Feature request: Add resource names to destination linkages

[allanchua101]

Describe your idea/feature/enhancement

In order to ease SAM connector's integration to storage resources as destinations (DynamoDBs, SQS Queues and Secrets), it will be really cool to add support to their names. This will make cross cloud formation stack integration much easier.

Proposal

I wish SAM connectors could be defined such as:

  StripePayoutInitiatorCron:
    Type: AWS::Serverless::Function
    Connectors:
      ReadConnectors:
        Properties:
          Destination:
            - Name: !Sub "${Environment}-${Version}-stripe-trail-queue" # SQS
            - Name: !Sub "${Environment}-${Version}-stripe-api-key" # Secrets manager
            - Name: !Sub "${Environment}-${Version}-stripe-payouts-db" # DynamoDB

[hoffa]

Currently you'd have to specify Type and Arn for SQS and DynamoDB (see this table) if the resources aren't in the same template:

  StripePayoutInitiatorCron:
    Type: AWS::Serverless::Function
    Connectors:
      Properties:
        ReadConnectors:
          Destination:
            - Type: AWS::SQS::Queue 
              Arn: !Sub "arn:${AWS::Partition}:sqs:${AWS::Region}:${AWS::AccountId}:${Environment}-${Version}-stripe-trail-queue" # SQS
            - Type: AWS::DynamoDB::Table
              Arn: !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${Environment}-${Version}-stripe-payouts-db" # DynamoDB
          Permissions:
            - Read

It might be technically possible to support Name for (most) resources, but since the SAM transform is a CloudFormation macro, it would still require some way of determining the type of a resource:

  StripePayoutInitiatorCron:
    Type: AWS::Serverless::Function
    Connectors:
      Properties:
        ReadConnectors:
          Destination:
            - Type: AWS::SQS::Queue 
              Name: !Sub "${Environment}-${Version}-stripe-trail-queue" # SQS
            - Type: AWS::DynamoDB::Table
              Name: !Sub "${Environment}-${Version}-stripe-payouts-db" # DynamoDB
          Permissions:
            - Read

To understand better, is the specific problem that it's too much friction figuring out the ARN format when only the name is known?

[allanchua101]

Currently you'd have to specify Type and Arn for SQS and DynamoDB (see this table) if the resources aren't in the same template:

  StripePayoutInitiatorCron:
    Type: AWS::Serverless::Function
    Connectors:
      Properties:
        ReadConnectors:
          Destination:
            - Type: AWS::SQS::Queue 
              Arn: !Sub "arn:${AWS::Partition}:sqs:${AWS::Region}:${AWS::AccountId}:${Environment}-${Version}-stripe-trail-queue" # SQS
            - Type: AWS::DynamoDB::Table
              Arn: !Sub "arn:${AWS::Partition}:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${Environment}-${Version}-stripe-payouts-db" # DynamoDB
          Permissions:
            - Read

It might be technically possible to support Name for (most) resources, but since the SAM transform is a CloudFormation macro, it would still require some way of determining the type of a resource:

  StripePayoutInitiatorCron:
    Type: AWS::Serverless::Function
    Connectors:
      Properties:
        ReadConnectors:
          Destination:
            - Type: AWS::SQS::Queue 
              Name: !Sub "${Environment}-${Version}-stripe-trail-queue" # SQS
            - Type: AWS::DynamoDB::Table
              Name: !Sub "${Environment}-${Version}-stripe-payouts-db" # DynamoDB
          Permissions:
            - Read

To understand better, is the specific problem that it's too much friction figuring out the ARN format when only the name is known?

Yes Hoffa! Importing ARNs from other cloudformation stacks could be daunting for large projects and most of the time, we want to be able to directly reference other resources by their names.

[hoffa]

Got it.

I had a quick look at the feasibility of this.

For context, connectors are mostly defined in a single configuration file. For example AWS::Lambda::Function to AWS::SQS::Queue includes:

serverless-application-model/samtranslator/model/connector_profiles/profiles.json

Lines 238 to 246 in 201b318

	"Read": {
	"Statement": [
	{
	"Effect": "Allow",
	"Action": ["sqs:ReceiveMessage", "sqs:GetQueueAttributes"],
	"Resource": ["%{Destination.Arn}"]
	}
	]
	},

The %{Destination.Arn} is essentially what makes passing the Arn property necessary when Id isn't used.

One solution to the request would be to change the configuration file to support multiple input formats, so that you can either pass the full ARN or its constituent parts, such as the name.

So for example, the above configuration could become:

"Read": {
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:GetQueueAttributes"
      ],
      "Resource": [
        {
          "__anyOf__": [
            "%{Destination.Arn}",
            "arn:%{Destination.Partition}:sqs:%{Destination.Region}:%{Destination.AccountId}:%{Destination.Name}"
          ]
        }
      ]
    }
  ]
}, 

That way you could either pass the Type and Arn (as usual), or Type and Name:

  MyFunction:
    Type: AWS::Serverless::Function
    Connectors:
      Properties:
        MyConnector:
          Destination:
            Type: AWS::SQS::Queue 
            Name: MyQueueName
          Permissions:
            - Read

We can default Partition to ${AWS::Partition}, Region to ${AWS::Region}, and AccountId to ${AWS::AccountId}. But of course you could also pass them as properties to change the default values.

In most situations you would only need to pass Type and Name. Arguably for some resources Name isn't very meaningful, so instead you might have to pass something such as ResourceId for AWS::ApiGateway::RestApi:

serverless-application-model/samtranslator/model/connector_profiles/profiles.json

Line 404 in 201b318

"SourceArn": "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:%{Source.ResourceId}/%{Source.Qualifier}"