No | A label for the New Relic Linked Account. This is how this integration will appear in New Relic. Defaults to "New Relic Lambda Integration - <AWS Account ID>". |
 | `--enable-logs` or `-e` | No | Enables forwarding logs to New Relic Logging. This is disabled by default. Make sure you run `newrelic-lambda subscriptions install --function ... --filter-pattern ""` afterwards. |
+| `--enable-license-key-secret` | No | Securely manages and store your New Relic license key in `AWS Secrets Manager` |
+| `--enable-cw-ingest` | No | Enable the CloudWatch `log ingest` function |
+| `--disable-cw-ingest` | No | Disable the CloudWatch `log ingest` function |
 | `--memory-size` or `-m` | No | Memory size (in MiB) for the New Relic log ingestion function. Default to 128MB. |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. |
 | `--timeout` or `-t` | No | Timeout (in seconds) for the New Relic log ingestion function. Defaults to 30 seconds. |
@@ -171,6 +174,7 @@ newrelic-lambda integrations update \
 | `--disable-logs` or `-d` | No | Disables forwarding logs to New Relic Logging. Make sure you run `newrelic-lambda subscriptions install --function ...` afterwards. |
 | `--enable-logs` or `-e` | No | Enables forwarding logs to New Relic Logging. Make sure you run `newrelic-lambda subscriptions install --function ... --filter-pattern ""` afterwards. |
 | `--memory-size` or `-m` | No | Memory size (in MiB) for the New Relic log ingestion function. |
+| `--enable-license-key-secret` | No | Securely manages and store your New Relic license key in `AWS Secrets Manager` |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. |
 | `--timeout` or `-t` | No | Timeout (in seconds) for the New Relic log ingestion function. |
 | `--role-name` | No | Role name for the ingestion function. If you prefer to create and manage an IAM role for the function to assume out of band, do so and specify that role's name here. This avoids needing CAPABILITY_IAM. |
@@ -198,11 +202,16 @@ newrelic-lambda layers install \
 | `--layer-arn` or `-l` | No | Specify a specific layer version ARN to use. This is auto detected by default. |
 | `--upgrade` or `-u` | No | Permit upgrade to the latest layer version for this region and runtime. |
 | `--disable-extension` | No | Disable the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). |
-| `--enable-extension-function-logs` | No | Enable forwarding logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). Disabled by default. |
+| `--enable-extension-function-logs` or `--send-function-logs` | No | Enable sending Lambda function logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). Disabled by default. |
+| `--disable-extension-function-logs` or `--disable-function-logs` | No | Disable sending Lambda function logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension).|
+| `--send-extension-logs` | No | Enable forwarding logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). Disabled by default. |
+| `--disable-extension-logs` | No | Disable forwarding logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension).|
 | `--aws-profile` or `-p` | No | The AWS profile to use for this command. Can also use `AWS_PROFILE`. Will also check `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables if not using AWS CLI. |
 | `--aws-region` or `-r` | No | The AWS region this function is located. Can use `AWS_DEFAULT_REGION` environment variable. Defaults to AWS session region. |
 | `--nr-api-key` or `-k` | No | Your [New Relic User API Key](https://docs.newrelic.com/docs/apis/get-started/intro-apis/types-new-relic-api-keys#user-api-key). Can also use the `NEW_RELIC_API_KEY` environment variable. Only used if `--enable-extension` is set and there is no New Relic license key in AWS Secrets Manager. |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. Only used if `--enable-extension` is set and there is no New Relic license key in AWS Secrets Manager. |
+| `--nr-env-delimite` | No | Set `NR_ENV_DELIMITER` environment variable for your Lambda Function |
+| `--nr-tags` | No | Set `NR_TAGS` environment variable for your Lambda Function |
 | `--java_handler_method` or `-j` | No | For java runtimes only to specify an aws implementation method. Defaults to RequestHandler. Optional inputs are: handleRequest, handleStreamsRequest `--java_handler_method handleStreamsRequest`. |
 | `--esm` | No |  For Node.js functions using ES Modules (ESM), enable the specific ESM wrapper during installation (e.g., using the --esm flag). This sets the Lambda handler to `/opt/nodejs/node_modules/newrelic-esm-lambda-wrapper/index.handler`. |
 

