Lambda

14 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

LambdaAlias # GA

LambdaAlias is the Schema for managing Lambda function aliases.

kubectl get lambdaaliases · example on GitHub

Example

# LambdaAlias — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdaalias
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaAlias
metadata:
  name: example-lambdaalias
  namespace: default
spec:
  description: Managed by konfig-konector
  functionName: example-lambdaalias
  functionVersion: '1.0'
  name: example-lambdaalias
  providerRef:
    name: example-lambdaalias
    region: us-east-1
  routingConfig:
    additionalVersionWeights: {}

Spec

Field	Type	Required	Description
`description`	string	—	Description is an optional description.
`functionName`	string	yes	FunctionName is the name or ARN of the Lambda function.
`functionVersion`	string	yes	FunctionVersion is the function version the alias points to.
`name`	string	yes	Name is the alias name.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`routingConfig`	object	—	RoutingConfig enables weighted traffic routing between function versions.
`routingConfig.additionalVersionWeights`	map<string>	—	AdditionalVersionWeights is a map of function version to weight (0.0-1.0).

Status

Field	Type	Required	Description
`aliasArn`	string	—	AliasARN is the ARN of the alias.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

LambdaCapacityProvider # CLOUD CONTROL · AWS::Lambda::CapacityProvider

LambdaCapacityProvider manages AWS::Lambda::CapacityProvider through the AWS Cloud Control API.

kubectl get lambdacapacityproviders · example on GitHub

Example

# LambdaCapacityProvider — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdacapacityprovider
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaCapacityProvider
metadata:
  name: example-lambdacapacityprovider
  namespace: default
spec:
  capacityProviderName: example-lambdacapacityprovider
  capacityProviderScalingConfig:
    maxVCpuCount: 2
    scalingMode: Auto
    scalingPolicies:
    - predefinedMetricType: LambdaCapacityProviderAverageCPUUtilization
      targetValue: 1
  instanceRequirements:
    allowedInstanceTypes:
    - example
    architectures:
    - example
    excludedInstanceTypes:
    - example
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  permissionsConfig:
    capacityProviderOperatorRoleArn: arn:aws:iam::123456789012:role/example-role
  propagateTags:
    explicitTags:
    - key: example
      value: example
    mode: None
  providerRef:
    name: example-lambdacapacityprovider
    region: us-east-1
  tags:
  - key: example
    value: example
  telemetryConfig:
    loggingConfig:
      logGroup: example
      systemLogLevel: DEBUG
  vpcConfig:
    securityGroupIds:
    - example
    subnetIds:
    - example

Spec

Field	Type	Required	Description
`capacityProviderName`	string	—	Create-only in AWS: changing it requires replacing the resource.
`capacityProviderScalingConfig`	object	—	The scaling configuration for the capacity provider.
`capacityProviderScalingConfig.maxVCpuCount`	integer	—	The maximum number of vCPUs that the capacity provider can provision across all compute instances.
`capacityProviderScalingConfig.scalingMode`	enum	—	The scaling mode that determines how the capacity provider responds to changes in demand. Allowed: `Auto, Manual`
`capacityProviderScalingConfig.scalingPolicies`	array<object>	—	A list of target tracking scaling policies for the capacity provider.
`capacityProviderScalingConfig.scalingPolicies[].predefinedMetricType`	enum	yes	The predefined metric type to track for scaling decisions. Allowed: `LambdaCapacityProviderAverageCPUUtilization, LambdaCapacityProviderAverageGPUUtilization`
`capacityProviderScalingConfig.scalingPolicies[].targetValue`	number	yes	The target value for the metric that the scaling policy attempts to maintain through scaling actions.
`instanceRequirements`	object	—	The instance requirements for compute resources managed by the capacity provider.
`instanceRequirements.allowedInstanceTypes`	array<string>	—	A list of EC2 instance types that the capacity provider is allowed to use.
`instanceRequirements.architectures`	array<string>	—	A list of supported CPU architectures for compute instances.
`instanceRequirements.excludedInstanceTypes`	array<string>	—	A list of EC2 instance types that the capacity provider should not use, even if they meet other requirements.
`kmsKeyArn`	string	—	The ARN of the KMS key used to encrypt the capacity provider's resources.
`permissionsConfig`	object	yes	The permissions configuration for the capacity provider.
`permissionsConfig.capacityProviderOperatorRoleArn`	string	yes	The ARN of the IAM role that the capacity provider uses to manage compute instances and other AWS resources.
`propagateTags`	object	—	Configuration for tag propagation to managed resources launched by the capacity provider.
`propagateTags.explicitTags`	array<object>	—	A list of tags to explicitly propagate to managed resources.
`propagateTags.explicitTags[].key`	string	yes
`propagateTags.explicitTags[].value`	string	yes
`propagateTags.mode`	enum	—	The mode for tag propagation. Allowed: `None, Explicit`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A key-value pair that provides metadata for the capacity provider.
`tags[].key`	string	yes
`tags[].value`	string	yes
`telemetryConfig`	object	—	The telemetry configuration for the capacity provider, including logging settings.
`telemetryConfig.loggingConfig`	object	—	The capacity provider's Amazon CloudWatch Logs configuration settings.
`telemetryConfig.loggingConfig.logGroup`	string	—	The name of the Amazon CloudWatch log group the capacity provider sends logs to.
`telemetryConfig.loggingConfig.systemLogLevel`	enum	—	Set this property to filter the system logs for your capacity provider that Lambda sends to CloudWatch. Allowed: `DEBUG, INFO, WARN`
`vpcConfig`	object	yes	The VPC configuration for the capacity provider.
`vpcConfig.securityGroupIds`	array<string>	yes	A list of security group IDs that control network access for compute instances managed by the capacity provider.
`vpcConfig.subnetIds`	array<string>	yes	A list of subnet IDs where the capacity provider launches compute instances.

