Release 1.92.0 (to main)

.cfnlintrc.yaml

@@ -131,11 +131,16 @@ ignore_templates:
   - tests/translator/output/**/function_with_mq.json  # Property "EventSourceArn" can Fn::GetAtt to a resource of types [AWS::DynamoDB::GlobalTable, AWS::DynamoDB::Table, AWS::Kinesis::Stream, AWS::Kinesis::StreamConsumer, AWS::SQS::Queue]
   - tests/translator/output/**/function_with_mq_using_autogen_role.json  # Property "EventSourceArn" can Fn::GetAtt to a resource of types [AWS::DynamoDB::GlobalTable, AWS::DynamoDB::Table, AWS::Kinesis::Stream, AWS::Kinesis::StreamConsumer, AWS::SQS::Queue]
   - tests/translator/output/**/function_with_recursive_loop.json  # Invalid Property Resources/RecursiveLoopParameterFunction/Properties/RecursiveLoop
+  - tests/translator/output/**/function_with_sourcekmskeyarn.json  # Invalid Property Resources/SourceKMSKeyArnParameterFunction/Properties/SourceKMSKeyArn
   - tests/translator/output/**/function_with_tracing.json # Obsolete DependsOn on resource
   - tests/translator/output/**/api_with_propagate_tags.json # TODO: Intentional error transform tests. Will be updated.
   - tests/translator/output/**/function_with_intrinsics_resource_attribute.json # CFN now supports intrinsics in DeletionPolicy
+  - tests/translator/output/**/function_with_snapstart.json # Snapstart intentionally not attached to a lambda version which causes lint issues
+  - tests/translator/output/**/managed_policies_everything.json # intentionally contains wrong arns
 ignore_checks:
   - E2531 # Deprecated runtime; not relevant for transform tests
+  - E2533 # Another deprecated runtime; not relevant for transform tests
   - W2531 # EOL runtime; not relevant for transform tests
   - E3001 # Invalid or unsupported Type; common in transform tests since they focus on SAM resources
   - W2001 # Parameter not used
+  - E3006 # Resource type check; we have some Foo Bar resources

DEVELOPMENT_GUIDE.md

@@ -59,10 +59,10 @@ We format our code using [Black](https://github.com/python/black) and verify the
 during PR checks. Black will be installed automatically with `make init`.
 
 After installing, you can run our formatting through our Makefile by `make format` or integrating Black directly in your favorite IDE (instructions
-can be found [here](https://black.readthedocs.io/en/stable/editor_integration.html))
+can be found [here](https://black.readthedocs.io/en/stable/integrations/editors.html))
 
 ##### (Workaround) Integrating Black directly in your favorite IDE
-Since black is installed in virtualenv, when you follow [this instruction](https://black.readthedocs.io/en/stable/editor_integration.html), `which black` might give you this
+Since black is installed in virtualenv, when you follow [this instruction](https://black.readthedocs.io/en/stable/integrations/editors.html), `which black` might give you this
 
 ```bash
 (sam38) $ where black

bin/add_transform_test.py

@@ -68,8 +68,13 @@ def get_input_file_path() -> Path:
 
 
 def copy_input_file_to_transform_test_dir(input_file_path: Path, transform_test_input_path: Path) -> None:
-    shutil.copyfile(input_file_path, transform_test_input_path)
-    print(f"Transform Test input file generated {transform_test_input_path}")
+    try:
+        shutil.copyfile(input_file_path, transform_test_input_path)
+        print(f"Transform Test input file generated {transform_test_input_path}")
+    except shutil.SameFileError:
+        print(f"Source and destination are the same file: {input_file_path}")
+    except Exception as e:
+        raise e
 
 
 def verify_input_template(input_file_path: Path) -> None:
@@ -99,7 +104,9 @@ def main() -> None:
     verify_input_template(input_file_path)
 
     transform_test_input_path = TRANSFORM_TEST_DIR / "input" / (file_basename + ".yaml")
-    copy_input_file_to_transform_test_dir(input_file_path, transform_test_input_path)
+    # check if the template is not already in the transform test input dir
+    if input_file_path != transform_test_input_path:
