From ae648f1d153656b865631ac12867fd562558566a Mon Sep 17 00:00:00 2001 From: mani Date: Tue, 28 Jul 2026 10:28:54 -0700 Subject: [PATCH] Make AWS Lambda role and external ID optional in create-version The server enforces them via the require_role_and_external_id setting, so the CLI requires only the function ARN and defers that policy to the server. Co-Authored-By: Claude Opus 4.8 --- internal/temporalcli/commands.gen.go | 8 ++++---- internal/temporalcli/commands.worker.deployment.go | 6 ++---- .../temporalcli/commands.worker.deployment_test.go | 7 +++++-- internal/temporalcli/commands.yaml | 12 ++++-------- 4 files changed, 15 insertions(+), 18 deletions(-) diff --git a/internal/temporalcli/commands.gen.go b/internal/temporalcli/commands.gen.go index 4807779f1..6b0fb541a 100644 --- a/internal/temporalcli/commands.gen.go +++ b/internal/temporalcli/commands.gen.go @@ -3661,8 +3661,8 @@ func NewTemporalWorkerDeploymentCreateVersionCommand(cctx *CommandContext, paren } s.Command.Args = cobra.NoArgs s.Command.Flags().StringVar(&s.AwsLambdaFunctionArn, "aws-lambda-function-arn", "", "Qualified (contains version suffix) or unqualified AWS Lambda function ARN to invoke when there are no active pollers for task queue targets in the Worker Deployment.") - s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified.") - s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified.") + s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version.") + s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value.") s.Command.Flags().StringVar(&s.GcpCloudRunProject, "gcp-cloud-run-project", "", "GCP project ID hosting the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.") s.Command.Flags().StringVar(&s.GcpCloudRunRegion, "gcp-cloud-run-region", "", "Region of the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.") s.Command.Flags().StringVar(&s.GcpCloudRunWorkerPool, "gcp-cloud-run-worker-pool", "", "GCP Cloud Run worker pool name to scale when there are no active pollers for task queue targets in the Worker Deployment.") @@ -3993,8 +3993,8 @@ func NewTemporalWorkerDeploymentUpdateVersionComputeConfigCommand(cctx *CommandC } s.Command.Args = cobra.NoArgs s.Command.Flags().StringVar(&s.AwsLambdaFunctionArn, "aws-lambda-function-arn", "", "Qualified (contains version suffix) or unqualified AWS Lambda function ARN to invoke when there are no active pollers for task queue targets in the Worker Deployment.") - s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified.") - s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified.") + s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version.") + s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value.") s.Command.Flags().StringVar(&s.GcpCloudRunProject, "gcp-cloud-run-project", "", "GCP project ID hosting the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.") s.Command.Flags().StringVar(&s.GcpCloudRunRegion, "gcp-cloud-run-region", "", "Region of the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.") s.Command.Flags().StringVar(&s.GcpCloudRunWorkerPool, "gcp-cloud-run-worker-pool", "", "GCP Cloud Run worker pool name to scale when there are no active pollers for task queue targets in the Worker Deployment.") diff --git a/internal/temporalcli/commands.worker.deployment.go b/internal/temporalcli/commands.worker.deployment.go index a32d749ee..f054243f3 100644 --- a/internal/temporalcli/commands.worker.deployment.go +++ b/internal/temporalcli/commands.worker.deployment.go @@ -885,10 +885,8 @@ func (c *TemporalWorkerDeploymentManagerIdentityUnsetCommand) run(cctx *CommandC } func validateAWSLambdaProviderDetails(details map[string]any) error { - for _, key := range []string{"arn", "role", "role_external_id"} { - if _, ok := details[key]; !ok { - return fmt.Errorf("missing required AWS Lambda provider detail: %s", key) - } + if v, ok := details["arn"].(string); !ok || v == "" { + return fmt.Errorf("missing required AWS Lambda provider detail: arn") } return nil } diff --git a/internal/temporalcli/commands.worker.deployment_test.go b/internal/temporalcli/commands.worker.deployment_test.go index d7642ee0f..19378386b 100644 --- a/internal/temporalcli/commands.worker.deployment_test.go +++ b/internal/temporalcli/commands.worker.deployment_test.go @@ -1286,6 +1286,9 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() { s.Error(res.Err) s.ErrorContains(res.Err, "failed to assume role arn:aws:iam::123456789012:role/MyServiceRole: operation error STS: AssumeRole") + // The CLI does not require role/external ID; the server enforces them when + // its require_role_and_external_id setting is true (the default here), so + // omitting either is rejected server-side. missingExternalIDBuildID := uuid.NewString() res = s.Execute( @@ -1297,7 +1300,7 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() { "--aws-lambda-assume-role-arn", assumeRoleARN, ) s.Error(res.Err) - s.ErrorContains(res.Err, "missing required AWS Lambda provider detail: role_external_id") + s.ErrorContains(res.Err, `AWS Lambda compute provider requires "role_external_id" to be configured`) missingAssumeRoleBuildID := uuid.NewString() @@ -1309,7 +1312,7 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() { "--aws-lambda-function-arn", invokeARN, ) s.Error(res.Err) - s.ErrorContains(res.Err, "missing required AWS Lambda provider detail: role") + s.ErrorContains(res.Err, `AWS Lambda compute provider requires "role" to be configured`) // --gcp-cloud-run-worker-pool requires project, region, and // service-account; the first missing detail key is reported. diff --git a/internal/temporalcli/commands.yaml b/internal/temporalcli/commands.yaml index 7fbe8b5bd..fa7e12668 100644 --- a/internal/temporalcli/commands.yaml +++ b/internal/temporalcli/commands.yaml @@ -1131,15 +1131,13 @@ commands: description: | AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker - Deployment Version. Required when --aws-lambda-function-arn is - specified. + Deployment Version. - name: aws-lambda-assume-role-external-id type: string description: | Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has - an aws:ExternalId condition that matches the supplied value. Required - when --aws-lambda-function-arn is specified. + an aws:ExternalId condition that matches the supplied value. - name: gcp-cloud-run-project type: string description: | @@ -1428,15 +1426,13 @@ commands: description: | AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker - Deployment Version. Required when --aws-lambda-function-arn is - specified. + Deployment Version. - name: aws-lambda-assume-role-external-id type: string description: | Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has - an aws:ExternalId condition that matches the supplied value. Required - when --aws-lambda-function-arn is specified. + an aws:ExternalId condition that matches the supplied value. - name: gcp-cloud-run-project type: string description: |