{newrelic_lambda_cli-0.9.9 → newrelic_lambda_cli-0.9.11}/README.md

@@ -100,6 +100,9 @@ newrelic-lambda integrations install \
 | `--nr-api-key` or `-k` | Yes | Your [New Relic User API Key](https://docs.newrelic.com/docs/apis/get-started/intro-apis/types-new-relic-api-keys#user-api-key). Can also use the `NEW_RELIC_API_KEY` environment variable. |
 | `--linked-account-name` or `-n` | No | A label for the New Relic Linked Account. This is how this integration will appear in New Relic. Defaults to "New Relic Lambda Integration - <AWS Account ID>". |
 | `--enable-logs` or `-e` | No | Enables forwarding logs to New Relic Logging. This is disabled by default. Make sure you run `newrelic-lambda subscriptions install --function ... --filter-pattern ""` afterwards. |
+| `--enable-license-key-secret` | No | Securely manages and store your New Relic license key in `AWS Secrets Manager` |
+| `--enable-cw-ingest` | No | Enable the CloudWatch `log ingest` function |
+| `--disable-cw-ingest` | No | Disable the CloudWatch `log ingest` function |
 | `--memory-size` or `-m` | No | Memory size (in MiB) for the New Relic log ingestion function. Default to 128MB. |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. |
 | `--timeout` or `-t` | No | Timeout (in seconds) for the New Relic log ingestion function. Defaults to 30 seconds. |
@@ -145,6 +148,7 @@ newrelic-lambda integrations update \
 | `--disable-logs` or `-d` | No | Disables forwarding logs to New Relic Logging. Make sure you run `newrelic-lambda subscriptions install --function ...` afterwards. |
 | `--enable-logs` or `-e` | No | Enables forwarding logs to New Relic Logging. Make sure you run `newrelic-lambda subscriptions install --function ... --filter-pattern ""` afterwards. |
 | `--memory-size` or `-m` | No | Memory size (in MiB) for the New Relic log ingestion function. |
+| `--enable-license-key-secret` | No | Securely manages and store your New Relic license key in `AWS Secrets Manager` |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. |
 | `--timeout` or `-t` | No | Timeout (in seconds) for the New Relic log ingestion function. |
 | `--role-name` | No | Role name for the ingestion function. If you prefer to create and manage an IAM role for the function to assume out of band, do so and specify that role's name here. This avoids needing CAPABILITY_IAM. |
@@ -172,11 +176,16 @@ newrelic-lambda layers install \
 | `--layer-arn` or `-l` | No | Specify a specific layer version ARN to use. This is auto detected by default. |
 | `--upgrade` or `-u` | No | Permit upgrade to the latest layer version for this region and runtime. |
 | `--disable-extension` | No | Disable the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). |
-| `--enable-extension-function-logs` | No | Enable forwarding logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). Disabled by default. |
+| `--enable-extension-function-logs` or `--send-function-logs` | No | Enable sending Lambda function logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). Disabled by default. |
+| `--disable-extension-function-logs` or `--disable-function-logs` | No | Disable sending Lambda function logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension).|
+| `--send-extension-logs` | No | Enable forwarding logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). Disabled by default. |
+| `--disable-extension-logs` | No | Disable forwarding logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension).|
 | `--aws-profile` or `-p` | No | The AWS profile to use for this command. Can also use `AWS_PROFILE`. Will also check `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables if not using AWS CLI. |
 | `--aws-region` or `-r` | No | The AWS region this function is located. Can use `AWS_DEFAULT_REGION` environment variable. Defaults to AWS session region. |
 | `--nr-api-key` or `-k` | No | Your [New Relic User API Key](https://docs.newrelic.com/docs/apis/get-started/intro-apis/types-new-relic-api-keys#user-api-key). Can also use the `NEW_RELIC_API_KEY` environment variable. Only used if `--enable-extension` is set and there is no New Relic license key in AWS Secrets Manager. |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. Only used if `--enable-extension` is set and there is no New Relic license key in AWS Secrets Manager. |
+| `--nr-env-delimite` | No | Set `NR_ENV_DELIMITER` environment variable for your Lambda Function |
+| `--nr-tags` | No | Set `NR_TAGS` environment variable for your Lambda Function |
 | `--java_handler_method` or `-j` | No | For java runtimes only to specify an aws implementation method. Defaults to RequestHandler. Optional inputs are: handleRequest, handleStreamsRequest `--java_handler_method handleStreamsRequest`. |
 | `--esm` | No |  For Node.js functions using ES Modules (ESM), enable the specific ESM wrapper during installation (e.g., using the --esm flag). This sets the Lambda handler to `/opt/nodejs/node_modules/newrelic-esm-lambda-wrapper/index.handler`. |
 

{newrelic_lambda_cli-0.9.9 → newrelic_lambda_cli-0.9.11}/newrelic_lambda_cli/api.py

@@ -362,6 +362,9 @@ def validate_gql_credentials(input):
 
 def retrieve_license_key(gql):
     global __cached_license_key
+    if gql is None and input and getattr(input, "nr_ingest_key", None):
+        return input.nr_ingest_key
+
     if __cached_license_key:
         return __cached_license_key
     assert isinstance(gql, NewRelicGQL)
@@ -370,11 +373,12 @@ def retrieve_license_key(gql):
         return __cached_license_key
     except Exception:
         raise click.BadParameter(
-            "Could not retrieve license key from New Relic. Check that your New Relic "
-            "Account ID is valid and try again.",
+            f"For New Relic Account ID: {gql.account_id}. "
+            "Could not retrieve INGEST - LICENSE key from New Relic. "
+            "Check that your New Relic Account ID and USER key are valid and try again.",
             ctx=None,
-            param="nr_account_id",
-            param_hint="New Relic Account ID",
+            param="nr_api_key",
+            param_hint="API Key",
         )
 
 

{newrelic_lambda_cli-0.9.9 → newrelic_lambda_cli-0.9.11}/newrelic_lambda_cli/cli/layers.py