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	enum	—	Read-only: reported by AWS after creation. Allowed: `Pending, Active, Failed, Deleting`

LambdaCodeSigningConfig # GA

LambdaCodeSigningConfig is the Schema for managing Lambda code signing configurations.

kubectl get lambdacodesigningconfigs · example on GitHub

Example

# LambdaCodeSigningConfig — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdacodesigningconfig
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaCodeSigningConfig
metadata:
  name: example-lambdacodesigningconfig
  namespace: default
spec:
  allowedPublisherArns:
  - example
  description: Managed by konfig-konector
  providerRef:
    name: example-lambdacodesigningconfig
    region: us-east-1
  untrustedArtifactOnDeployment: Warn

Spec

Field	Type	Required	Description
`allowedPublisherArns`	array<string>	yes	AllowedPublisherARNs are the signing profile version ARNs.
`description`	string	—	Description is an optional description.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`untrustedArtifactOnDeployment`	enum	—	UntrustedArtifactOnDeployment controls behavior when deployment validation fails. Allowed: `Warn, Enforce`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`codeSigningConfigArn`	string	—	CodeSigningConfigARN is the ARN of the code signing config.
`codeSigningConfigId`	string	—	CodeSigningConfigID is the ID of the code signing config.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

LambdaEventInvokeConfig # GA

LambdaEventInvokeConfig is the Schema for managing Lambda event invoke configs.

kubectl get lambdaeventinvokeconfigs · example on GitHub

Example

# LambdaEventInvokeConfig — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdaeventinvokeconfig
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaEventInvokeConfig
metadata:
  name: example-lambdaeventinvokeconfig
  namespace: default
spec:
  functionName: example-lambdaeventinvokeconfig
  functionRef:
    functionName: example-lambdaeventinvokeconfig
    name: example-lambdaeventinvokeconfig
  maximumEventAgeInSeconds: 60
  maximumRetryAttempts: 1
  onFailureDestinationArn: arn:aws:iam::123456789012:role/example-role
  onSuccessDestinationArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-lambdaeventinvokeconfig
    region: us-east-1
  qualifier: example

Spec

Field	Type	Required	Description
`functionName`	string	—	FunctionName is a direct Lambda function name or ARN.
`functionRef`	object	—	FunctionRef references a LambdaFunction CR.
`functionRef.functionName`	string	—	FunctionName is a direct AWS Lambda function name or ARN.
`functionRef.name`	string	—	Name of a LambdaFunction CR in the same namespace.
`maximumEventAgeInSeconds`	integer	—	MaximumEventAgeInSeconds is the maximum age of an async event (60-21600).
`maximumRetryAttempts`	integer	—	MaximumRetryAttempts for async invocation (0-2).
`onFailureDestinationArn`	string	—	OnFailureDestinationARN receives records of failed async invocations.
`onSuccessDestinationArn`	string	—	OnSuccessDestinationARN receives records of successful async invocations (SQS, SNS, Lambda, or EventBridge ARN).
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`qualifier`	string	—	Qualifier is a version number or alias name.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`functionArn`	string	—	FunctionARN is the ARN of the function (with qualifier) the config applies to.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

