(stepfunctions-tasks): support bring your own role for Lambda created by EvaluteExpression

[lagroujl]

(stepfunctions-tasks): support bring your own role for Lambda created by EvaluteExpression

[lagroujl]

I had already created a pull request for this. But I jumped in when I thought this was a little simpler than it turned out to be. So I thought a better approach was to create an issue/socialize the change & implementation.

the main issue is getting around the fact that EvaluateExpression uses SingletonFunction. Which is fine for the existing implementation, but adding the role property can cause some confusing behavior if its not implemented correctly. The first thing I noticed was the UUID is based only on the nodejs version, so you need to also take into account the role passed in, or the first instance of SingletonFunction evaluated will prevent other roles from being used.

[pahud]

Makes sense.

Before we have the fix I guess you probably can find out the IAM role of the lambda SingletonFunction and override it with your existing one. You probably can modify my sample to fit your needs:

[pahud]

While workaround is possible, we still welcome and appreciate any pull requests to address this.

[lagroujl]

#29212 is also a good example of what can go wrong. With my implementation, if you were to change the role between deployments, any currently running workflows could fail.

• I also considered just accepting the first occurrence of EvaluateExpression wins scenario. Then as a user, you have to make sure the role property is set on every occurrence of EvaluateExpression in the stack.

• Another approach could be to just add the uuid to the API of EvaluateExpression. If omitted, EvaluteExpression uses the current behavior, otherwise users can force a uuid without messing with private APIs. It can still land in some non-intuitive behavior but at least the users have a public API & visibility into what the issue is + solves the issue of keeping the same lambda function through configuration updates.

• my implemented approach of adding the role's node addr into the uuid, so each role used will create different lambda functions, but reusing a role should also reuse the Lambda function. that only solves this issue and not 29212