From 4666dd5578dfb0d665f025bb6c0afb16c8520c95 Mon Sep 17 00:00:00 2001 From: Stanislav Bytsko Date: Fri, 27 Sep 2024 16:58:08 +0300 Subject: [PATCH] fix: Work around limit in lambda policy size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently failing with ``` │ Error: adding Lambda Permission (arn:aws:lambda:us-east-2:591234544403:function:model-inference-development-datadog-forwarder/_aws_sagemaker_Endpoints_recs-ranker-rn-scribd-has-read-after-AllowExecutionFromCloudWatchLogs): PolicyLengthExceededException: The final policy size (20782) is bigger than the limit (20480). │ { │ RespMetadata: { │ StatusCode: 400, │ RequestID: "e220c7fb-c4c9-4b93-9f15-beba592a3afc" │ }, │ Message_: "The final policy size (20782) is bigger than the limit (20480).", │ Type: "User" │ } │ │ with module.datadog[0].aws_lambda_permission.allow_cloudwatch_logs_to_call_dd_lambda_handler["/aws/sagemaker/Endpoints/recs-ranker-rn-scribd-has-read-after"], │ on .terraform/modules/datadog/logs_monitoring_cloudwatch_log.tf line 10, in resource "aws_lambda_permission" "allow_cloudwatch_logs_to_call_dd_lambda_handler": │ 10: resource "aws_lambda_permission" "allow_cloudwatch_logs_to_call_dd_lambda_handler" { } ``` --- logs_monitoring_cloudwatch_log.tf | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/logs_monitoring_cloudwatch_log.tf b/logs_monitoring_cloudwatch_log.tf index b5b4a22..dfd6ab6 100644 --- a/logs_monitoring_cloudwatch_log.tf +++ b/logs_monitoring_cloudwatch_log.tf @@ -7,11 +7,12 @@ resource "aws_cloudwatch_log_subscription_filter" "test_lambdafunction_logfilter distribution = "Random" } +// we're using wildcard sources instead of making separate grant per source +// in order to avoid hitting limit of 20KB per lambda function's aggregated policy size resource "aws_lambda_permission" "allow_cloudwatch_logs_to_call_dd_lambda_handler" { - for_each = { for lg in var.cloudwatch_log_groups : lg => lg } - statement_id = "${substr(replace(each.value, "/", "_"), 0, 67)}-AllowExecutionFromCloudWatchLogs" + statement_id = "AllowExecutionFromCloudWatchLogs" action = "lambda:InvokeFunction" function_name = aws_cloudformation_stack.datadog-forwarder.outputs.DatadogForwarderArn principal = "logs.${var.aws_region}.amazonaws.com" - source_arn = "arn:aws:logs:${var.aws_region}:${var.aws_account_id}:log-group:${each.value}:*" + source_arn = "arn:aws:logs:${var.aws_region}:${var.aws_account_id}:log-group:*" }