@@ -42,6 +42,13 @@ def register(group):
     metavar="<key>",
     required=False,
 )
+@click.option(
+    "--nr-ingest-key",
+    envvar="NEW_RELIC_INGEST_KEY",
+    help="New Relic License/Ingest Key (alternative to --nr-api-key)",
+    metavar="<key>",
+    required=False,
+)
 @click.option(
     "--nr-region",
     default="us",
@@ -94,10 +101,42 @@ def register(group):
     help="Enable/disable the New Relic Lambda Extension",
 )
 @click.option(
-    "--enable-extension-function-logs/--disable-extension-function-logs",
-    default=False,
-    show_default=True,
-    help="Enable/disable sending Lambda function logs via the Extension",
+    "--send-extension-logs",
+    is_flag=True,
+    help="Enable sending extension logs via the New Relic Lambda Extension",
+)
+@click.option(
+    "--disable-extension-logs",
+    is_flag=True,
+    help="Disable sending extension logs via the New Relic Lambda Extension",
+)
+@click.option(
+    "--enable-extension-function-logs",
+    is_flag=True,
+    help="Enable sending Lambda function logs via the New Relic Lambda Extension",
+)
+@click.option(
+    "--disable-extension-function-logs",
+    is_flag=True,
+    help="Disable sending Lambda function logs via the New Relic Lambda Extension",
+)
+@click.option(
+    "--nr-tags",
+    help="Set NR_TAGS environment variable for Lambda (e.g. key1:value1;key2:value2)",
+)
+@click.option(
+    "--nr-env-delimiter",
+    help="Set NR_ENV_DELIMITER environment variable for Lambda (e.g. ',' for comma)",
+)
+@click.option(
+    "--send-function-logs",
+    is_flag=True,
+    help="Enable sending Lambda function logs via the New Relic Lambda Extension",
+)
+@click.option(
+    "--disable-function-logs",
+    is_flag=True,
+    help="Disable sending Lambda function logs via the New Relic Lambda Extension",
 )
 @click.option(
     "--java_handler_method",
@@ -116,6 +155,12 @@ def register(group):
 @click.pass_context
 def install(ctx, **kwargs):
     """Install New Relic AWS Lambda Layers"""
+
+    if "nr_ingest_key" not in kwargs:
+        kwargs["nr_ingest_key"] = None
+    if "nr_api_key" not in kwargs:
+        kwargs["nr_api_key"] = None
+
     input = LayerInstall(session=None, verbose=ctx.obj["VERBOSE"], **kwargs)
     input = input._replace(
         session=boto3.Session(

{newrelic_lambda_cli-0.9.9 → newrelic_lambda_cli-0.9.11}/newrelic_lambda_cli/layers.py

@@ -18,6 +18,7 @@ from newrelic_lambda_cli.utils import catch_boto_errors
 
 NEW_RELIC_ENV_VARS = (
     "NEW_RELIC_ACCOUNT_ID",
+    "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS",
     "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS",
     "NEW_RELIC_LAMBDA_EXTENSION_ENABLED",
     "NEW_RELIC_LAMBDA_HANDLER",
@@ -25,6 +26,8 @@ NEW_RELIC_ENV_VARS = (
     "NEW_RELIC_LOG_ENDPOINT",
     "NEW_RELIC_TELEMETRY_ENDPOINT",
     "NEW_RELIC_APM_LAMBDA_MODE",
+    "NR_TAGS",
+    "NR_ENV_DELIMITER",
 )
 
 
@@ -201,10 +204,52 @@ def _add_new_relic(input, config, nr_license_key):
             "NEW_RELIC_LAMBDA_EXTENSION_ENABLED"
         ] = "true"
 
-        update_kwargs["Environment"]["Variables"][
-            "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
-        ] = ("true" if input.enable_extension_function_logs else "false")
+        if not input.upgrade:
+            update_kwargs["Environment"]["Variables"][
+                "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+            ] = "false"
+        elif input.enable_extension_function_logs or input.send_function_logs:
+            update_kwargs["Environment"]["Variables"][
+                "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+            ] = "true"
+            success(
+                "Successfully enabled NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS tag to the function"
+            )
+        elif input.disable_extension_function_logs or input.disable_function_logs:
+            update_kwargs["Environment"]["Variables"][
+                "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+            ] = "false"
+            success(
+                "Successfully disabled NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS tag to the function"
+            )
+
+        if not input.upgrade:
+            update_kwargs["Environment"]["Variables"][
+                "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+            ] = "false"
+        elif input.send_extension_logs:
+            update_kwargs["Environment"]["Variables"][
+                "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+            ] = "true"
+            success(
+                "Successfully enabled NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS tag to the function"
+            )
+        elif input.disable_extension_logs:
+            update_kwargs["Environment"]["Variables"][
+                "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+            ] = "false"
+            success(
+                "Successfully disabled NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS tag to the function"
+            )
 
+        if input.nr_tags:
+            update_kwargs["Environment"]["Variables"]["NR_TAGS"] = input.nr_tags
+            success("Successfully added NR_TAGS tag to the function")
+        if input.nr_env_delimiter:
+            update_kwargs["Environment"]["Variables"][
+                "NR_ENV_DELIMITER"
+            ] = input.nr_env_delimiter
+            success("Successfully added NR_ENV_DELIMITER tag to the function")
         if input.nr_region == "staging":
             update_kwargs["Environment"]["Variables"][
                 "NEW_RELIC_TELEMETRY_ENDPOINT"
@@ -213,14 +258,19 @@ def _add_new_relic(input, config, nr_license_key):
                 "NEW_RELIC_LOG_ENDPOINT"
             ] = "https://staging-log-api.newrelic.com/log/v1"
 
