cerbos / cerbos-aws-lambda Goto Github PK

Hello,

I have been trying to follow all your steps in order to run this in a lambda but it has been impossible.

I am using s3 as disk as part of the config file:
cerbos-aws-lambda\conf.default.yml

storage:
  driver: "blob"
  blob:
    # This section is required only if storage.driver is blob.
    bucket: "s3://cerbos-test-pdp?region=us-west-2" 
    downloadTimeout: 30s # DownloadTimeout specifies the timeout for downloading from cloud storage.
    prefix: policies # Prefix specifies a subdirectory to download.
    requestTimeout: 10s # RequestTimeout specifies the timeout for an HTTP request.
    updatePollInterval: 15s # UpdatePollInterval specifies the interval to poll the cloud storage. Set to 0 to disable.

And just in case, I added the s3 config as part of the sam.yaml file:

Variables:
          BUCKET_URL: "s3://cerbos-test-pdp?region=us-west-2"
          BUCKET_PREFIX: "policies"
          CERBOS_LOG_LEVEL: DEBUG

and the set of permissions I attached to the lambda running the cerbos image:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:*",
                "s3-object-lambda:*"
            ],
            "Resource": "arn:aws:s3:::cerbos-test-pdp/*"
        }
    ]
}

ERROR: failed to create store: unknown storage driver [blob]

Please, any help is appreciated. This is driving me nuts.

thanks.

There is an issue with grep regex on Linux.

If an S3 bucket URL is provided in the config can we check/grant read access to the role created by the SAM template?

based on the lambda pricing page arm64 is NOT available in the the following regions:
af-south-1, ap-east-1, ap-northeast-2, ap-northeast-3, ca-central-1, eu-south-1, eu-west-3, eu-north-1, me-south-1, sa-east-1, and us-west-1

This causes an issue if you build the image on an M1 mac and try to deploy in these regions

https://github.com/mthenw/awesome-layers
https://aws.amazon.com/about-aws/whats-new/2018/11/aws-lambda-now-supports-custom-runtimes-and-layers/