AwsCustomResource
Defines a custom resource that is materialized using specific AWS API calls.
These calls are created using a singleton Lambda function.
Use this to bridge any gap that might exist in the CloudFormation Coverage. You can specify exactly which calls are invoked for the 'CREATE', 'UPDATE' and 'DELETE' life cycle events.
Example
const crossAccountRoleArn = 'arn:aws:iam::OTHERACCOUNT:role/CrossAccountRoleName'; // arn of role deployed in separate account
const callRegion = 'us-west-1'; // sdk call to be made in specified region (optional)
new cr.AwsCustomResource(this, 'CrossAccount', {
onCreate: {
assumedRoleArn: crossAccountRoleArn,
region: callRegion, // optional
service: 'sts',
action: 'GetCallerIdentity',
physicalResourceId: cr.PhysicalResourceId.of('id'),
},
policy: cr.AwsCustomResourcePolicy.fromStatements([iam.PolicyStatement.fromJson({
Effect: "Allow",
Action: "sts:AssumeRole",
Resource: crossAccountRoleArn,
})]),
});
cross_account_role_arn = "arn:aws:iam::OTHERACCOUNT:role/CrossAccountRoleName" # arn of role deployed in separate account
call_region = "us-west-1" # sdk call to be made in specified region (optional)
cr.AwsCustomResource(self, "CrossAccount",
on_create=cr.AwsSdkCall(
assumed_role_arn=cross_account_role_arn,
region=call_region, # optional
service="sts",
action="GetCallerIdentity",
physical_resource_id=cr.PhysicalResourceId.of("id")
),
policy=cr.AwsCustomResourcePolicy.from_statements([iam.PolicyStatement.from_json({
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": cross_account_role_arn
})])
)
String crossAccountRoleArn = "arn:aws:iam::OTHERACCOUNT:role/CrossAccountRoleName"; // arn of role deployed in separate account
String callRegion = "us-west-1"; // sdk call to be made in specified region (optional)
// sdk call to be made in specified region (optional)
AwsCustomResource.Builder.create(this, "CrossAccount")
.onCreate(AwsSdkCall.builder()
.assumedRoleArn(crossAccountRoleArn)
.region(callRegion) // optional
.service("sts")
.action("GetCallerIdentity")
.physicalResourceId(PhysicalResourceId.of("id"))
.build())
.policy(AwsCustomResourcePolicy.fromStatements(List.of(PolicyStatement.fromJson(Map.of(
"Effect", "Allow",
"Action", "sts:AssumeRole",
"Resource", crossAccountRoleArn)))))
.build();
// Install: dotnet add package Amazon.CDK.Lib
var crossAccountRoleArn = "arn:aws:iam::OTHERACCOUNT:role/CrossAccountRoleName"; // arn of role deployed in separate account
var callRegion = "us-west-1"; // sdk call to be made in specified region (optional)
// sdk call to be made in specified region (optional)
new AwsCustomResource(this, "CrossAccount", new AwsCustomResourceProps {
OnCreate = new AwsSdkCall {
AssumedRoleArn = crossAccountRoleArn,
Region = callRegion, // optional
Service = "sts",
Action = "GetCallerIdentity",
PhysicalResourceId = PhysicalResourceId.Of("id")
},
Policy = AwsCustomResourcePolicy.FromStatements(new [] { PolicyStatement.FromJson(new Dictionary<string, string> {
{ "Effect", "Allow" },
{ "Action", "sts:AssumeRole" },
{ "Resource", crossAccountRoleArn }
}) })
});
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
crossAccountRoleArn := "arn:aws:iam::OTHERACCOUNT:role/CrossAccountRoleName" // arn of role deployed in separate account
callRegion := "us-west-1" // sdk call to be made in specified region (optional)
// sdk call to be made in specified region (optional)
cr.NewAwsCustomResource(this, jsii.String("CrossAccount"), &AwsCustomResourceProps{
OnCreate: &AwsSdkCall{