-        if nr_license_key:
+        if input.nr_ingest_key:
+            update_kwargs["Environment"]["Variables"][
+                "NEW_RELIC_LICENSE_KEY"
+            ] = input.nr_ingest_key
+            success("Using New Relic ingest key for layer configuration")
+        elif nr_license_key:
             update_kwargs["Environment"]["Variables"][
                 "NEW_RELIC_LICENSE_KEY"
             ] = nr_license_key
-    else:
-        update_kwargs["Environment"]["Variables"][
-            "NEW_RELIC_LAMBDA_EXTENSION_ENABLED"
-        ] = "false"
+        else:
+            update_kwargs["Environment"]["Variables"][
+                "NEW_RELIC_LAMBDA_EXTENSION_ENABLED"
+            ] = "false"
 
     if "dotnet" in runtime:
         update_kwargs["Environment"]["Variables"]["CORECLR_ENABLE_PROFILING"] = "1"
@@ -246,6 +296,14 @@ def _add_new_relic(input, config, nr_license_key):
 
 @catch_boto_errors
 def install(input, function_arn):
+    if input.nr_api_key and input.nr_ingest_key:
+        raise click.UsageError(
+            "Please provide either the --nr-api-key or the --nr-ingest-key flag, but not both."
+        )
+    if not input.nr_api_key and not input.nr_ingest_key:
+        raise click.UsageError(
+            "Please provide either the --nr-api-key or the --nr-ingest-key flag."
+        )
     assert isinstance(input, LayerInstall)
 
     client = input.session.client("lambda")
@@ -297,6 +355,8 @@ def install(input, function_arn):
     ):
         gql = api.validate_gql_credentials(input)
         nr_license_key = api.retrieve_license_key(gql)
+    elif input.nr_ingest_key:
+        nr_license_key = input.nr_ingest_key
 
     update_kwargs = _add_new_relic(input, config, nr_license_key)
     if isinstance(update_kwargs, bool):

{newrelic_lambda_cli-0.9.9 → newrelic_lambda_cli-0.9.11}/newrelic_lambda_cli/types.py

@@ -96,6 +96,7 @@ LAYER_INSTALL_KEYS = [
     "verbose",
     "nr_account_id",
     "nr_api_key",
+    "nr_ingest_key",
     "nr_region",
     "aws_profile",
     "aws_region",
@@ -107,6 +108,13 @@ LAYER_INSTALL_KEYS = [
     "apm",
     "enable_extension",
     "enable_extension_function_logs",
+    "disable_extension_function_logs",
+    "nr_tags",
+    "nr_env_delimiter",
+    "send_function_logs",
+    "disable_function_logs",
+    "send_extension_logs",
+    "disable_extension_logs",
     "java_handler_method",
     "esm",
 ]

{newrelic_lambda_cli-0.9.9 → newrelic_lambda_cli-0.9.11}/newrelic_lambda_cli/utils.py

@@ -187,7 +187,9 @@ def parse_arn(arn):
         result["resource"] = elements[5]
         result["resourcetype"] = None
     else:
-        result["resourcetype"], result["resource"] = elements[5].split("/")
+        splitted_arn = elements[5].split("/")
+        result["resourcetype"] = splitted_arn[0]
+        result["resource"] = "/".join(splitted_arn[1:])
     return result
 
 

