Skip to content

Make AWS Lambda role and external ID optional in create-version #1140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mani-j9 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Make AWS Lambda role and external ID optional in create-version #1140

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ae648f1
Make AWS Lambda role and external ID optional in create-version
Jul 28, 2026
137d686
Merge branch 'main' into mani/relax-lambda-role-eid-validation
mani-j9 Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions internal/temporalcli/commands.gen.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3665,8 +3665,8 @@ func NewTemporalWorkerDeploymentCreateVersionCommand(cctx *CommandContext, paren
}
s.Command.Args = cobra.NoArgs
s.Command.Flags().StringVar(&s.AwsLambdaFunctionArn, "aws-lambda-function-arn", "", "Qualified (contains version suffix) or unqualified AWS Lambda function ARN to invoke when there are no active pollers for task queue targets in the Worker Deployment.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value.")
s.Command.Flags().StringVar(&s.GcpCloudRunProject, "gcp-cloud-run-project", "", "GCP project ID hosting the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
s.Command.Flags().StringVar(&s.GcpCloudRunRegion, "gcp-cloud-run-region", "", "Region of the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
s.Command.Flags().StringVar(&s.GcpCloudRunWorkerPool, "gcp-cloud-run-worker-pool", "", "GCP Cloud Run worker pool name to scale when there are no active pollers for task queue targets in the Worker Deployment.")
Expand Down Expand Up @@ -4005,8 +4005,8 @@ func NewTemporalWorkerDeploymentUpdateVersionComputeConfigCommand(cctx *CommandC
}
s.Command.Args = cobra.NoArgs
s.Command.Flags().StringVar(&s.AwsLambdaFunctionArn, "aws-lambda-function-arn", "", "Qualified (contains version suffix) or unqualified AWS Lambda function ARN to invoke when there are no active pollers for task queue targets in the Worker Deployment.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version. Required when --aws-lambda-function-arn is specified.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value. Required when --aws-lambda-function-arn is specified.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version.")
s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value.")
s.Command.Flags().StringVar(&s.GcpCloudRunProject, "gcp-cloud-run-project", "", "GCP project ID hosting the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
s.Command.Flags().StringVar(&s.GcpCloudRunRegion, "gcp-cloud-run-region", "", "Region of the Cloud Run worker pool. Required when --gcp-cloud-run-worker-pool is specified.")
s.Command.Flags().StringVar(&s.GcpCloudRunWorkerPool, "gcp-cloud-run-worker-pool", "", "GCP Cloud Run worker pool name to scale when there are no active pollers for task queue targets in the Worker Deployment.")
Expand Down
6 changes: 2 additions & 4 deletions internal/temporalcli/commands.worker.deployment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -990,10 +990,8 @@ func (c *TemporalWorkerDeploymentManagerIdentityUnsetCommand) run(cctx *CommandC
}

func validateAWSLambdaProviderDetails(details map[string]any) error {
for _, key := range []string{"arn", "role", "role_external_id"} {
if _, ok := details[key]; !ok {
return fmt.Errorf("missing required AWS Lambda provider detail: %s", key)
}
if v, ok := details["arn"].(string); !ok || v == "" {
return fmt.Errorf("missing required AWS Lambda provider detail: arn")
}
return nil
}
Expand Down
7 changes: 5 additions & 2 deletions internal/temporalcli/commands.worker.deployment_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1290,6 +1290,9 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() {
s.Error(res.Err)
s.ErrorContains(res.Err, "failed to assume role arn:aws:iam::123456789012:role/MyServiceRole: operation error STS: AssumeRole")

// The CLI does not require role/external ID; the server enforces them when
// its require_role_and_external_id setting is true (the default here), so
// omitting either is rejected server-side.
missingExternalIDBuildID := uuid.NewString()

res = s.Execute(
Expand All @@ -1301,7 +1304,7 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() {
"--aws-lambda-assume-role-arn", assumeRoleARN,
)
s.Error(res.Err)
s.ErrorContains(res.Err, "missing required AWS Lambda provider detail: role_external_id")
s.ErrorContains(res.Err, `AWS Lambda compute provider requires "role_external_id" to be configured`)

missingAssumeRoleBuildID := uuid.NewString()

Expand All @@ -1313,7 +1316,7 @@ func (s *SharedServerSuite) TestCreateWorkerDeploymentVersion_Errors() {
"--aws-lambda-function-arn", invokeARN,
)
s.Error(res.Err)
s.ErrorContains(res.Err, "missing required AWS Lambda provider detail: role")
s.ErrorContains(res.Err, `AWS Lambda compute provider requires "role" to be configured`)

// --gcp-cloud-run-worker-pool requires project, region, and
// service-account; the first missing detail key is reported.
Expand Down
12 changes: 4 additions & 8 deletions internal/temporalcli/commands.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1135,15 +1135,13 @@ commands:
description: |
AWS IAM role ARN that the Temporal server will assume when invoking
the Lambda function that spawns a new Worker in this Worker
Deployment Version. Required when --aws-lambda-function-arn is
specified.
Deployment Version.
- name: aws-lambda-assume-role-external-id
type: string
description: |
Temporal server will enforce that the AWS IAM trust policy associated
with the AWS IAM role specified in --aws-lambda-assume-role-arn has
an aws:ExternalId condition that matches the supplied value. Required
when --aws-lambda-function-arn is specified.
an aws:ExternalId condition that matches the supplied value.
- name: gcp-cloud-run-project
type: string
description: |
Expand Down Expand Up @@ -1486,15 +1484,13 @@ commands:
description: |
AWS IAM role ARN that the Temporal server will assume when invoking
the Lambda function that spawns a new Worker in this Worker
Deployment Version. Required when --aws-lambda-function-arn is
specified.
Deployment Version.
- name: aws-lambda-assume-role-external-id
type: string
description: |
Temporal server will enforce that the AWS IAM trust policy associated
with the AWS IAM role specified in --aws-lambda-assume-role-arn has
an aws:ExternalId condition that matches the supplied value. Required
when --aws-lambda-function-arn is specified.
an aws:ExternalId condition that matches the supplied value.
- name: gcp-cloud-run-project
type: string
description: |
Expand Down