AssumedRoleArn: crossAccountRoleArn,
Region: callRegion,
// optional
Service: jsii.String("sts"),
Action: jsii.String("GetCallerIdentity"),
PhysicalResourceId: cr.PhysicalResourceId_Of(jsii.String("id")),
},
Policy: cr.AwsCustomResourcePolicy_FromStatements([]PolicyStatement{
iam.PolicyStatement_FromJson(map[string]*string{
"Effect": jsii.String("Allow"),
"Action": jsii.String("sts:AssumeRole"),
"Resource": crossAccountRoleArn,
}),
}),
})
Initializer
new AwsCustomResource(scope: Construct, id: string, props: AwsCustomResourceProps)
AwsCustomResource(scope: Construct, id: str, props: AwsCustomResourceProps)
new AwsCustomResource(Construct scope, String id, AwsCustomResourceProps props)
new AwsCustomResource(Construct scope, string id, AwsCustomResourceProps props)
NewAwsCustomResource(Scope Construct, Id *string, Props AwsCustomResourceProps)
Construct Props
functionNamestringfunction_namestrfunctionNameStringFunctionNamestringFunctionName*string= AWS CloudFormation generates a u…#The function name will remain the same after the first AwsCustomResource is created in a stack.
default
Default: AWS CloudFormation generates a unique physical ID and uses that ID for the function's name. For more information, see Name Type.
installLatestAwsSdkbooleaninstall_latest_aws_sdkboolinstallLatestAwsSdkBooleanInstallLatestAwsSdkboolInstallLatestAwsSdk*bool= The value of `@aws-cdk/customres…#notes · default
If not specified, this uses whatever JavaScript SDK version is the default in AWS Lambda at the time of execution.
Otherwise, installs the latest version from 'npmjs.com'. The installation takes around 60 seconds and requires internet connectivity.
The default can be controlled using the context key @aws-cdk/customresources:installLatestAwsSdkDefault is.
Default: The value of @aws-cdk/customresources:installLatestAwsSdkDefault, otherwise true
logGroupILogGroupReflog_groupILogGroupReflogGroupILogGroupRefLogGroupILogGroupRefLogGroupILogGroupRef= a default log group created by A…#Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first.
default
Default: a default log group created by AWS Lambda
logRetentionRetentionDayslog_retentionRetentionDayslogRetentionRetentionDaysLogRetentionRetentionDaysLogRetentionRetentionDays= logs.RetentionDays.INFINITE#This is a legacy API and we strongly recommend you migrate to logGroup if you can. logGroup allows you to create a fully customizable log group and instruct the Lambda function to send logs to it.
memorySizenumbermemory_sizeint | floatmemorySizeNumberMemorySizedoubleMemorySize*float64= 512 mega in case if installLates…#default
Default: 512 mega in case if installLatestAwsSdk is false.
onCreateAwsSdkCallon_createAwsSdkCallonCreateAwsSdkCallOnCreateAwsSdkCallOnCreateAwsSdkCall= the call when the resource is up…#default
Default: the call when the resource is updated
onDeleteAwsSdkCallon_deleteAwsSdkCallonDeleteAwsSdkCallOnDeleteAwsSdkCallOnDeleteAwsSdkCall= no call#onUpdateAwsSdkCallon_updateAwsSdkCallonUpdateAwsSdkCallOnUpdateAwsSdkCallOnUpdateAwsSdkCall= no call#policyAwsCustomResourcePolicypolicyAwsCustomResourcePolicypolicyAwsCustomResourcePolicyPolicyAwsCustomResourcePolicyPolicyAwsCustomResourcePolicy= no policy added#notes
The custom resource also implements iam.IGrantable, making it possible to use the grantXxx() methods.
As this custom resource uses a singleton Lambda function, it's important to note the that function's role will eventually accumulate the permissions/grants from all resources.