+        copy_input_file_to_transform_test_dir(input_file_path, transform_test_input_path)
 
     generate_transform_test_output_files(transform_test_input_path, file_basename)
 

bin/run_cfn_lint.sh

@@ -9,7 +9,7 @@ if [ ! -d "${VENV}" ]; then
     python3 -m venv "${VENV}"
 fi
 
-"${VENV}/bin/python" -m pip install cfn-lint==0.75.0 --upgrade --quiet
+"${VENV}/bin/python" -m pip install cfn-lint --upgrade --quiet
 # update cfn schema
 "${VENV}/bin/cfn-lint" -u
 "${VENV}/bin/cfn-lint" --format parseable

integration/resources/templates/combination/all_policy_templates.yaml

@@ -8,7 +8,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: hello.handler
-      Runtime: python3.8
+      Runtime: python3.11
       Policies:
 
       - SQSPollerPolicy:
@@ -123,7 +123,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: hello.handler
-      Runtime: python3.8
+      Runtime: python3.11
       Policies:
 
       - SESEmailTemplateCrudPolicy: {}
@@ -187,7 +187,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: hello.handler
-      Runtime: python3.8
+      Runtime: python3.11
       Policies:
       - ElasticMapReduceModifyInstanceFleetPolicy:
           ClusterId: name

integration/resources/templates/combination/api_with_authorizers_invokefunction_set_none.yaml

@@ -12,7 +12,7 @@ Resources:
       InlineCode: |
         print("hello")
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
       Events:
         API3:
           Type: Api

integration/resources/templates/combination/api_with_authorizers_max.yaml

@@ -125,8 +125,8 @@ Resources:
     Type: AWS::IAM::Role
     Properties:
       ManagedPolicyArns:
-      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
-      - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
+      - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+      - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaRole
       AssumeRolePolicyDocument:
         Version: '2012-10-17'
         Statement:

integration/resources/templates/combination/api_with_authorizers_max_openapi.yaml

@@ -138,8 +138,8 @@ Resources:
     Type: AWS::IAM::Role
     Properties:
       ManagedPolicyArns:
-      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
-      - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
+      - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+      - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaRole
       AssumeRolePolicyDocument:
         Version: '2012-10-17'
         Statement:

integration/resources/templates/combination/connector_function_to_location_place_index.yaml

@@ -9,7 +9,7 @@ Resources:
   TriggerFunction:
     Type: AWS::Serverless::Function
     Properties:
-      Runtime: python3.8
+      Runtime: python3.11
       Handler: index.handler
       InlineCode: |
         import boto3

integration/resources/templates/combination/depends_on.yaml

@@ -12,7 +12,7 @@ Resources:
       Role:
         Fn::GetAtt: LambdaRole.Arn
       Handler: lambda_function.lambda_handler
-      Runtime: python3.8
+      Runtime: python3.11
       Timeout: 15
       CodeUri: ${codeuri}
 

integration/resources/templates/combination/function_with_custom_code_deploy.yaml

@@ -10,7 +10,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
 
       AutoPublishAlias: Live
 

integration/resources/templates/combination/function_with_deployment_basic.yaml

@@ -5,7 +5,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
 
       AutoPublishAlias: Live
 

integration/resources/templates/combination/function_with_deployment_default_role_managed_policy.yaml

@@ -4,7 +4,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
       AutoPublishAlias: Live
       DeploymentPreference:
         Type: Canary10Percent5Minutes

integration/resources/templates/combination/function_with_deployment_globals.yaml

@@ -16,7 +16,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
       AutoPublishAlias: Live
 
   DeploymentRole:

integration/resources/templates/combination/function_with_http_api.yaml

