Provider
Defines an AWS CloudFormation custom resource provider.
Example
// Create custom resource handler entrypoint
const handler = new lambda.Function(this , 'my-handler', {
runtime: lambda.Runtime.NODEJS_20_X,
handler: 'index.handler',
code: lambda.Code.fromInline(`
exports.handler = async (event, context) => {
return {
PhysicalResourceId: '1234',
NoEcho: true,
Data: {
mySecret: 'secret-value',
hello: 'world',
ghToken: 'gho_xxxxxxx',
},
};
};`),
});
// Provision a custom resource provider framework
const provider = new cr.Provider(this , 'my-provider', {
onEventHandler: handler,
});
new CustomResource(this , 'my-cr', {
serviceToken: provider.serviceToken,
});
# Create custom resource handler entrypoint
handler = lambda_.Function(self, "my-handler",
runtime=lambda_.Runtime.NODEJS_20_X,
handler="index.handler",
code=lambda_.Code.from_inline("""
exports.handler = async (event, context) => {
return {
PhysicalResourceId: '1234',
NoEcho: true,
Data: {
mySecret: 'secret-value',
hello: 'world',
ghToken: 'gho_xxxxxxx',
},
};
};""")
)
# Provision a custom resource provider framework
provider = cr.Provider(self, "my-provider",
on_event_handler=handler
)
CustomResource(self, "my-cr",
service_token=provider.service_token
)
// Create custom resource handler entrypoint
Function handler = Function.Builder.create(this, "my-handler")
.runtime(Runtime.NODEJS_20_X)
.handler("index.handler")
.code(Code.fromInline("\n exports.handler = async (event, context) => {\n return {\n PhysicalResourceId: '1234',\n NoEcho: true,\n Data: {\n mySecret: 'secret-value',\n hello: 'world',\n ghToken: 'gho_xxxxxxx',\n },\n };\n };"))
.build();
// Provision a custom resource provider framework
Provider provider = Provider.Builder.create(this, "my-provider")
.onEventHandler(handler)
.build();
CustomResource.Builder.create(this, "my-cr")
.serviceToken(provider.getServiceToken())
.build();
// Install: dotnet add package Amazon.CDK.Lib
// Create custom resource handler entrypoint
var handler = new Function(this, "my-handler", new FunctionProps {
Runtime = Runtime.NODEJS_20_X,
Handler = "index.handler",
Code = Code.FromInline(@"
exports.handler = async (event, context) => {
return {
PhysicalResourceId: '1234',
NoEcho: true,
Data: {
mySecret: 'secret-value',
hello: 'world',
ghToken: 'gho_xxxxxxx',
},
};
};")
});
// Provision a custom resource provider framework
var provider = new Provider(this, "my-provider", new ProviderProps {
OnEventHandler = handler
});
new CustomResource(this, "my-cr", new CustomResourceProps {
ServiceToken = provider.ServiceToken
});
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
// Create custom resource handler entrypoint
handler := lambda.NewFunction(this, jsii.String("my-handler"), &FunctionProps{
Runtime: lambda.Runtime_NODEJS_20_X(),
Handler: jsii.String("index.handler"),
Code: lambda.Code_FromInline(jsii.String(`
exports.handler = async (event, context) => {
return {
PhysicalResourceId: '1234',
NoEcho: true,
Data: {
mySecret: 'secret-value',
hello: 'world',
ghToken: 'gho_xxxxxxx',
},
};
};`)),
})
// Provision a custom resource provider framework
provider := cr.NewProvider(this, jsii.String("my-provider"), &ProviderProps{
OnEventHandler: handler,
})
awscdk.NewCustomResource(this, jsii.String("my-cr"), &CustomResourceProps{
ServiceToken: provider.ServiceToken,
})
Initializer
new Provider(scope: Construct, id: string, props: ProviderProps)
Provider(scope: Construct, id: str, props: ProviderProps)
new Provider(Construct scope, String id, ProviderProps props)
new Provider(Construct scope, string id, ProviderProps props)
NewProvider(Scope Construct, Id *string, Props ProviderProps)
Construct Props
disableWaiterStateMachineLoggingoptionalbooleandisable_waiter_state_machine_loggingoptionalbooldisableWaiterStateMachineLoggingoptionalBooleanDisableWaiterStateMachineLoggingoptionalboolDisableWaiterStateMachineLoggingoptional*bool= true#frameworkCompleteAndTimeoutRoleoptionalIRoleframework_complete_and_timeout_roleoptionalIRoleframeworkCompleteAndTimeoutRoleoptionalIRoleFrameworkCompleteAndTimeoutRoleoptionalIRoleFrameworkCompleteAndTimeoutRoleoptionalIRole#Default: A default role will be created.
