AwsCustomResourceProps Struct
Properties for AwsCustomResource.
Note that at least onCreate, onUpdate or onDelete must be specified.
Example
const crossAccountRoleArn = 'arn:aws:iam::OTHERACCOUNT:role/CrossAccountRoleName'; // arn of role deployed in separate account
const callRegion = 'us-west-1'; // sdk call to be made in specified region (optional)
new cr.AwsCustomResource(this, 'CrossAccount', {
onCreate: {
assumedRoleArn: crossAccountRoleArn,
region: callRegion, // optional
service: 'sts',
action: 'GetCallerIdentity',
physicalResourceId: cr.PhysicalResourceId.of('id'),
},
policy: cr.AwsCustomResourcePolicy.fromStatements([iam.PolicyStatement.fromJson({
Effect: "Allow",
Action: "sts:AssumeRole",
Resource: crossAccountRoleArn,
})]),
});
Properties
functionNamestringfunction_namestrfunctionNameStringFunctionNamestringFunctionName*string= AWS CloudFormation generates a u…#The function name will remain the same after the first AwsCustomResource is created in a stack.
default
Default: AWS CloudFormation generates a unique physical ID and uses that ID for the function's name. For more information, see Name Type.
installLatestAwsSdkbooleaninstall_latest_aws_sdkboolinstallLatestAwsSdkBooleanInstallLatestAwsSdkboolInstallLatestAwsSdk*bool= The value of `@aws-cdk/customres…#notes · default
If not specified, this uses whatever JavaScript SDK version is the default in AWS Lambda at the time of execution.
Otherwise, installs the latest version from 'npmjs.com'. The installation takes around 60 seconds and requires internet connectivity.
The default can be controlled using the context key @aws-cdk/customresources:installLatestAwsSdkDefault is.
Default: The value of @aws-cdk/customresources:installLatestAwsSdkDefault, otherwise true
logGroupILogGroupReflog_groupILogGroupReflogGroupILogGroupRefLogGroupILogGroupRefLogGroupILogGroupRef= a default log group created by A…#Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first.
default
Default: a default log group created by AWS Lambda
logRetentionRetentionDayslog_retentionRetentionDayslogRetentionRetentionDaysLogRetentionRetentionDaysLogRetentionRetentionDays= logs.RetentionDays.INFINITE#This is a legacy API and we strongly recommend you migrate to logGroup if you can. logGroup allows you to create a fully customizable log group and instruct the Lambda function to send logs to it.
memorySizenumbermemory_sizeint | floatmemorySizeNumberMemorySizedoubleMemorySize*float64= 512 mega in case if installLates…#default
Default: 512 mega in case if installLatestAwsSdk is false.
onCreateAwsSdkCallon_createAwsSdkCallonCreateAwsSdkCallOnCreateAwsSdkCallOnCreateAwsSdkCall= the call when the resource is up…#default
Default: the call when the resource is updated
onDeleteAwsSdkCallon_deleteAwsSdkCallonDeleteAwsSdkCallOnDeleteAwsSdkCallOnDeleteAwsSdkCall= no call#onUpdateAwsSdkCallon_updateAwsSdkCallonUpdateAwsSdkCallOnUpdateAwsSdkCallOnUpdateAwsSdkCall= no call#policyAwsCustomResourcePolicypolicyAwsCustomResourcePolicypolicyAwsCustomResourcePolicyPolicyAwsCustomResourcePolicyPolicyAwsCustomResourcePolicy= no policy added#notes
The custom resource also implements iam.IGrantable, making it possible to use the grantXxx() methods.
As this custom resource uses a singleton Lambda function, it's important to note the that function's role will eventually accumulate the permissions/grants from all resources.
Note that a policy must be specified if role is not provided, as by default a new role is created which requires policy changes to access resources.
removalPolicyRemovalPolicyremoval_policyRemovalPolicyremovalPolicyRemovalPolicyRemovalPolicyRemovalPolicyRemovalPolicyRemovalPolicy= cdk.RemovalPolicy.Destroy#resourceTypestringresource_typestrresourceTypeStringResourceTypestringResourceType*string= Custom::AWS#This role will apply to all AwsCustomResource instances in the stack. The role must be assumable by the lambda.amazonaws.com service principal.
serviceTimeoutDurationservice_timeoutDurationserviceTimeoutDurationServiceTimeoutDurationServiceTimeoutDuration= Duration.seconds(3600)#notes
You should not need to set this property. It is intended to allow quick turnaround even if the implementor of the custom resource forgets to include a try/catch. We have included the try/catch, and AWS service calls usually do not take an hour to complete.
The value must be between 1 second and 3600 seconds.
default
Default: the function is not provisioned inside a vpc.
vpcSubnetsSubnetSelectionvpc_subnetsSubnetSelectionvpcSubnetsSubnetSelectionVpcSubnetsSubnetSelectionVpcSubnetsSubnetSelection= the Vpc default strategy if not …#Only used if 'vpc' is supplied. Note: internet access for Lambdas requires a NAT gateway, so picking Public subnets is not allowed.
default
Default: the Vpc default strategy if not specified