@@ -3,7 +3,7 @@ Resources:
     Type: AWS::Serverless::Function
     Properties:
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
       InlineCode: |
         def handler(event, context):
             return {'body': 'Hello World!', 'statusCode': 200}

integration/resources/templates/combination/function_with_http_api_default_path.yaml

@@ -3,7 +3,7 @@ Resources:
     Type: AWS::Serverless::Function
     Properties:
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
       InlineCode: |
         def handler(event, context):
             return {'body': 'Hello World!', 'statusCode': 200}

integration/resources/templates/combination/function_with_implicit_http_api.yaml

@@ -4,7 +4,7 @@ Resources:
     Type: AWS::Serverless::Function
     Properties:
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
       InlineCode: |
         def handler(event, context):
             return {'body': 'Hello World!', 'statusCode': 200}

integration/resources/templates/combination/function_with_mq.yaml

@@ -101,7 +101,8 @@ Resources:
               secretsmanager:GetSecretValue]
             Effect: Allow
             Resource: '*'
-      ManagedPolicyArns: [arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]
+      ManagedPolicyArns:
+      - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
       Tags:
       - {Value: SAM, Key: lambda:createdBy}
 

integration/resources/templates/combination/function_with_msk.yaml

@@ -27,7 +27,8 @@ Resources:
               logs:CreateLogStream, logs:PutLogEvents]
             Effect: Allow
             Resource: '*'
-      ManagedPolicyArns: [arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]
+      ManagedPolicyArns:
+      - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
       Tags:
       - {Value: SAM, Key: lambda:createdBy}
 

integration/resources/templates/combination/function_with_msk_trigger_and_s3_onfailure_events_destinations.yaml

@@ -27,7 +27,8 @@ Resources:
               logs:CreateLogStream, logs:PutLogEvents, s3:ListBucket]
             Effect: Allow
             Resource: '*'
-      ManagedPolicyArns: [arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole]
+      ManagedPolicyArns:
+      - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
       Tags:
       - {Value: SAM, Key: lambda:createdBy}
 

integration/resources/templates/combination/function_with_policy_templates.yaml

@@ -14,7 +14,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: hello.handler
-      Runtime: python3.8
+      Runtime: python3.11
       Policies:
       - SQSPollerPolicy:
           QueueName:

integration/resources/templates/combination/function_with_resource_refs.yaml

@@ -10,14 +10,14 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: hello.handler
-      Runtime: python3.8
+      Runtime: python3.11
       AutoPublishAlias: Live
 
   MyOtherFunction:
     Type: AWS::Serverless::Function
     Properties:
       CodeUri: ${codeuri}
-      Runtime: python3.8
+      Runtime: python3.11
       Handler: hello.handler
       Environment:
         Variables:

integration/resources/templates/combination/http_api_with_auth.yaml

@@ -3,7 +3,7 @@ Resources:
     Type: AWS::Serverless::Function
     Properties:
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
       InlineCode: |
         def handler(event, context):
             return {'body': 'Hello World!', 'statusCode': 200}

integration/resources/templates/combination/http_api_with_auth_updated.yaml

@@ -3,7 +3,7 @@ Resources:
     Type: AWS::Serverless::Function
     Properties:
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
       InlineCode: |
         def handler(event, context):
             return {'body': 'Hello World!', 'statusCode': 200}

integration/resources/templates/combination/http_api_with_fail_on_warnings_and_default_stage_name.yaml

@@ -16,7 +16,7 @@ Resources:
       InlineCode: |
         def handler(event, context):
           print("Hello, world!")
