Each DynamoDB stream event handler duplicates the IAM policy, causing "Maximum policy size exceeded" about serverless

[tibbe]

Assuming I'm looking at the right code, it's not obvious why this happens:

serverless/lib/plugins/aws/package/compile/events/stream.js

Line 241 in 7b1e012

dynamodbStreamStatement.Resource.push(EventSourceArn);

The above code seems to add each resource to the same statement (although without any deduping based on the resource, from what I can see). I don't see how we end up getting multiple statements.

[tibbe]

Could it be that CloudFormation (perhaps when doing an incremental deployment) appends rather than overwrites the policy?

[tibbe]

The IAM policy editor shows "Suggestions: Redundant Statement", so it agrees these statements are redundant.

[tibbe]

Manually deleting all sections containing dynamodb:GetRecords except one, followed by a redeploy didn't recreate all those sections. This suggests that this perhaps has to do with either something that happened in an earlier serverless version or something that has to do with incremental updates of some sort.

[tibbe]

My workaround from #12313 (comment) no longer works. I'm not sure why it ever did. Deploys are now completely blocked due to the number of dynamodb:GetRecords statements in the lambdaRole.

This is a rather serious problem. Our serverless stack is no longer deployable and we need to consider rather undesirable workarounds, like manually merging Lambdas to reduce the size of the IAM document.

[tibbe]

I tried a workaround by using a custom role, however that doesn't help as the default lambdaRole policy still contains a copy of dynamodb:GetRecords and friends, even if the lambda doesn't use the default role.

[tibbe]

I've updated to the latest version and confirmed the problem persists there:

Framework Core: 3.38.0 (local) 3.38.0 (global)
Plugin: 7.2.0
SDK: 4.5.1

[tibbe]

Upon reading the code again it's please what's going on. We're adding the same statement (in particular, the same list of allowed actions) for each event stream processing function. This is unnecessary and only the list of resources needs to be updated per function. Fix: #12320

[tibbe]

We're currently running a patched version of serverless to be able to deploy to production due to this bug. Could someone please take a look at the provided PR with the fix?

[tibbe]

This is a production blocking issue for larger scale users of serverless with a simple fix provided as a PR. Could someone please take a look?