LambdaEventSourceMapping # GA

LambdaEventSourceMapping is the Schema for managing Lambda Event Source Mappings.

kubectl get lambdaeventsourcemappings · example on GitHub

Example

# LambdaEventSourceMapping — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdaeventsourcemapping
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaEventSourceMapping
metadata:
  name: example-lambdaeventsourcemapping
  namespace: default
spec:
  batchSize: 2
  enabled: true
  eventSourceArn: arn:aws:iam::123456789012:role/example-role
  filterCriteria:
    filters:
    - example
  functionArn: arn:aws:iam::123456789012:role/example-role
  functionRef:
    functionName: example-lambdaeventsourcemapping
    name: example-lambdaeventsourcemapping
  maximumBatchingWindowInSeconds: 300
  providerRef:
    name: example-lambdaeventsourcemapping
    region: us-east-1
  startingPosition: TRIM_HORIZON

Spec

Field	Type	Required	Description
`batchSize`	integer	—	BatchSize is the maximum number of records in each batch.
`enabled`	boolean	—	Enabled controls whether the event source mapping is active.
`eventSourceArn`	string	yes	EventSourceArn is the ARN of the event source (SQS queue, Kinesis stream, DynamoDB stream, etc.).
`filterCriteria`	object	—	FilterCriteria filters which events invoke the function.
`filterCriteria.filters`	array<string>	—	Filters are the filter patterns (JSON pattern strings).
`functionArn`	string	—	FunctionArn is a direct Lambda function ARN or name.
`functionRef`	object	—	FunctionRef references the Lambda function to invoke.
`functionRef.functionName`	string	—	FunctionName is a direct AWS Lambda function name or ARN.
`functionRef.name`	string	—	Name of a LambdaFunction CR in the same namespace.
`maximumBatchingWindowInSeconds`	integer	—	MaximumBatchingWindowInSeconds is the maximum time to gather records before invoking the function.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`startingPosition`	enum	—	StartingPosition is where to start reading from a stream. Allowed: `TRIM_HORIZON, LATEST, AT_TIMESTAMP`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the event source mapping state: Creating, Enabled, Disabled, Disabling, Enabling, Updating, Deleting.
`uuid`	string	—	UUID is the identifier of the event source mapping.

LambdaFunction # GA

LambdaFunction is the Schema for managing AWS Lambda functions.

kubectl get lambdafunctions · example on GitHub

Example

# LambdaFunction — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdafunction
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaFunction
metadata:
  name: example-lambdafunction
  namespace: default
spec:
  architecture: x86_64
  code:
    imageUri: example
    s3:
      s3Bucket: example
      s3Key: example
      s3ObjectVersion: '1.0'
  deadLetterConfig:
    targetARN: arn:aws:iam::123456789012:role/example-role
  description: Managed by konfig-konector
  environment:
    key: value
  ephemeralStorageSize: 2
  fileSystemConfigs:
  - arn: arn:aws:iam::123456789012:role/example-role
    localMountPath: example
  functionName: example-lambdafunction
  handler: example
  imageConfig:
    command:
    - example
    entryPoint:
    - example
    workingDirectory: example
  layers:
  - example
  loggingConfig:
    applicationLogLevel: TRACE
    logFormat: Text
    logGroup: example
    systemLogLevel: DEBUG
  memorySize: 128
  providerRef:
    name: example-lambdafunction
    region: us-east-1
  reservedConcurrency: 1
  roleArn: arn:aws:iam::123456789012:role/example-role
  roleRef:
    name: example-role
  runtime: '2026-01-01T00:00:00Z'
  snapStart:
    applyOn: PublishedVersions
  tags:
    environment: dev
    team: platform
  timeout: 1
  tracingConfig:
    mode: PassThrough
  vpcConfig:
    securityGroupRefs:
    - name: example-securitygrouprefs
    subnetRefs:
    - name: example-subnetrefs

