Switched to a sequential creation of permission resorces for the same function

Author: AntonBazhal

add-permissions.js

@@ -38,10 +38,11 @@ module.exports = class AwsAddLambdaAccountPermissions {
 
       const functionLogicalId = this.provider.naming.getLambdaLogicalId(functionName);
 
-      functionAllowAccess.forEach(principal => {
+      functionAllowAccess.reduce((previousResourceName, principal) => {
         principal = principal.toString();
-        const resourceName = principal.replace(/\b\w/g, l => l.toUpperCase()).replace(/[_\W]+/g, "");
-        resources.Resources[`${functionLogicalId}PermitInvokeFrom${resourceName}`] = {
+        const principalName = principal.replace(/\b\w/g, l => l.toUpperCase()).replace(/[_\W]+/g, "");
+        const resourceName = `${functionLogicalId}PermitInvokeFrom${principalName}`;
+        const resource = {
           Type: 'AWS::Lambda::Permission',
           Properties: {
             Action: 'lambda:InvokeFunction',
@@ -51,7 +52,14 @@ module.exports = class AwsAddLambdaAccountPermissions {
             Principal: principal
           }
         };
-      });
+
+        if (previousResourceName) {
+          resource.DependsOn = previousResourceName;
+        }
+
+        resources.Resources[resourceName] = resource;
+        return resourceName;
+      }, null);
     });
   }
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "serverless-plugin-lambda-account-access",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "engines": {
     "node": ">=4.0"
   },

test/add-permissions-tests.js

@@ -157,7 +157,8 @@ describe('serverless-plugin-lambda-account-access', function() {
                 'Fn::GetAtt': [ 'Function1LambdaFunction', 'Arn' ],
               },
               'Principal': '222222222222'
-            }
+            },
+            'DependsOn': 'Function1LambdaFunctionPermitInvokeFrom111111111111'
           },
           'Function2LambdaFunctionPermitInvokeFrom111111111111': {
             'Type': 'AWS::Lambda::Permission',
@@ -177,7 +178,8 @@ describe('serverless-plugin-lambda-account-access', function() {
                 'Fn::GetAtt': [ 'Function2LambdaFunction', 'Arn' ],
               },
               'Principal': '222222222222'
-            }
+            },
+            'DependsOn': 'Function2LambdaFunctionPermitInvokeFrom111111111111'
           }
         });
     });
@@ -215,7 +217,8 @@ describe('serverless-plugin-lambda-account-access', function() {
                 'Fn::GetAtt': [ 'Function2LambdaFunction', 'Arn' ],
               },
               'Principal': '222222222222'
-            }
+            },
+            'DependsOn': 'Function2LambdaFunctionPermitInvokeFrom111111111111'
           }
         });
     });
@@ -253,7 +256,8 @@ describe('serverless-plugin-lambda-account-access', function() {
                 'Fn::GetAtt': [ 'Function2LambdaFunction', 'Arn' ],
               },
               'Principal': '222222222222'
-            }
+            },
+            'DependsOn': 'Function2LambdaFunctionPermitInvokeFrom111111111111'
           }
         });
     });
@@ -291,7 +295,8 @@ describe('serverless-plugin-lambda-account-access', function() {
                 'Fn::GetAtt': [ 'Function1LambdaFunction', 'Arn' ],
               },
               'Principal': '444444444444'
-            }
+            },
+            'DependsOn': 'Function1LambdaFunctionPermitInvokeFrom333333333333'
           },
           'Function2LambdaFunctionPermitInvokeFrom111111111111': {
             'Type': 'AWS::Lambda::Permission',
@@ -311,7 +316,8 @@ describe('serverless-plugin-lambda-account-access', function() {
                 'Fn::GetAtt': [ 'Function2LambdaFunction', 'Arn' ],
               },
               'Principal': '222222222222'
-            }
+            },
+            'DependsOn': 'Function2LambdaFunctionPermitInvokeFrom111111111111'
           }
         });
     });