{newrelic_lambda_cli-0.9.9 → newrelic_lambda_cli-0.9.11}/newrelic_lambda_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: newrelic-lambda-cli
-Version: 0.9.9
+Version: 0.9.11
 Summary: A CLI to install the New Relic AWS Lambda integration and layers.
 Home-page: https://github.com/newrelic/newrelic-lambda-cli
 Author: New Relic
@@ -126,6 +126,9 @@ newrelic-lambda integrations install \
 | `--nr-api-key` or `-k` | Yes | Your [New Relic User API Key](https://docs.newrelic.com/docs/apis/get-started/intro-apis/types-new-relic-api-keys#user-api-key). Can also use the `NEW_RELIC_API_KEY` environment variable. |
 | `--linked-account-name` or `-n` | No | A label for the New Relic Linked Account. This is how this integration will appear in New Relic. Defaults to "New Relic Lambda Integration - <AWS Account ID>". |
 | `--enable-logs` or `-e` | No | Enables forwarding logs to New Relic Logging. This is disabled by default. Make sure you run `newrelic-lambda subscriptions install --function ... --filter-pattern ""` afterwards. |
+| `--enable-license-key-secret` | No | Securely manages and store your New Relic license key in `AWS Secrets Manager` |
+| `--enable-cw-ingest` | No | Enable the CloudWatch `log ingest` function |
+| `--disable-cw-ingest` | No | Disable the CloudWatch `log ingest` function |
 | `--memory-size` or `-m` | No | Memory size (in MiB) for the New Relic log ingestion function. Default to 128MB. |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. |
 | `--timeout` or `-t` | No | Timeout (in seconds) for the New Relic log ingestion function. Defaults to 30 seconds. |
@@ -171,6 +174,7 @@ newrelic-lambda integrations update \
 | `--disable-logs` or `-d` | No | Disables forwarding logs to New Relic Logging. Make sure you run `newrelic-lambda subscriptions install --function ...` afterwards. |
 | `--enable-logs` or `-e` | No | Enables forwarding logs to New Relic Logging. Make sure you run `newrelic-lambda subscriptions install --function ... --filter-pattern ""` afterwards. |
 | `--memory-size` or `-m` | No | Memory size (in MiB) for the New Relic log ingestion function. |
+| `--enable-license-key-secret` | No | Securely manages and store your New Relic license key in `AWS Secrets Manager` |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. |
 | `--timeout` or `-t` | No | Timeout (in seconds) for the New Relic log ingestion function. |
 | `--role-name` | No | Role name for the ingestion function. If you prefer to create and manage an IAM role for the function to assume out of band, do so and specify that role's name here. This avoids needing CAPABILITY_IAM. |
@@ -198,11 +202,16 @@ newrelic-lambda layers install \
 | `--layer-arn` or `-l` | No | Specify a specific layer version ARN to use. This is auto detected by default. |
 | `--upgrade` or `-u` | No | Permit upgrade to the latest layer version for this region and runtime. |
 | `--disable-extension` | No | Disable the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). |
-| `--enable-extension-function-logs` | No | Enable forwarding logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). Disabled by default. |
+| `--enable-extension-function-logs` or `--send-function-logs` | No | Enable sending Lambda function logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). Disabled by default. |
+| `--disable-extension-function-logs` or `--disable-function-logs` | No | Disable sending Lambda function logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension).|
+| `--send-extension-logs` | No | Enable forwarding logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension). Disabled by default. |
+| `--disable-extension-logs` | No | Disable forwarding logs via the [New Relic Lambda Extension](https://github.com/newrelic/newrelic-lambda-extension).|
 | `--aws-profile` or `-p` | No | The AWS profile to use for this command. Can also use `AWS_PROFILE`. Will also check `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables if not using AWS CLI. |
 | `--aws-region` or `-r` | No | The AWS region this function is located. Can use `AWS_DEFAULT_REGION` environment variable. Defaults to AWS session region. |
 | `--nr-api-key` or `-k` | No | Your [New Relic User API Key](https://docs.newrelic.com/docs/apis/get-started/intro-apis/types-new-relic-api-keys#user-api-key). Can also use the `NEW_RELIC_API_KEY` environment variable. Only used if `--enable-extension` is set and there is no New Relic license key in AWS Secrets Manager. |
 | `--nr-region` | No | The New Relic region to use for the integration. Can use the `NEW_RELIC_REGION` environment variable. Can be either `eu` or `us`. Defaults to `us`. Only used if `--enable-extension` is set and there is no New Relic license key in AWS Secrets Manager. |
+| `--nr-env-delimite` | No | Set `NR_ENV_DELIMITER` environment variable for your Lambda Function |
+| `--nr-tags` | No | Set `NR_TAGS` environment variable for your Lambda Function |
 | `--java_handler_method` or `-j` | No | For java runtimes only to specify an aws implementation method. Defaults to RequestHandler. Optional inputs are: handleRequest, handleStreamsRequest `--java_handler_method handleStreamsRequest`. |
 | `--esm` | No |  For Node.js functions using ES Modules (ESM), enable the specific ESM wrapper during installation (e.g., using the --esm flag). This sets the Lambda handler to `/opt/nodejs/node_modules/newrelic-esm-lambda-wrapper/index.handler`. |
 

{newrelic_lambda_cli-0.9.9 → newrelic_lambda_cli-0.9.11}/setup.py

@@ -6,7 +6,7 @@ README = open(os.path.join(os.path.dirname(__file__), "README.md"), "r").read()
 
 setup(
     name="newrelic-lambda-cli",
-    version="0.9.9",
+    version="0.9.11",
     python_requires=">=3.3",
     description="A CLI to install the New Relic AWS Lambda integration and layers.",
     long_description=README,

{newrelic_lambda_cli-0.9.9 → newrelic_lambda_cli-0.9.11}/tests/test_layers.py

@@ -1,4 +1,5 @@
 import boto3
+import click
 from click import UsageError
 from moto import mock_aws
 import pytest
@@ -49,13 +50,13 @@ def test_add_new_relic(aws_credentials, mock_function_config):
     )
     assert (
         update_kwargs["Environment"]["Variables"]["NEW_RELIC_LAMBDA_EXTENSION_ENABLED"]
-        == "true"
+        == "false"
     )
     assert (
         update_kwargs["Environment"]["Variables"][
             "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
         ]
-        == "true"
+        == "false"
     )
 
     config = mock_function_config("not.a.runtime")
@@ -316,7 +317,6 @@ def test_install_apm(aws_credentials, mock_function_config):
                             "EXISTING_ENV_VAR": "Hello World",
                             "NEW_RELIC_ACCOUNT_ID": "12345",
                             "NEW_RELIC_LAMBDA_HANDLER": "original_handler",
-                            "NEW_RELIC_LAMBDA_EXTENSION_ENABLED": "false",
                             "NEW_RELIC_APM_LAMBDA_MODE": "True",
                         }
                     },
@@ -378,13 +378,13 @@ def test_add_new_relic_dotnet(aws_credentials, mock_function_config):
             update_kwargs["Environment"]["Variables"][
                 "NEW_RELIC_LAMBDA_EXTENSION_ENABLED"
             ]
-            == "true"
+            == "false"
         )
         assert (
             update_kwargs["Environment"]["Variables"][
                 "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
             ]
-            == "true"
+            == "false"
         )
 
         # .NET specific environment variables
@@ -462,7 +462,7 @@ def test_add_new_relic_nodejs(aws_credentials, mock_function_config):
         update_kwargs_std["Environment"]["Variables"][
             "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
         ]
-        == "true"
+        == "false"
     )
 
     # --- Scenario 2: ESM Node.js Handler (ESM enabled) ---
@@ -514,7 +514,7 @@ def test_add_new_relic_nodejs(aws_credentials, mock_function_config):
         update_kwargs_esm["Environment"]["Variables"][
             "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
         ]
-        == "true"
+        == "false"
     )
 