Spec

Field	Type	Required	Description
`architecture`	enum	—	Architectures is the instruction set architecture. Allowed: `x86_64, arm64`
`code`	object	yes	Code defines where the function code lives.
`code.imageUri`	string	—	ImageURI is an ECR image URI for container image functions.
`code.s3`	object	—	S3 references a zip deployment package in S3.
`code.s3.s3Bucket`	string	yes	S3Bucket is the S3 bucket containing the deployment package.
`code.s3.s3Key`	string	yes	S3Key is the S3 key of the deployment package.
`code.s3.s3ObjectVersion`	string	—	S3ObjectVersion is the S3 object version of the deployment package.
`deadLetterConfig`	object	—	DeadLetterConfig configures a dead-letter queue or SNS topic for failed async invocations.
`deadLetterConfig.targetARN`	string	yes	TargetARN is the ARN of an SQS queue or SNS topic.
`description`	string	—	Description is a human-readable description of the function.
`environment`	map<string>	—	Environment variables for the function.
`ephemeralStorageSize`	integer	—	EphemeralStorageSize is the /tmp storage size in MB.
`fileSystemConfigs`	array<object>	—	FileSystemConfigs mounts EFS access points into the function.
`fileSystemConfigs[].arn`	string	yes	ARN is the ARN of the EFS access point.
`fileSystemConfigs[].localMountPath`	string	yes	LocalMountPath is the path where the file system is mounted (must start with /mnt/).
`functionName`	string	yes	FunctionName is the name of the Lambda function.
`handler`	string	—	Handler is the function entrypoint (e.g.
`imageConfig`	object	—	ImageConfig overrides the container image configuration.
`imageConfig.command`	array<string>	—	Command overrides the CMD in the Dockerfile.
`imageConfig.entryPoint`	array<string>	—	EntryPoint overrides the ENTRYPOINT in the Dockerfile.
`imageConfig.workingDirectory`	string	—	WorkingDirectory overrides the working directory.
`layers`	array<string>	—	Layers is a list of Lambda layer ARNs to attach.
`loggingConfig`	object	—	LoggingConfig configures CloudWatch Logs for the function.
`loggingConfig.applicationLogLevel`	enum	—	ApplicationLogLevel is the log level for application logs: TRACE, DEBUG, INFO, WARN, ERROR, or FATAL. Allowed: `TRACE, DEBUG, INFO, WARN, ERROR, FATAL`
`loggingConfig.logFormat`	enum	—	LogFormat is the format for function logs: Text or JSON. Allowed: `Text, JSON`
`loggingConfig.logGroup`	string	—	LogGroup is the CloudWatch log group name.
`loggingConfig.systemLogLevel`	enum	—	SystemLogLevel is the log level for system logs: DEBUG, INFO, or WARN. Allowed: `DEBUG, INFO, WARN`
`memorySize`	integer	—	MemorySize is the memory allocated to the function in MB.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`reservedConcurrency`	integer	—	ReservedConcurrency sets the reserved concurrency limit.
`roleArn`	string	—	RoleArn is the IAM execution role ARN for the function.
`roleRef`	object	—	RoleRef references an IAMRole CR in the same namespace.
`roleRef.arn`	string	—	ARN is a direct AWS IAM role ARN.
`roleRef.name`	string	—	Name of an IAMRole CR in the same namespace.
`roleRef.namespace`	string	—	Namespace of the IAMRole CR.
`runtime`	string	—	Runtime is the function runtime identifier (e.g.
`snapStart`	object	—	SnapStart configures SnapStart for supported runtimes (Java).
`snapStart.applyOn`	enum	yes	ApplyOn controls when SnapStart is applied: PublishedVersions or None. Allowed: `PublishedVersions, None`
`tags`	map<string>	—	Tags are AWS resource tags.
`timeout`	integer	—	Timeout is the maximum execution time in seconds.
`tracingConfig`	object	—	TracingConfig configures AWS X-Ray tracing.
`tracingConfig.mode`	enum	yes	Mode is the tracing mode: PassThrough or Active. Allowed: `PassThrough, Active`
`vpcConfig`	object	—	VpcConfig places the function inside a VPC.
`vpcConfig.securityGroupRefs`	array<object>	yes	SecurityGroupRefs are the security groups attached to the function.
`vpcConfig.securityGroupRefs[].id`	string	—	ID is a direct AWS Security Group ID (e.g.
`vpcConfig.securityGroupRefs[].name`	string	—	Name of a SecurityGroup CR in the same namespace.
`vpcConfig.subnetRefs`	array<object>	yes	SubnetRefs are the subnets the function runs in.
`vpcConfig.subnetRefs[].id`	string	—	ID is a direct AWS Subnet ID (e.g.
`vpcConfig.subnetRefs[].name`	string	—	Name of a Subnet CR in the same namespace.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`codeSha256`	string	—	CodeSha256 is the SHA256 of the deployed code package.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`functionArn`	string	—	FunctionARN is the ARN of the Lambda function.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the function state: Pending, Active, Inactive, Failed.

