Serverless-application-model: Setting KMS key for Lambda function

[restfulhead]

CloudFormation lets you specify a KMS key via the KmsKeyArn attribute. However, this does not seem to be supported by SAM.

Template snippet

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.handler
      Runtime: nodejs6.10
      CodeUri: ./src
      KmsKeyArn: !Sub "${MyKmsKey}"

Error when calling aws cloudformation deploy:

Invalid Serverless Application Specification document. Number of errors found: 1. Resource with id [MyFunction] is invalid. property KmsKeyArn not defined for resource of type AWS::Serverless::Function

Is there another way of setting this or is this feature missing at the moment?

[jolexa]

This might be a duplicate of #48

[restfulhead]

Right, although #48 is requesting more than this. This issue is just about supporting the CloudFormation attribute KmsKeyArn, no additional changes like CLI support for encryption.

[sanathkr]

SAM now supports KmsKeyArn. I will update the documentation tomorrow.

[wes3985]

Hi, I'm looking to get a bit more clarity about how to declare KMS keys in the yaml using SAM. The following structure works when deployed but we've' been advised this is very poor from a security perspective::

Resources:
    MyFunction:
        Type: AWS::Serverless::Function
        Properties:
            KmsKeyArn: !Sub arn:aws:kms:region:number:key/id
            Policies:
                - Statement:
                    Effect: Allow
                    Action:
                        - "kms:*"
                        - "s3:*"
                    Resource:
                        - "*"

However if I try to add a specific key to the 'Resource' section such as:

- !Sub arn:aws:kms:region:number:key/id
or
- "arn:aws:kms:region:number:key/id"

everything packages and deploys ok but I get the following error when I try to run the lambda on the console:

"errorMessage": "An error occurred (AccessDenied) when calling the PutObject operation: Access Denied"

p.s. I have declared the specific bucket that the lambda is used on in the Resource section as follows so I don't think it is a bucket issue:

- "arn:aws:s3:::mybucket/*

Apologies if I should have started a new thread? I thought this would be relevant to post here?