Share a single lambda service role across all lambda functions

This reduces the chance of reaching the AWS service quota limit of 1000
IAM roles per account when deploying many stacks with multiple lambdas
per stack.

src/cdk/add-lambda-resource.ts

@@ -1,17 +1,25 @@
+import type {LambdaFunctionConstructDependencies} from './create-lambda-function.js';
 import type {LambdaRoute, StackConfig} from '../parse-stack-config.js';
-import type {Stack, aws_lambda} from 'aws-cdk-lib';
+import type {aws_lambda} from 'aws-cdk-lib';
 
 import {addCorsPreflight} from './add-cors-preflight.js';
 import {createLambdaFunction} from './create-lambda-function.js';
 import {aws_apigateway} from 'aws-cdk-lib';
 
+export interface LambdaResourceConstructDependencies
+  extends LambdaFunctionConstructDependencies {
+  readonly requestAuthorizer: aws_apigateway.IAuthorizer | undefined;
+  readonly restApi: aws_apigateway.RestApiBase;
+}
+
 export function addLambdaResource(
   stackConfig: StackConfig,
   route: LambdaRoute,
-  stack: Stack,
-  restApi: aws_apigateway.RestApiBase,
-  requestAuthorizer: aws_apigateway.IAuthorizer | undefined,
+  constructDependencies: LambdaResourceConstructDependencies,
 ): aws_lambda.FunctionBase {
+  const {lambdaServiceRole, requestAuthorizer, restApi, stack} =
+    constructDependencies;
+
   const {
     httpMethod,
     publicPath,
@@ -30,7 +38,10 @@ export function addLambdaResource(
     .filter(([, {cacheKey}]) => cacheKey)
     .map(([parameterName]) => `method.request.querystring.${parameterName}`);
 
-  const lambdaFunction = createLambdaFunction(stackConfig, route, stack);
+  const lambdaFunction = createLambdaFunction(stackConfig, route, {
+    lambdaServiceRole,
+    stack,
+  });
 
   const integration = new aws_apigateway.LambdaIntegration(lambdaFunction, {
     cacheKeyParameters,

src/cdk/add-s3-resource.ts

@@ -5,13 +5,20 @@ import {addCorsPreflight} from './add-cors-preflight.js';
 import {aws_apigateway} from 'aws-cdk-lib';
 import {join} from 'path';
 
+export interface S3ResourceConstructDependencies {
+  readonly bucket: aws_s3.IBucket;
+  readonly bucketReadRole: aws_iam.IRole;
+  readonly requestAuthorizer: aws_apigateway.IAuthorizer | undefined;
+  readonly restApi: aws_apigateway.RestApiBase;
+}
+
 export function addS3Resource(
   route: S3Route,
-  restApi: aws_apigateway.RestApiBase,
-  bucket: aws_s3.IBucket,
-  bucketReadRole: aws_iam.IRole,
-  requestAuthorizer: aws_apigateway.IAuthorizer | undefined,
+  constructDependencies: S3ResourceConstructDependencies,
 ): void {
+  const {bucket, bucketReadRole, requestAuthorizer, restApi} =
+    constructDependencies;
+
   const {type, publicPath, path, authenticationEnabled, corsEnabled} = route;
 
   if (authenticationEnabled && !requestAuthorizer) {

src/cdk/create-lambda-function.ts

@@ -1,19 +1,26 @@
 import type {LambdaRoute, StackConfig} from '../parse-stack-config.js';
-import type {Stack} from 'aws-cdk-lib';
+import type {Stack, aws_iam} from 'aws-cdk-lib';
 
 import {getDomainName} from '../utils/get-domain-name.js';
 import {getHash} from '../utils/get-hash.js';
 import {getNormalizedName} from '../utils/get-normalized-name.js';
 import {Duration, aws_lambda, aws_logs} from 'aws-cdk-lib';
 import {basename, dirname, extname, join} from 'path';
 
+export interface LambdaFunctionConstructDependencies {
+  readonly lambdaServiceRole: aws_iam.IRole;
+  readonly stack: Stack;
+}
+
 const maxTimeoutInSeconds = 28;
 
 export function createLambdaFunction(
   stackConfig: StackConfig,
   route: LambdaRoute,
-  stack: Stack,
+  constructDependencies: LambdaFunctionConstructDependencies,
 ): aws_lambda.FunctionBase {
+  const {lambdaServiceRole, stack} = constructDependencies;
+
   const {
     httpMethod,
     publicPath,
@@ -60,6 +67,7 @@ export function createLambdaFunction(
       runtime: aws_lambda.Runtime.NODEJS_18_X,
       tracing: aws_lambda.Tracing.PASS_THROUGH,
       logRetention: aws_logs.RetentionDays.TWO_WEEKS,
+      role: lambdaServiceRole,
     },
   );
 }

src/cdk/create-lambda-service-role.ts

@@ -0,0 +1,15 @@
+import type {Stack} from 'aws-cdk-lib';
+
+import {aws_iam} from 'aws-cdk-lib';
+
+export function createLambdaServiceRole(stack: Stack): aws_iam.IRole {
+  return new aws_iam.Role(stack, `LambdaServiceRole`, {
+    assumedBy: new aws_iam.ServicePrincipal(`lambda.amazonaws.com`),
+    managedPolicies: [
+      aws_iam.ManagedPolicy.fromAwsManagedPolicyName(
+        `service-role/AWSLambdaBasicExecutionRole`,
+      ),
+      aws_iam.ManagedPolicy.fromAwsManagedPolicyName(`AWSXrayWriteOnlyAccess`),
+    ],
+  });
+}

src/synthesize-command.ts

@@ -4,6 +4,7 @@ import {addLambdaResource} from './cdk/add-lambda-resource.js';
 import {addS3Resource} from './cdk/add-s3-resource.js';
 import {createBucketReadRole} from './cdk/create-bucket-read-role.js';
 import {createBucket} from './cdk/create-bucket.js';
+import {createLambdaServiceRole} from './cdk/create-lambda-service-role.js';
 import {createRequestAuthorizer} from './cdk/create-request-authorizer.js';
 import {createRestApi} from './cdk/create-rest-api.js';
 import {createStack} from './cdk/create-stack.js';
@@ -31,26 +32,25 @@ export const synthesizeCommand: CommandModule<{}, {}> = {
     const bucket = createBucket(stack);
     const bucketReadRole = createBucketReadRole(stack, bucket);
     const requestAuthorizer = createRequestAuthorizer(stackConfig, stack);
+    const lambdaServiceRole = createLambdaServiceRole(stack);
 
     for (const route of stackConfig.routes) {
       if (route.type === `function`) {
-        const lambdaFunction = addLambdaResource(
-          stackConfig,
-          route,
-          stack,
-          restApi,
+        const lambdaFunction = addLambdaResource(stackConfig, route, {
+          lambdaServiceRole,
           requestAuthorizer,
-        );
+          restApi,
+          stack,
+        });
 
         route.onSynthesize?.({stack, restApi, lambdaFunction});
       } else {
-        addS3Resource(
-          route,
-          restApi,
+        addS3Resource(route, {
           bucket,
           bucketReadRole,
           requestAuthorizer,
-        );
+          restApi,
+        });
       }
     }