LambdaFunctionURL # GA

LambdaFunctionURL is the Schema for managing Lambda function URLs.

kubectl get lambdafunctionurls · example on GitHub

Example

# LambdaFunctionURL — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdafunctionurl
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaFunctionURL
metadata:
  name: example-lambdafunctionurl
  namespace: default
spec:
  authType: NONE
  cors:
    allowCredentials: false
    allowHeaders:
    - example
    allowMethods:
    - example
    allowOrigins:
    - example
    exposeHeaders:
    - example
    maxAge: 1
  functionName: example-lambdafunctionurl
  invokeMode: BUFFERED
  providerRef:
    name: example-lambdafunctionurl
    region: us-east-1
  qualifier: example

Spec

Field	Type	Required	Description
`authType`	enum	yes	AuthType controls authentication for the function URL. Allowed: `NONE, AWS_IAM`
`cors`	object	—	CORS defines CORS settings for the function URL.
`cors.allowCredentials`	boolean	—	AllowCredentials indicates whether to include cookies in CORS responses.
`cors.allowHeaders`	array<string>	—	AllowHeaders lists headers allowed in preflight requests.
`cors.allowMethods`	array<string>	—	AllowMethods lists HTTP methods allowed.
`cors.allowOrigins`	array<string>	—	AllowOrigins lists origins that can access the function URL.
`cors.exposeHeaders`	array<string>	—	ExposeHeaders lists headers accessible to the browser.
`cors.maxAge`	integer	—	MaxAge is the time in seconds the browser caches preflight results.
`functionName`	string	yes	FunctionName is the name or ARN of the Lambda function.
`invokeMode`	enum	—	InvokeMode controls how the function is invoked. Allowed: `BUFFERED, RESPONSE_STREAM`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`qualifier`	string	—	Qualifier is the function version or alias (optional).

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`functionUrl`	string	—	FunctionURL is the URL for the function.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

LambdaLayerVersion # GA

LambdaLayerVersion is the Schema for managing Lambda layer versions.

kubectl get lambdalayerversions · example on GitHub

Example

# LambdaLayerVersion — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdalayerversion
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaLayerVersion
metadata:
  name: example-lambdalayerversion
  namespace: default
spec:
  compatibleArchitectures:
  - example
  compatibleRuntimes:
  - '2026-01-01T00:00:00Z'
  content:
    s3Bucket: example
    s3Key: example
    s3ObjectVersion: '1.0'
  description: Managed by konfig-konector
  layerName: example-lambdalayerversion
  licenseInfo: example
  providerRef:
    name: example-lambdalayerversion
    region: us-east-1

Spec

Field	Type	Required	Description
`compatibleArchitectures`	array<string>	—	CompatibleArchitectures lists the architectures compatible with this layer.
`compatibleRuntimes`	array<string>	—	CompatibleRuntimes lists the runtimes compatible with this layer.
`content`	object	yes	Content is the layer archive source.
`content.s3Bucket`	string	—	S3Bucket is the S3 bucket containing the layer archive.
`content.s3Key`	string	—	S3Key is the S3 object key for the layer archive.
`content.s3ObjectVersion`	string	—	S3ObjectVersion is the S3 object version.
`description`	string	—	Description is an optional description.
`layerName`	string	yes	LayerName is the name of the layer.
`licenseInfo`	string	—	LicenseInfo provides license details.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`layerVersionArn`	string	—	LayerVersionARN is the ARN of the layer version.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`version`	integer	—	Version is the version number.