notes
Note that this role must be assumed by the 'lambda.amazonaws.com' service principal. To prevent circular dependency problem in the provider framework, please ensure you specify a different IAM Role for 'frameworkCompleteAndTimeoutRole' from 'frameworkOnEventRole'.
This property cannot be used with 'role' property
frameworkLambdaLoggingLeveloptionalApplicationLogLevelframework_lambda_logging_leveloptionalApplicationLogLevelframeworkLambdaLoggingLeveloptionalApplicationLogLevelFrameworkLambdaLoggingLeveloptionalApplicationLogLevelFrameworkLambdaLoggingLeveloptionalApplicationLogLevel#Default: true - Logging is disabled by default
frameworkOnEventRoleoptionalIRoleframework_on_event_roleoptionalIRoleframeworkOnEventRoleoptionalIRoleFrameworkOnEventRoleoptionalIRoleFrameworkOnEventRoleoptionalIRole#Default: A default role will be created.
Note that this role must be assumed by the 'lambda.amazonaws.com' service principal.
This property cannot be used with 'role' property
isCompleteHandleroptionalIFunctionis_complete_handleroptionalIFunctionisCompleteHandleroptionalIFunctionIsCompleteHandleroptionalIFunctionIsCompleteHandleroptionalIFunction#Default: provider is synchronous. This means that the onEvent handler is expected to finish all lifecycle operations within the initial invocation.
notes
This function will be called immediately after onEvent and then periodically based on the configured query interval as long as it returns false. If the function still returns false and the alloted timeout has passed, the operation will fail.
logGroupoptionalILogGroupReflog_groupoptionalILogGroupReflogGroupoptionalILogGroupRefLogGroupoptionalILogGroupRefLogGroupoptionalILogGroupRef#Default: a default log group created by AWS Lambda
Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16. If you are deploying to another type of region, please check regional availability first.
logRetentionoptionalRetentionDayslog_retentionoptionalRetentionDayslogRetentionoptionalRetentionDaysLogRetentionoptionalRetentionDaysLogRetentionoptionalRetentionDays= logs.RetentionDays.INFINITE#notes
When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to INFINITE.
This is a legacy API and we strongly recommend you migrate to logGroup if you can. logGroup allows you to create a fully customizable log group and instruct the Lambda function to send logs to it.
onEventHandlerIFunctionon_event_handlerIFunctiononEventHandlerIFunctionOnEventHandlerIFunctionOnEventHandlerIFunctionrequired#notes
This function is responsible to begin the requested resource operation (CREATE/UPDATE/DELETE) and return any additional properties to add to the event, which will later be passed to isComplete. The PhysicalResourceId property must be included in the response.
providerFunctionEnvEncryptionoptionalIKeyRefprovider_function_env_encryptionoptionalIKeyRefproviderFunctionEnvEncryptionoptionalIKeyRefProviderFunctionEnvEncryptionoptionalIKeyRefProviderFunctionEnvEncryptionoptionalIKeyRef#Default: AWS Lambda creates and uses an AWS managed customer master key (CMK)
providerFunctionNameoptionalstringprovider_function_nameoptionalstrproviderFunctionNameoptionalStringProviderFunctionNameoptionalstringProviderFunctionNameoptional*string#Default: CloudFormation default name from unique physical ID
The provider lambda function name.
queryIntervaloptionalDurationquery_intervaloptionalDurationqueryIntervaloptionalDurationQueryIntervaloptionalDurationQueryIntervaloptionalDuration= Duration.seconds(5)#The first isComplete will be called immediately after handler and then every queryInterval seconds, and until timeout has been reached or until isComplete returns true.
