Merge pull request #2547 from bblommers/feature/2546

AWS Lambda: Add Role validation when creating functions

moto/awslambda/exceptions.py

@@ -0,0 +1,31 @@
+from botocore.client import ClientError
+
+
+class LambdaClientError(ClientError):
+    def __init__(self, error, message):
+        error_response = {"Error": {"Code": error, "Message": message}}
+        super(LambdaClientError, self).__init__(error_response, None)
+
+
+class CrossAccountNotAllowed(LambdaClientError):
+    def __init__(self):
+        super(CrossAccountNotAllowed, self).__init__(
+            "AccessDeniedException", "Cross-account pass role is not allowed."
+        )
+
+
+class InvalidParameterValueException(LambdaClientError):
+    def __init__(self, message):
+        super(InvalidParameterValueException, self).__init__(
+            "InvalidParameterValueException", message
+        )
+
+
+class InvalidRoleFormat(LambdaClientError):
+    pattern = r"arn:(aws[a-zA-Z-]*)?:iam::(\d{12}):role/?[a-zA-Z_0-9+=,.@\-_/]+"
+
+    def __init__(self, role):
+        message = "1 validation error detected: Value '{0}' at 'role' failed to satisfy constraint: Member must satisfy regular expression pattern: {1}".format(
+            role, InvalidRoleFormat.pattern
+        )
+        super(InvalidRoleFormat, self).__init__("ValidationException", message)

moto/awslambda/models.py

@@ -26,11 +26,18 @@ import requests.adapters
 import boto.awslambda
 from moto.core import BaseBackend, BaseModel
 from moto.core.exceptions import RESTError
+from moto.iam.models import iam_backend
+from moto.iam.exceptions import IAMNotFoundException
 from moto.core.utils import unix_time_millis
 from moto.s3.models import s3_backend
 from moto.logs.models import logs_backends
 from moto.s3.exceptions import MissingBucket, MissingKey
 from moto import settings
+from .exceptions import (
+    CrossAccountNotAllowed,
+    InvalidRoleFormat,
+    InvalidParameterValueException,
+)
 from .utils import make_function_arn, make_function_ver_arn
 from moto.sqs import sqs_backends
 from moto.dynamodb2 import dynamodb_backends2
@@ -214,9 +221,8 @@ class LambdaFunction(BaseModel):
                 key = s3_backend.get_key(self.code["S3Bucket"], self.code["S3Key"])
             except MissingBucket:
                 if do_validate_s3():
-                    raise ValueError(
-                        "InvalidParameterValueException",
-                        "Error occurred while GetObject. S3 Error Code: NoSuchBucket. S3 Error Message: The specified bucket does not exist",
+                    raise InvalidParameterValueException(
+                        "Error occurred while GetObject. S3 Error Code: NoSuchBucket. S3 Error Message: The specified bucket does not exist"
                     )
             except MissingKey:
                 if do_validate_s3():
@@ -668,6 +674,19 @@ class LambdaStorage(object):
         :param fn: Function
         :type fn: LambdaFunction
         """
+        valid_role = re.match(InvalidRoleFormat.pattern, fn.role)
+        if valid_role:
+            account = valid_role.group(2)
+            if account != ACCOUNT_ID:
+                raise CrossAccountNotAllowed()
+            try:
+                iam_backend.get_role_by_arn(fn.role)
+            except IAMNotFoundException:
+                raise InvalidParameterValueException(
+                    "The role defined for the function cannot be assumed by Lambda."
+                )
+        else:
+            raise InvalidRoleFormat(fn.role)
         if fn.function_name in self._functions:
             self._functions[fn.function_name]["latest"] = fn
         else:

moto/awslambda/responses.py

@@ -211,30 +211,14 @@ class LambdaResponse(BaseResponse):
         return 200, {}, json.dumps(result)
 
     def _create_function(self, request, full_url, headers):
-        try:
-            fn = self.lambda_backend.create_function(self.json_body)
-        except ValueError as e:
-            return (
-                400,
-                {},
-                json.dumps({"Error": {"Code": e.args[0], "Message": e.args[1]}}),
-            )
-        else:
-            config = fn.get_configuration()
-            return 201, {}, json.dumps(config)
+        fn = self.lambda_backend.create_function(self.json_body)
+        config = fn.get_configuration()
+        return 201, {}, json.dumps(config)
 
     def _create_event_source_mapping(self, request, full_url, headers):
-        try:
-            fn = self.lambda_backend.create_event_source_mapping(self.json_body)
-        except ValueError as e:
-            return (
-                400,
-                {},
-                json.dumps({"Error": {"Code": e.args[0], "Message": e.args[1]}}),
-            )
-        else:
-            config = fn.get_configuration()
-            return 201, {}, json.dumps(config)
+        fn = self.lambda_backend.create_event_source_mapping(self.json_body)
+        config = fn.get_configuration()
+        return 201, {}, json.dumps(config)
 
     def _list_event_source_mappings(self, event_source_arn, function_name):
         esms = self.lambda_backend.list_event_source_mappings(

moto/core/utils.py

@@ -8,6 +8,7 @@ import random
 import re
 import six
 import string
+from botocore.exceptions import ClientError
 from six.moves.urllib.parse import urlparse
 
 
@@ -141,7 +142,10 @@ class convert_flask_to_httpretty_response(object):
     def __call__(self, args=None, **kwargs):
         from flask import request, Response
 
-        result = self.callback(request, request.url, {})
+        try:
+            result = self.callback(request, request.url, {})
+        except ClientError as exc:
+            result = 400, {}, exc.response["Error"]["Message"]
         # result is a status, headers, response tuple
         if len(result) == 3:
             status, headers, content = result

moto/iam/models.py

@@ -371,7 +371,7 @@ class Role(BaseModel):
         from moto.cloudformation.exceptions import UnformattedGetAttTemplateException
 
         if attribute_name == "Arn":
-            raise NotImplementedError('"Fn::GetAtt" : [ "{0}" , "Arn" ]"')
+            return self.arn
         raise UnformattedGetAttTemplateException()
 
     def get_tags(self):