-      Runtime: python3.8
+      Runtime: python3.11
       Architectures:
       - x86_64
       Events:

integration/resources/templates/combination/state_machine_with_policy_templates.yaml

@@ -24,7 +24,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: hello.handler
-      Runtime: python3.8
+      Runtime: python3.11
 
   MyQueue:
     Type: AWS::SQS::Queue

integration/resources/templates/single/basic_api_with_mode.yaml

@@ -9,7 +9,7 @@ Resources:
     Type: AWS::Serverless::Function
     Properties:
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
       AutoPublishAlias: live
       InlineCode: |
         import json
@@ -31,6 +31,6 @@ Resources:
 
 Outputs:
   ApiEndpoint:
-    Value: !Sub "https://${MyApi}.execute-api.${AWS::Region}.amazonaws.com/MyNewStageName"
+    Value: !Sub "https://${MyApi}.execute-api.${AWS::Region}.${AWS::URLSuffix}/MyNewStageName"
 Metadata:
   SamTransformTest: true

integration/resources/templates/single/basic_api_with_mode_update.yaml

@@ -9,7 +9,7 @@ Resources:
     Type: AWS::Serverless::Function
     Properties:
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
       AutoPublishAlias: live
       InlineCode: |
         def handler(event, context):

integration/resources/templates/single/function_with_deployment_preference_alarms_intrinsic_if.yaml

@@ -9,7 +9,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: hello.handler
-      Runtime: python3.8
+      Runtime: python3.11
       AutoPublishAlias: live
       DeploymentPreference:
         Type: Linear10PercentEvery3Minutes

integration/resources/templates/single/function_with_role_path.yaml

@@ -4,7 +4,7 @@ Resources:
     Properties:
       CodeUri: ${codeuri}
       Handler: hello.handler
-      Runtime: python3.8
+      Runtime: python3.11
       RolePath: /foo/bar/
 Metadata:
   SamTransformTest: true

integration/resources/templates/single/state_machine_with_api.yaml

@@ -14,12 +14,12 @@ Resources:
             print(event)
             return "do nothing"
       Handler: index.handler
-      Runtime: python3.8
+      Runtime: python3.11
   Post:
     Type: AWS::Serverless::StateMachine
     Properties:
       Policies:
-      - arn:aws:iam::aws:policy/AWSLambda_FullAccess
+      - !Sub arn:${AWS::Partition}:iam::aws:policy/AWSLambda_FullAccess
       Definition:
         StartAt: One
         States:

samtranslator/__init__.py

@@ -1 +1 @@
-__version__ = "1.91.0"
+__version__ = "1.92.0"

samtranslator/internal/schema_source/aws_serverless_function.py

@@ -513,6 +513,7 @@ class ScheduleV2Event(BaseModel):
 RuntimeManagementConfig = Optional[PassThroughProp]  # TODO: check the type
 LoggingConfig = Optional[PassThroughProp]  # TODO: add documentation
 RecursiveLoop = Optional[PassThroughProp]
+SourceKMSKeyArn = Optional[PassThroughProp]
 
 
 class Properties(BaseModel):
@@ -640,6 +641,7 @@ class Properties(BaseModel):
     VpcConfig: Optional[VpcConfig] = prop("VpcConfig")
     LoggingConfig: Optional[PassThroughProp]  # TODO: add documentation
     RecursiveLoop: Optional[PassThroughProp]  # TODO: add documentation
+    SourceKMSKeyArn: Optional[PassThroughProp]  # TODO: add documentation
 
 
 class Globals(BaseModel):
@@ -699,6 +701,7 @@ class Globals(BaseModel):
     RuntimeManagementConfig: Optional[RuntimeManagementConfig] = prop("RuntimeManagementConfig")
     LoggingConfig: Optional[PassThroughProp]  # TODO: add documentation
     RecursiveLoop: Optional[PassThroughProp]  # TODO: add documentation
+    SourceKMSKeyArn: Optional[PassThroughProp]  # TODO: add documentation
 
 
 class Resource(ResourceAttributes):

samtranslator/internal/schema_source/aws_serverless_statemachine.py

@@ -174,6 +174,7 @@ class Properties(BaseModel):
     Type: Optional[PassThroughProp] = properties("Type")
     AutoPublishAlias: Optional[PassThroughProp]
     DeploymentPreference: Optional[PassThroughProp]
+    UseAliasAsEventTarget: Optional[bool]
 
 
 class Resource(ResourceAttributes):