Note that a policy must be specified if role is not provided, as by default a new role is created which requires policy changes to access resources.
removalPolicyRemovalPolicyremoval_policyRemovalPolicyremovalPolicyRemovalPolicyRemovalPolicyRemovalPolicyRemovalPolicyRemovalPolicy= cdk.RemovalPolicy.Destroy#resourceTypestringresource_typestrresourceTypeStringResourceTypestringResourceType*string= Custom::AWS#This role will apply to all AwsCustomResource instances in the stack. The role must be assumable by the lambda.amazonaws.com service principal.
serviceTimeoutDurationservice_timeoutDurationserviceTimeoutDurationServiceTimeoutDurationServiceTimeoutDuration= Duration.seconds(3600)#notes
You should not need to set this property. It is intended to allow quick turnaround even if the implementor of the custom resource forgets to include a try/catch. We have included the try/catch, and AWS service calls usually do not take an hour to complete.
The value must be between 1 second and 3600 seconds.
default
Default: the function is not provisioned inside a vpc.
vpcSubnetsSubnetSelectionvpc_subnetsSubnetSelectionvpcSubnetsSubnetSelectionVpcSubnetsSubnetSelectionVpcSubnetsSubnetSelection= the Vpc default strategy if not …#Only used if 'vpc' is supplied. Note: internet access for Lambdas requires a NAT gateway, so picking Public subnets is not allowed.
default
Default: the Vpc default strategy if not specified
Properties
grantPrincipalIPrincipalgrant_principalIPrincipalgrantPrincipalIPrincipalGrantPrincipalIPrincipalGrantPrincipalIPrincipalrequired#PROPERTY_INJECTION_IDstringproperty_injection_idstrPROPERTY_INJECTION_IDStringPROPERTY_INJECTION_IDstringPROPERTY_INJECTION_ID*stringrequiredstatic#PROVIDER_FUNCTION_UUIDstringprovider_function_uuidstrPROVIDER_FUNCTION_UUIDStringPROVIDER_FUNCTION_UUIDstringPROVIDER_FUNCTION_UUID*stringrequiredstatic#Methods
getResponseField(dataPath: string): stringdef get_response_field(self, data_path: str) -> strpublic String getResponseField(String dataPath)public string GetResponseField(string dataPath)func GetResponseField(DataPath *string) *string#notes · 1 parameter
Example for S3 / listBucket : 'Buckets.0.Name'
Note that you cannot use this method if ignoreErrorCodesMatching is configured for any of the SDK calls. This is because in such a case, the response data might not exist, and will cause a CloudFormation deploy time error.
Parameters
dataPathdata_pathdataPathdataPathDataPath— the path to the data.
getResponseFieldReference(dataPath: string): Referencedef get_response_field_reference(self, data_path: str) -> Referencepublic Reference getResponseFieldReference(String dataPath)public Reference GetResponseFieldReference(string dataPath)func GetResponseFieldReference(DataPath *string) Reference#notes · 1 parameter
Example for S3 / listBucket : 'Buckets.0.Name'
Use Token.asXxx to encode the returned Reference as a specific type or use the convenience getDataString for string attributes.
Note that you cannot use this method if ignoreErrorCodesMatching is configured for any of the SDK calls. This is because in such a case, the response data might not exist, and will cause a CloudFormation deploy time error.
Parameters
dataPathdata_pathdataPathdataPathDataPath— the path to the data.
isConstruct(x: any): boolean@staticmethod def is_construct(x: Any) -> boolpublic static Boolean isConstruct(Object x)public static bool IsConstruct(object x)func IsConstruct(X interface{}) *boolstatic#notes · 1 parameter · returns
Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.
Parameters
xxxxX— Any object.
Returns: true if x is an object created from a class which extends Construct.
toString(): stringdef to_string(self, ) -> strpublic String toString()public string ToString()func ToString() *string#with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.
1 parameter · returns
Parameters
mixinsmixinsmixinsmixinsMixins— The mixins to apply.
Returns: This construct for chaining