 
@@ -621,7 +621,13 @@ def test_install_failure(aws_credentials, mock_function_config):
         mock_client.get_function.return_value = config
         with pytest.raises(UsageError):
             install(
-                layer_install(nr_account_id=9876543, session=mock_session), "foobarbaz"
+                layer_install(
+                    nr_account_id=9876543,
+                    session=mock_session,
+                    nr_api_key=None,
+                    nr_ingest_key=None,
+                ),
+                "foobarbaz",
             )
 
 
@@ -639,7 +645,13 @@ def test_install(aws_credentials, mock_function_config):
         mock_client.get_function.return_value = config
         with pytest.raises(UsageError):
             install(
-                layer_install(nr_account_id=9876543, session=mock_session), "foobarbaz"
+                layer_install(
+                    nr_account_id=9876543,
+                    session=mock_session,
+                    nr_api_key=None,
+                    nr_ingest_key=None,
+                ),
+                "foobarbaz",
             )
 
         mock_client = mock_session.client.return_value
@@ -681,7 +693,6 @@ def test_install(aws_credentials, mock_function_config):
                             "EXISTING_ENV_VAR": "Hello World",
                             "NEW_RELIC_ACCOUNT_ID": "12345",
                             "NEW_RELIC_LAMBDA_HANDLER": "original_handler",
-                            "NEW_RELIC_LAMBDA_EXTENSION_ENABLED": "false",
                         }
                     },
                     Layers=ANY,
@@ -781,3 +792,643 @@ def test_install_success_message_new_layer(aws_credentials, mock_function_config
                 "Successfully installed Layer ARN %s for the function: %s"
                 % (new_layer_arn, function_arn)
             )
+
+
+@mock_aws
+def test_extension_logs_flags(aws_credentials, mock_function_config):
+    """Test that --send-extension-logs and --disable-extension-logs flags work correctly"""
+    session = boto3.Session(region_name="us-east-1")
+    nr_account_id = 12345
+
+    # Test 1: Fresh install with default settings - logs should be disabled by default
+    config = mock_function_config("python3.12")
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+        ]
+        == "false"
+    )
+
+    # Test 2: Fresh install with --send-extension-logs
+    config = mock_function_config("python3.12")
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+            send_extension_logs=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+        ]
+        == "false"
+    )
+
+    # Test 3: Upgrade with --send-extension-logs - should set to true
+    config = mock_function_config("python3.12")
+    config["Configuration"]["Environment"]["Variables"][
+        "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+    ] = "false"
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+            send_extension_logs=True,
+            upgrade=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+        ]
+        == "true"
+    )
+
+    # Test 4: Upgrade with --disable-extension-logs - should set to false
+    config = mock_function_config("python3.12")
+    config["Configuration"]["Environment"]["Variables"][
+        "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+    ] = "true"
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+            disable_extension_logs=True,
+            upgrade=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+        ]
+        == "false"
+    )
+
+    # Test 5: Upgrade without flags - should preserve existing value
+    config = mock_function_config("python3.12")
+    config["Configuration"]["Environment"]["Variables"][
+        "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+    ] = "true"
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+            upgrade=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+        ]
+        == "true"
+    )
+
+
+@mock_aws
+def test_function_logs_flags(aws_credentials, mock_function_config):
+    """Test that --send-function-logs and --disable-function-logs flags work correctly"""
+    session = boto3.Session(region_name="us-east-1")
+    nr_account_id = 12345
+
+    # Test 1: Fresh install with default settings - logs should be disabled by default
+    config = mock_function_config("python3.12")
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+        ]
+        == "false"
+    )
+
+    # Test 2: Fresh install with --send-function-logs - should still be false
+    config = mock_function_config("python3.12")
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+            send_function_logs=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+        ]
+        == "false"
+    )
+
+    # Test 3: Upgrade with --send-function-logs - should set to true
+    config = mock_function_config("python3.12")
+    config["Configuration"]["Environment"]["Variables"][
+        "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+    ] = "false"
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+            send_function_logs=True,
+            upgrade=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+        ]
+        == "true"
+    )
+
+    # Test 4: Upgrade with --disable-function-logs - should set to false
+    config = mock_function_config("python3.12")
+    config["Configuration"]["Environment"]["Variables"][
+        "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+    ] = "true"
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+            disable_function_logs=True,
+            upgrade=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+        ]
+        == "false"
+    )
+
+    # Test 5: Upgrade without flags - should preserve existing value
+    config = mock_function_config("python3.12")
+    config["Configuration"]["Environment"]["Variables"][
+        "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+    ] = "true"
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+            upgrade=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+        ]
+        == "true"
+    )
+
+
+@mock_aws