Default: A default role will be created.
The role is shared by provider framework's onEvent, isComplete lambda, and onTimeout Lambda functions. This role will be assumed by the AWS Lambda, so it must be assumable by the 'lambda.amazonaws.com' service principal.
securityGroupsoptionalISecurityGroup[]security_groupsoptionaltyping.List[ISecurityGroup]securityGroupsoptionalList<ISecurityGroup>SecurityGroupsoptionalISecurityGroup[]SecurityGroupsoptional*[]ISecurityGroup#Default: If vpc is not supplied, no security groups are attached. Otherwise, a dedicated security group is created for each function.
Only used if 'vpc' is supplied
totalTimeoutoptionalDurationtotal_timeoutoptionalDurationtotalTimeoutoptionalDurationTotalTimeoutoptionalDurationTotalTimeoutoptionalDuration= Duration.minutes(30)#The maximum timeout is 1 hour (yes, it can exceed the AWS Lambda 15 minutes)
Default: functions are not provisioned inside a vpc.
vpcSubnetsoptionalSubnetSelectionvpc_subnetsoptionalSubnetSelectionvpcSubnetsoptionalSubnetSelectionVpcSubnetsoptionalSubnetSelectionVpcSubnetsoptionalSubnetSelection#Default: the Vpc default strategy if not specified
Only used if 'vpc' is supplied. Note: internet access for Lambdas requires a NAT gateway, so picking Public subnets is not allowed.
waiterStateMachineLogOptionsoptionalLogOptionswaiter_state_machine_log_optionsoptionalLogOptionswaiterStateMachineLogOptionsoptionalLogOptionsWaiterStateMachineLogOptionsoptionalLogOptionsWaiterStateMachineLogOptionsoptionalLogOptions#Default: A default log group will be created if logging for the waiter state machine is enabled.
Properties
isCompleteHandlermay be undefinedIFunctionis_complete_handlermay be undefinedIFunctionisCompleteHandlermay be undefinedIFunctionIsCompleteHandlermay be undefinedIFunctionIsCompleteHandlermay be undefinedIFunction#onEventHandlerIFunctionon_event_handlerIFunctiononEventHandlerIFunctionOnEventHandlerIFunctionOnEventHandlerIFunction#PROPERTY_INJECTION_IDstringproperty_injection_idstrPROPERTY_INJECTION_IDStringPROPERTY_INJECTION_IDstringPROPERTY_INJECTION_ID*stringstatic#Methods
isConstruct(x: any): boolean@staticmethod def is_construct(x: Any) -> boolpublic static Boolean isConstruct(Object x)public static bool IsConstruct(object x)func IsConstruct(X interface{}) *boolstatic#notes · 1 parameter · returns
Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.
Parameters
xxxxX— Any object.
Returns: true if x is an object created from a class which extends Construct.
toString(): stringdef to_string(self, ) -> strpublic String toString()public string ToString()func ToString() *string#with(...mixins: IMixin[]): IConstructdef with(self, mixins: IMixin) -> IConstructpublic IConstruct with(IMixin mixins)public IConstruct With(IMixin mixins)func With(Mixins IMixin) IConstruct#Mixins are applied in order. The list of constructs is captured at the start of the call, so constructs added by a mixin will not be visited. Use multiple with() calls if subsequent mixins should apply to added constructs.
1 parameter · returns
Parameters
mixinsmixinsmixinsmixinsMixins— The mixins to apply.
Returns: This construct for chaining