Package software.amazon.awscdk.services.lambda

Class CfnResourcePolicy

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
software.amazon.awscdk.CfnElement
software.amazon.awscdk.CfnRefElement
software.amazon.awscdk.CfnResource
software.amazon.awscdk.services.lambda.CfnResourcePolicy
All Implemented Interfaces:
IInspectable, IEnvironmentAware, IResourcePolicyRef, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
@Generated(value="jsii-pacmak/1.139.0 (build 26a6b54)", date="2026-09-02T11:03:12.887Z") @Stability(Stable) public class CfnResourcePolicy extends CfnResource implements IInspectable, IResourcePolicyRef
Use the AWS::Lambda::ResourcePolicy resource to attach a resource-based policy to a LAM resource.

A resource-based policy applies to a single LAM resource, for example, a function, function version, or function alias. To learn more about using resource-based policies with LAM, see Working with resource-based policies in in the Developer Guide. You can use resource-based policies to grant permissions to other AWS services, AWS accounts and organizations, and IAM users and roles to access your LAM resource. You can also deny access to specific entities, and use the full range of IAM global condition keys to further restrict who has access to your LAM resource. For example, you can limit access to calls originating from a specified IP address or VPC. A resource-based policy is a JSON document containing a number of statements. Each statement defines the entities you want to grant permission to, the API actions you want to allow or deny, and the LAM resource you want the statement to apply to. A statement can also optionally include an array of logical conditions using the IAM global condition keys. To use the AWS::Lambda::ResourcePolicy resource, make sure that you have the resource-based policy permissions for Lambda. To learn more about creating resource-based policies, see Policies and permissions in in the User Guide. For more information about example policies for providing permissions to AWS services, other AWS accounts, and IAM users and roles, see Example resource-based policies for functions in the Developer Guide. Avoid mixing permission resource types To grant permissions to access your function, we recommend using the AWS::Lambda::ResourcePolicy resource to set access permissions. With this resource, you have more flexibility and fine-grained control than AWS::Lambda::Permission. This resource grants an AWS service or another account permission to call a particular API action on a function. You can also use the AWS::Lambda::Permission resource, however using both AWS::Lambda::Permission and AWS::Lambda::ResourcePolicy to set permissions on a function can result in errors. Permissions defined in AWS::Lambda::Permission can be unintentionally overwritten, whether in a single CFN stack or across multiple stacks. Don't use both resource types to set permissions on a function. To migrate existing permissions for a function from AWS::Lambda::Permission to AWS::Lambda::ResourcePolicy, do the following:

  1. Set a Retaindeletion policy on the AWS::Lambda::Permission resources you want to migrate. This is necessary so that Lambda does not delete statements with the same statement ID when you delete these resources.
  2. Use the GetResourcePolicyLAM API to retrieve the resource-based policy currently attached to the function.
  3. Use this policy to create a new AWS::Lambda::ResourcePolicy resource.
  4. Delete all the existing AWS::Lambda::Permission resources for the function.

Example: 

 // The code below shows an example of how to instantiate this type.
 // The values are placeholders you should change.
 import software.amazon.awscdk.services.lambda.*;
 Object policyDocument;
 CfnResourcePolicy cfnResourcePolicy = CfnResourcePolicy.Builder.create(this, "MyCfnResourcePolicy")
         .policyDocument(policyDocument)
         .resourceArn("resourceArn")
         .build();

See Also:

  • Field Details

    • CFN_RESOURCE_TYPE_NAME

      @Stability(Stable) public static final String CFN_RESOURCE_TYPE_NAME
      The CloudFormation resource type name for this resource class.

  • Constructor Details

    • CfnResourcePolicy

      protected CfnResourcePolicy(software.amazon.jsii.JsiiObjectRef objRef)

    • CfnResourcePolicy

      protected CfnResourcePolicy(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

    • CfnResourcePolicy

      @Stability(Stable) public CfnResourcePolicy(@NotNull software.constructs.Construct scope, @NotNull String id, @NotNull CfnResourcePolicyProps props)
      Create a new AWS::Lambda::ResourcePolicy.

      Parameters:
      scope - Scope in which this resource is defined. This parameter is required.
      id - Construct identifier for this resource (unique in its scope). This parameter is required.
      props - Resource properties. This parameter is required.

  • Method Details

    • isCfnResourcePolicy

      @Stability(Stable) @NotNull public static Boolean isCfnResourcePolicy(@NotNull Object x)
      Checks whether the given object is a CfnResourcePolicy.

      Parameters:
      x - This parameter is required.

    • inspect

      @Stability(Stable) public void inspect(@NotNull TreeInspector inspector)
      Examines the CloudFormation resource and discloses attributes.

      Specified by:
      inspect in interface IInspectable
      Parameters:
      inspector - tree inspector to collect and process attributes. This parameter is required.

    • renderProperties

      @Stability(Stable) @NotNull protected Map<String,Object> renderProperties(@NotNull Map<String,Object> props)
      Overrides:
      renderProperties in class CfnResource
      Parameters:
      props - This parameter is required.

    • getCfnProperties

      @Stability(Stable) @NotNull protected Map<String,Object> getCfnProperties()
      Overrides:
      getCfnProperties in class CfnResource

    • getCfnPropertyNames

      @Stability(Stable) @NotNull protected Map<String,String> getCfnPropertyNames()
      Overrides:
      getCfnPropertyNames in class CfnResource

    • getResourcePolicyRef

      @Stability(Stable) @NotNull public ResourcePolicyReference getResourcePolicyRef()
      A reference to a ResourcePolicy resource.
      Specified by:
      getResourcePolicyRef in interface IResourcePolicyRef

    • getPolicyDocument

      @Stability(Stable) @NotNull public Object getPolicyDocument()
      The policy document you want to add to your LAM resource.

    • setPolicyDocument

      @Stability(Stable) public void setPolicyDocument(@NotNull Object value)
      The policy document you want to add to your LAM resource.

    • getResourceArn

      @Stability(Stable) @NotNull public String getResourceArn()
      The Amazon Resource Name (ARN) of the LAM resource you want to add the policy to.

    • setResourceArn

      @Stability(Stable) public void setResourceArn(@NotNull String value)
      The Amazon Resource Name (ARN) of the LAM resource you want to add the policy to.