Add support for selectively ignoring Globals in AWS SAM template for specific functions

[EnkhAmar]

Issue:
Currently, Globals are applied to all functions defined in the AWS SAM template, which can cause issues when users want to customize specific functions without affecting the others. This issue has been reported by some users, and a possible solution is to introduce a new property to the function definition that allows users to selectively ignore Globals for specific functions.

Proposed Solution:
Add a new property to the function definition, such as "IgnoreGlobals" or similar, that allows users to specify whether or not Globals should be applied to that particular function. This would give users more control over how Globals are applied in their AWS SAM templates and would make it easier to customize functions without affecting the entire template.

Please share your thoughts or feedback on this proposal. Thank you!

[ssenchenko]

Thank you for your request.

It is possible to override Globals in the specific function. What is the problem that you're facing?

[EnkhAmar]

@ssenchenko Thank you for your response. I appreciate the suggestion of overriding Globals in the specific function. However, in my case, I have a mix of functions written in Python and a Lambda function defined with PackageType: Image that uses Docker.

The issue I am facing is that I have a common utility function defined in a Layer called "CommonLayer", which I want to use in all my functions, including the Lambda function with PackageType: Image. However, when I try to use the Layer property in the function with PackageType: Image, I encounter an error.

It appears that the current implementation does not allow the Lambda function with PackageType: Image to use the Layer property, which is why having the option to selectively ignore Globals for specific functions, including those with PackageType: Image, would be helpful for users who face similar challenges.

I hope this clarifies the problem I am facing and why the proposed solution of selectively ignoring Globals for specific functions would be useful.

[placeposition]

I also have a SAM template where 90% of the functions need to invoke inside a VPC - so I use the Globals to set VpcConfig.

Globals:

  Api:
    OpenApiVersion: 3.0.1
    Cors: 
      AllowMethods: "'*'"
      AllowHeaders: "'*'"
      AllowOrigin: "'*'"

  Function:
    Timeout: 10
    Tracing: Active
    Runtime: nodejs16.x
    MemorySize: 128
    CodeUri: ./lambdas
    Environment:
      Variables:
        RDS_HOSTNAME_WRITE: !Sub '{{resolve:secretsmanager:xxx-${Environment}-database:SecretString:RDS_HOSTNAME_WRITE}}'
        RDS_USERNAME_WRITE: !Sub '{{resolve:secretsmanager:xxx-${Environment}-database:SecretString:RDS_USERNAME_WRITE}}'
        RDS_PASSWORD_WRITE: !Sub '{{resolve:secretsmanager:xxx-${Environment}-database:SecretString:RDS_PASSWORD_WRITE}}'
        RDS_DBNAME: !Sub '{{resolve:secretsmanager:xxx-${Environment}-database:SecretString:RDS_DBNAME}}'
        DYNAMO_TABLE_NAME: !Sub 'xxx-dynamodb-${Environment}'
    Layers:
      - !Sub 'arn:aws:lambda:eu-west-1:52881xxxx:layer:xxx-Layer-V4-${Environment}:${LayerVersion}'
    Architectures:
      - x86_64
    VpcConfig:
        SubnetIds:
          - subnet-0adc18xxx 
          - subnet-01343bxxx
          - subnet-0e4947xxx
        SecurityGroupIds:
          - sg-079e57xxx

I would like a way to override the Global for VpcConfig in a function so it can invoke anywhere and not have the disadvantage of a slower cold start. Since the settings are additive I cant just set an empty array on the function like this:

RoomLogFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub '${StackPrefix}-S3-LOG-${Environment}'
      Handler: roomLog/index.handler
      Role: arn:aws:iam::52881xxx:role/lambda-vpc-role
      Environment:
        Variables:
          ROOM_LOG_BUCKET: !Sub '${StackPrefix}-pub-sub-${Environment}'
      Events:
        SNSEvent:
          Type: SNS
          Properties:
            Topic: !Ref SnsRoomPubSub
      VpcConfig:
        SubnetIds: []
        SecurityGroupIds: []

I know I could set the VpcConfig on each function that needs it, but it will be hundreds of functions throughout my project.

[GavinZZ]

Hi after team discussion, we will support introducing a new resource attribute called IgnoreGlobals. (Documentation changes to be made).

IgnoreGlobals will accept a string input value of "*" or a list of string input values.

1. When IgnoreGlobals: "*" is used as resource attribute of a specific resource, it means to ignore all Globals for this specific resource
2. When a list of valid string input is used, it will ignore the matching properties in Globals.

Consider the example where I have a mix of PackageType: Image function and a PackageType: Zip function.

Globals:
  Function:
    Runtime: python3.8
    Handler: index.lambda_handler
    MemorySize: 128

Resources:
  ZipFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: s3://bucket/key

  ImageFunction:
    Type: AWS::Serverless::Function
    IgnoreGlobals: '*'
    Properties:
      PackageType: Image
      ImageUri: s3://bucket/key
    Metadata:
      Dockerfile: Dockerfile
      DockerContext: ./src/image

  ImageFunction2:
    Type: AWS::Serverless::Function
    IgnoreGlobals:
    - Runtime
    - Handler
    Properties:
      PackageType: Image
      ImageUri: s3://bucket/key
    Metadata:
      Dockerfile: Dockerfile
      DockerContext: ./src/image

Note that this feature is already merged, see #3386. It will take about 2~3 weeks to gradually roll out to all regions.

[GavinZZ]

This resource attribute, IgnoreGlobals, is going to be available for all SAM resources (AWS::Serverless::*).

[GavinZZ]

Marking this feature request as closed. Please expect 2~3 weeks from today of deployment time to be generally available.