AWS CDK Reference

Appearance

v2.276.0

LayerVersionPermission Struct ​

Identification of an account (or organization) that is allowed to access a Lambda Layer Version.

Source
aws-lambda/lib/layers.ts

Example ​

ts
const layer = new lambda.LayerVersion(stack, 'MyLayer', {
  code: lambda.Code.fromAsset(path.join(__dirname, 'layer-code')),
  compatibleRuntimes: [lambda.Runtime.NODEJS_LATEST],
  license: 'Apache-2.0',
  description: 'A layer to test the L2 construct',
});

// To grant usage by other AWS accounts
layer.addPermission('remote-account-grant', { accountId: awsAccountId });

// To grant usage to all accounts in some AWS Ogranization
// layer.grantUsage({ accountId: '*', organizationId });

new lambda.Function(stack, 'MyLayeredLambda', {
  code: new lambda.InlineCode('foo'),
  handler: 'index.handler',
  runtime: lambda.Runtime.NODEJS_LATEST,
  layers: [layer],
});
python
layer = lambda_.LayerVersion(stack, "MyLayer",
    code=lambda_.Code.from_asset(path.join(__dirname, "layer-code")),
    compatible_runtimes=[lambda_.Runtime.NODEJS_LATEST],
    license="Apache-2.0",
    description="A layer to test the L2 construct"
)

# To grant usage by other AWS accounts
layer.add_permission("remote-account-grant", account_id=aws_account_id)

# To grant usage to all accounts in some AWS Ogranization
# layer.grantUsage({ accountId: '*', organizationId });

lambda_.Function(stack, "MyLayeredLambda",
    code=lambda_.InlineCode("foo"),
    handler="index.handler",
    runtime=lambda_.Runtime.NODEJS_LATEST,
    layers=[layer]
)
java
LayerVersion layer = LayerVersion.Builder.create(stack, "MyLayer")
        .code(Code.fromAsset(join(__dirname, "layer-code")))
        .compatibleRuntimes(List.of(Runtime.NODEJS_LATEST))
        .license("Apache-2.0")
        .description("A layer to test the L2 construct")
        .build();

// To grant usage by other AWS accounts
layer.addPermission("remote-account-grant", LayerVersionPermission.builder().accountId(awsAccountId).build());

// To grant usage to all accounts in some AWS Ogranization
// layer.grantUsage({ accountId: '*', organizationId });

// To grant usage to all accounts in some AWS Ogranization
// layer.grantUsage({ accountId: '*', organizationId });
Function.Builder.create(stack, "MyLayeredLambda")
        .code(new InlineCode("foo"))
        .handler("index.handler")
        .runtime(Runtime.NODEJS_LATEST)
        .layers(List.of(layer))
        .build();
csharp
// Install: dotnet add package Amazon.CDK.Lib
var layer = new LayerVersion(stack, "MyLayer", new LayerVersionProps {
    Code = Code.FromAsset(Join(__dirname, "layer-code")),
    CompatibleRuntimes = new [] { Runtime.NODEJS_LATEST },
    License = "Apache-2.0",
    Description = "A layer to test the L2 construct"
});

// To grant usage by other AWS accounts
layer.AddPermission("remote-account-grant", new LayerVersionPermission { AccountId = awsAccountId });

// To grant usage to all accounts in some AWS Ogranization
// layer.grantUsage({ accountId: '*', organizationId });

// To grant usage to all accounts in some AWS Ogranization
// layer.grantUsage({ accountId: '*', organizationId });
new Function(stack, "MyLayeredLambda", new FunctionProps {
    Code = new InlineCode("foo"),
    Handler = "index.handler",
    Runtime = Runtime.NODEJS_LATEST,
    Layers = new [] { layer }
});
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
layer := lambda.NewLayerVersion(stack, jsii.String("MyLayer"), &LayerVersionProps{
	Code: lambda.Code_FromAsset(path.join(__dirname, jsii.String("layer-code"))),
	CompatibleRuntimes: []Runtime{
		lambda.Runtime_NODEJS_LATEST(),
	},
	License: jsii.String("Apache-2.0"),
	Description: jsii.String("A layer to test the L2 construct"),
})

// To grant usage by other AWS accounts
layer.addPermission(jsii.String("remote-account-grant"), &LayerVersionPermission{
	AccountId: awsAccountId,
})

// To grant usage to all accounts in some AWS Ogranization
// layer.grantUsage({ accountId: '*', organizationId });

// To grant usage to all accounts in some AWS Ogranization
// layer.grantUsage({ accountId: '*', organizationId });
lambda.NewFunction(stack, jsii.String("MyLayeredLambda"), &FunctionProps{
	Code: lambda.NewInlineCode(jsii.String("foo")),
	Handler: jsii.String("index.handler"),
	Runtime: lambda.Runtime_NODEJS_LATEST(),
	Layers: []ILayerVersion{
		layer,
	},
})

Properties ​

accountIdstringaccount_idstraccountIdStringAccountIdstringAccountId*stringrequired#
The AWS Account id of the account that is authorized to use a Lambda Layer Version.

The wild-card '*' can be used to grant access to "any" account (or any account in an organization when organizationId is specified).

organizationIdoptionalstringorganization_idoptionalstrorganizationIdoptionalStringOrganizationIdoptionalstringOrganizationIdoptional*string#
The ID of the AWS Organization to which the grant is restricted.

Can only be specified if accountId is '*'