+def test_independent_log_settings(aws_credentials, mock_function_config):
+    """Test that function logs and extension logs are independent settings"""
+    session = boto3.Session(region_name="us-east-1")
+    nr_account_id = 12345
+
+    # Test: Upgrade with one flag should not affect the other setting
+    config = mock_function_config("python3.12")
+    config["Configuration"]["Environment"]["Variables"][
+        "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+    ] = "true"
+    config["Configuration"]["Environment"]["Variables"][
+        "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+    ] = "true"
+
+    # Set only function logs to false
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=nr_account_id,
+            enable_extension=True,
+            disable_function_logs=True,
+            upgrade=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    # Function logs should be set to false, extension logs should be preserved
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_FUNCTION_LOGS"
+        ]
+        == "false"
+    )
+    assert (
+        update_kwargs["Environment"]["Variables"][
+            "NEW_RELIC_EXTENSION_SEND_EXTENSION_LOGS"
+        ]
+        == "true"
+    )
+
+
+@mock_aws
+def test_add_new_relic_sets_nr_tags(aws_credentials, mock_function_config):
+    session = boto3.Session(region_name="us-east-1")
+    config = mock_function_config("python3.12")
+    tags_value = "foo:bar;baz:qux"
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=12345,
+            enable_extension=True,
+            enable_extension_function_logs=True,
+            nr_tags=tags_value,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert update_kwargs["Environment"]["Variables"]["NR_TAGS"] == tags_value
+
+
+@mock_aws
+def test_add_new_relic_sets_nr_env_delimiter(aws_credentials, mock_function_config):
+    session = boto3.Session(region_name="us-east-1")
+    config = mock_function_config("python3.12")
+    delimiter_value = "|"
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=12345,
+            enable_extension=True,
+            enable_extension_function_logs=True,
+            nr_env_delimiter=delimiter_value,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert (
+        update_kwargs["Environment"]["Variables"]["NR_ENV_DELIMITER"] == delimiter_value
+    )
+
+
+@mock_aws
+def test_add_new_relic_sets_both_nr_tags_and_env_delimiter(
+    aws_credentials, mock_function_config
+):
+    session = boto3.Session(region_name="us-east-1")
+    config = mock_function_config("python3.12")
+    tags_value = "foo:bar|baz:qux"
+    delimiter_value = "|"
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=12345,
+            enable_extension=True,
+            enable_extension_function_logs=True,
+            nr_tags=tags_value,
+            nr_env_delimiter=delimiter_value,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    assert update_kwargs["Environment"]["Variables"]["NR_TAGS"] == tags_value
+    assert (
+        update_kwargs["Environment"]["Variables"]["NR_ENV_DELIMITER"] == delimiter_value
+    )
+
+
+@mock_aws
+def test_add_new_relic_with_ingest_key(aws_credentials, mock_function_config):
+    """Test _add_new_relic function with ingest key instead of API key"""
+    session = boto3.Session(region_name="us-east-1")
+
+    config = mock_function_config("python3.12")
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=12345,
+            enable_extension=True,
+            nr_ingest_key="test-ingest-key-12345",
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    # Verify ingest key is used for NEW_RELIC_LICENSE_KEY
+    assert (
+        update_kwargs["Environment"]["Variables"]["NEW_RELIC_LICENSE_KEY"]
+        == "test-ingest-key-12345"
+    )
+    assert (
+        update_kwargs["Environment"]["Variables"]["NEW_RELIC_LAMBDA_EXTENSION_ENABLED"]
+        == "true"
+    )
+
+
+@mock_aws
+def test_add_new_relic_without_license_key_or_ingest_key(
+    aws_credentials, mock_function_config
+):
+    """Test _add_new_relic function when neither license key nor ingest key is provided"""
+    session = boto3.Session(region_name="us-east-1")
+
+    config = mock_function_config("python3.12")
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=12345,
+            enable_extension=True,
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    # When no license key or ingest key is provided, extension should be disabled
+    assert (
+        update_kwargs["Environment"]["Variables"]["NEW_RELIC_LAMBDA_EXTENSION_ENABLED"]
+        == "false"
+    )
+    assert "NEW_RELIC_LICENSE_KEY" not in update_kwargs["Environment"]["Variables"]
+
+
+@mock_aws
+def test_add_new_relic_staging_region(aws_credentials, mock_function_config):
+    """Test _add_new_relic function with staging region"""
+    session = boto3.Session(region_name="us-east-1")
+
+    config = mock_function_config("python3.12")
+
+    update_kwargs = _add_new_relic(
+        layer_install(
+            session=session,
+            aws_region="us-east-1",
+            nr_account_id=12345,
+            enable_extension=True,
+            nr_region="staging",
+            nr_ingest_key="test-ingest-key",
+        ),
+        config,
+        nr_license_key=None,
+    )
+
+    # Verify staging endpoints are set
+    assert (
+        update_kwargs["Environment"]["Variables"]["NEW_RELIC_TELEMETRY_ENDPOINT"]
+        == "https://staging-cloud-collector.newrelic.com/aws/lambda/v1"
+    )
+    assert (
+        update_kwargs["Environment"]["Variables"]["NEW_RELIC_LOG_ENDPOINT"]
+        == "https://staging-log-api.newrelic.com/log/v1"
+    )
+
+
+def test_install_with_both_api_key_and_ingest_key(
+    aws_credentials, mock_function_config
+):
+    """Test install function fails when both API key and ingest key are provided"""
+    mock_session = MagicMock()
+    mock_session.region_name = "us-east-1"
+
+    with pytest.raises(
+        UsageError,
+        match="Please provide either the --nr-api-key or the --nr-ingest-key flag, but not both",
+    ):
+        install(
+            layer_install(
+                session=mock_session,
