Support for lambda layers and how to adjust environment/handler?

[dschro-1993]

Discussed in https://github.com/orgs/cloud-custodian/discussions/7633

Found a closed issue:
#4334

At the moment I am struggling with the environment and the handler of my lambdas.
For datadog I have to modify a few things:

policies:
  - name: s3-set-bucket-encryption
    resource: s3
    mode:
      type: periodic
      schedule: "rate(5 minutes)"
      role: arn:aws:iam::{account_id}:role/<role-name>
      layers:
        - "arn:aws:lambda:{region}:464622532012:layer:Datadog-Python39:60"
        - "arn:aws:lambda:{region}:464622532012:layer:Datadog-Extension:27"
      environment:
        DD_LAMBDA_HANDLER: "custodian_policy.run"
        DD_SITE:           "datadoghq.eu"
        DD_API_KEY:        "<dd_api_key>"
#   handler: "datadog_lambda.handler.handler" # Todo
    actions:
      - type: set-bucket-encryption
        crypto: AES256
        enabled: True

The environment block throws the following error:

custodian.commands:ERROR Error while executing policy s3-set-bucket-encryption, continuing
Traceback (most recent call last):
  File "/Users/ds05823/Library/Python/3.8/lib/python/site-packages/c7n/commands.py", line 301, in run
    policy()
  File "/Users/ds05823/Library/Python/3.8/lib/python/site-packages/c7n/policy.py", line 1240, in __call__
    resources = mode.provision()
  File "/Users/ds05823/Library/Python/3.8/lib/python/site-packages/c7n/policy.py", line 518, in provision
    return manager.publish(
  File "/Users/ds05823/Library/Python/3.8/lib/python/site-packages/c7n/mu.py", line 387, in publish
    result, changed = self._create_or_update(
  File "/Users/ds05823/Library/Python/3.8/lib/python/site-packages/c7n/mu.py", line 484, in _create_or_update
    new_config = func.get_config()
  File "/Users/ds05823/Library/Python/3.8/lib/python/site-packages/c7n/mu.py", line 706, in get_config
    if self.environment['Variables']:
KeyError: 'Variables'
2022-08-10 13:32:43,493: custodian.commands:ERROR The following policies had errors while executing
 - s3-set-bucket-encryption

And the handler property is not supported at all...

[kapilt]

yeah.. the environment handling in the policy is a little obtuse to specify, its a nested mapping with

environment: 
  Variables:
     key: value

we should probably support both a mapping or the nested mapping, the extant nested mapping was for a pass through to the api, but its definitely on the non obvious.

[dschro-1993]

@kapilt Thx for your answer! Great stuff! Do you also have a solution for the handler? Is it defined under execution-options?

[dschro-1993]

@kapilt I guess you've hardcoded the handler to be custodian_policy.run?
https://github.com/cloud-custodian/cloud-custodian/blob/master/c7n/mu.py#L829

You never thought about having a different entrypoint when using layers and extensions?

[ajkerrigan]

Closed via #7652