+                nr_account_id=12345,
+                nr_api_key="test-api-key",
+                nr_ingest_key="test-ingest-key",
+            ),
+            "test-function",
+        )
+
+
+def test_install_with_ingest_key_success(aws_credentials, mock_function_config):
+    """Test successful install with ingest key"""
+    mock_session = MagicMock()
+    mock_session.region_name = "us-east-1"
+    mock_client = mock_session.client.return_value
+
+    with patch(
+        "newrelic_lambda_cli.layers._get_license_key_outputs"
+    ) as mock_get_license_key_outputs, patch(
+        "newrelic_lambda_cli.layers.get_function"
+    ) as mock_get_function, patch(
+        "newrelic_lambda_cli.layers._add_new_relic"
+    ) as mock_add_new_relic:
+
+        # Set up policy_arn so GraphQL validation is skipped
+        mock_get_license_key_outputs.return_value = (None, "12345", "test-policy-arn")
+        mock_get_function.return_value = mock_function_config("python3.12")
+        mock_add_new_relic.return_value = {
+            "FunctionName": "test-function",
+            "Environment": {"Variables": {"NEW_RELIC_LICENSE_KEY": "test-ingest-key"}},
+            "Layers": ["test-layer"],
+        }
+        mock_client.update_function_configuration.return_value = {
+            "Configuration": {
+                "Layers": [{"Arn": "existing-layer"}],
+                "FunctionArn": "test-function",
+            }
+        }
+
+        result = install(
+            layer_install(
+                session=mock_session,
+                nr_account_id=12345,
+                nr_ingest_key="test-ingest-key",
+                enable_extension=False,
+            ),
+            "test-function",
+        )
+
+        assert result is True
+        mock_client.update_function_configuration.assert_called_once()
+
+
+@mock_aws
+def test_install_with_apm_and_verbose(aws_credentials, mock_function_config):
+    """Test install with APM enabled and verbose output to cover success message paths"""
+    mock_session = MagicMock()
+    mock_session.region_name = "us-east-1"
+    mock_client = mock_session.client.return_value
+
+    with patch(
+        "newrelic_lambda_cli.layers._get_license_key_outputs"
+    ) as mock_get_license_key_outputs, patch(
+        "newrelic_lambda_cli.layers.get_function"
+    ) as mock_get_function, patch(
+        "newrelic_lambda_cli.layers._add_new_relic"
+    ) as mock_add_new_relic:
+
+        mock_get_license_key_outputs.return_value = (None, "12345", "test-policy-arn")
+        mock_get_function.return_value = mock_function_config("python3.12")
+        mock_add_new_relic.return_value = {
+            "FunctionName": "test-function",
+            "Environment": {"Variables": {"NEW_RELIC_LICENSE_KEY": "test-key"}},
+            "Layers": ["test-layer"],
+        }
+        mock_client.update_function_configuration.return_value = {
+            "Configuration": {"Layers": [], "FunctionArn": "test-function"}
+        }
+        mock_client.tag_resource.return_value = {}
+
+        result = install(
+            layer_install(
+                session=mock_session,
+                nr_account_id=12345,
+                nr_api_key="test-api-key",
+                nr_region="us",
+                apm=True,
+                verbose=True,
+                enable_extension=False,
+            ),
+            "test-function",
+        )
+
+        assert result is True
+        mock_client.tag_resource.assert_called_once()
+
+
+@mock_aws
+def test_install_function_not_found(aws_credentials):
+    """Test install function when function is not found"""
+    mock_session = MagicMock()
+    mock_session.region_name = "us-east-1"
+
+    with patch("newrelic_lambda_cli.layers.get_function") as mock_get_function:
+        mock_get_function.return_value = None
+
+        result = install(
+            layer_install(
+                session=mock_session,
+                nr_account_id=12345,
+                nr_api_key="test-api-key",
+            ),
+            "nonexistent-function",
+        )
+
+        assert result is False
+
+
+def test_install_secret_account_mismatch(aws_credentials):
+    """Test install with managed secret account ID mismatch"""
+    mock_session = MagicMock()
+    mock_session.region_name = "us-east-1"
+
+    with patch(
+        "newrelic_lambda_cli.layers._get_license_key_outputs"
+    ) as mock_get_license_key_outputs, patch(
+        "newrelic_lambda_cli.layers.get_function"
+    ) as mock_get_function:
+
+        # Different account ID in existing secret
+        mock_get_license_key_outputs.return_value = (None, "99999", "test-policy-arn")
+        mock_get_function.return_value = {"Configuration": {"FunctionArn": "test"}}
+
+        with pytest.raises(UsageError, match="A managed secret already exists"):
+            install(
+                layer_install(
+                    session=mock_session,
+                    nr_account_id=12345,  # Different from secret account ID
+                    nr_ingest_key="test-ingest-key",
+                ),
+                "test-function",
+            )
+
+
+def test_install_extension_without_secret_or_api_key(aws_credentials):
+    """Test install with extension enabled but no secret or API key"""
+    mock_session = MagicMock()
+    mock_session.region_name = "us-east-1"
+
+    with patch(
+        "newrelic_lambda_cli.layers._get_license_key_outputs"
+    ) as mock_get_license_key_outputs, patch(
+        "newrelic_lambda_cli.layers.get_function"
+    ) as mock_get_function:
+
+        mock_get_license_key_outputs.return_value = (None, None, None)  # No secret
+        mock_get_function.return_value = {"Configuration": {"FunctionArn": "test"}}
+
+        with pytest.raises(UsageError, match="In order to use `--enable-extension`"):
+            install(
+                layer_install(
+                    session=mock_session,
+                    nr_account_id=12345,
+                    enable_extension=True,
+                    nr_ingest_key="test-ingest-key",
+                ),
+                "test-function",
+            )