LambdaLayerVersionPermission # CLOUD CONTROL · AWS::Lambda::LayerVersionPermission

LambdaLayerVersionPermission manages AWS::Lambda::LayerVersionPermission through the AWS Cloud Control API.

kubectl get lambdalayerversionpermissions · example on GitHub

Example

# LambdaLayerVersionPermission — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdalayerversionpermission
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaLayerVersionPermission
metadata:
  name: example-lambdalayerversionpermission
  namespace: default
spec:
  action: example
  layerVersionArn: arn:aws:iam::123456789012:role/example-role
  principal: example
  providerRef:
    name: example-lambdalayerversionpermission
    region: us-east-1

Spec

Field	Type	Required	Description
`action`	string	yes	The API action that grants access to the layer.
`layerVersionArn`	string	yes	The name or Amazon Resource Name (ARN) of the layer.
`organizationId`	string	—	With the principal set to *, grant permission to all accounts in the specified organization.
`principal`	string	yes	An account ID, or * to grant layer usage permission to all accounts in an organization, or all AWS accounts (if organizationId is not specified).
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	ID generated by service Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

LambdaMicrovmImage # CLOUD CONTROL · AWS::Lambda::MicrovmImage

LambdaMicrovmImage manages AWS::Lambda::MicrovmImage through the AWS Cloud Control API.

kubectl get lambdamicrovmimages · example on GitHub

Example

# LambdaMicrovmImage — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdamicrovmimage
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaMicrovmImage
metadata:
  name: example-lambdamicrovmimage
  namespace: default
spec:
  additionalOsCapabilities:
  - example
  baseImageArn: arn:aws:iam::123456789012:role/example-role
  baseImageVersion: '1.0'
  buildRoleArn: arn:aws:iam::123456789012:role/example-role
  codeArtifact:
    uri: example
  cpuConfigurations:
  - architecture: ARM_64
  description: Managed by konfig-konector
  egressNetworkConnectors:
  - example
  environmentVariables:
  - key: example
    value: example
  hooks:
    microvmHooks:
      resume: DISABLED
      resumeTimeoutInSeconds: 1
      run: DISABLED
      runTimeoutInSeconds: 1
      suspend: DISABLED
      suspendTimeoutInSeconds: 1
      terminate: DISABLED
      terminateTimeoutInSeconds: 1
    microvmImageHooks:
      ready: DISABLED
      readyTimeoutInSeconds: 1
      validate: DISABLED
      validateTimeoutInSeconds: 1
    port: 1
  logging:
    cloudWatch:
      logGroup: example
      logStream: example
    disabled: false
  name: example-lambdamicrovmimage
  providerRef:
    name: example-lambdamicrovmimage
    region: us-east-1
  resources:
  - minimumMemoryInMiB: 1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`additionalOsCapabilities`	array<string>	yes
`baseImageArn`	string	yes	ARN of the base MicroVM image.
`baseImageVersion`	string	yes	Specific version of the base MicroVM image to use.
`buildRoleArn`	string	yes	ARN of the IAM build role.
`codeArtifact`	object	yes	Code artifact for the active MicroVM image.
`codeArtifact.uri`	string	yes
`cpuConfigurations`	array<object>	yes
`cpuConfigurations[].architecture`	enum	yes	Allowed: `ARM_64`
`description`	string	yes	Human-readable description of the MicroVM image and its purpose.
`egressNetworkConnectors`	array<string>	yes
`environmentVariables`	array<object>	yes	Environment variables to set in the container during the snapshot build.
`environmentVariables[].key`	string	yes
`environmentVariables[].value`	string	yes
`hooks`	object	yes	LambdaMicrovmImageHooks is a nested property type of AWS::Lambda::MicrovmImage.
`hooks.microvmHooks`	object	—	LambdaMicrovmImageMicrovmHooks is a nested property type of AWS::Lambda::MicrovmImage.
`hooks.microvmHooks.resume`	enum	—	Allowed: `DISABLED, ENABLED`
`hooks.microvmHooks.resumeTimeoutInSeconds`	integer	—
`hooks.microvmHooks.run`	enum	—	Allowed: `DISABLED, ENABLED`
`hooks.microvmHooks.runTimeoutInSeconds`	integer	—
`hooks.microvmHooks.suspend`	enum	—	Allowed: `DISABLED, ENABLED`
`hooks.microvmHooks.suspendTimeoutInSeconds`	integer	—
`hooks.microvmHooks.terminate`	enum	—	Allowed: `DISABLED, ENABLED`
`hooks.microvmHooks.terminateTimeoutInSeconds`	integer	—
`hooks.microvmImageHooks`	object	—	LambdaMicrovmImageMicrovmImageHooks is a nested property type of AWS::Lambda::MicrovmImage.
`hooks.microvmImageHooks.ready`	enum	—	Allowed: `DISABLED, ENABLED`
`hooks.microvmImageHooks.readyTimeoutInSeconds`	integer	—
`hooks.microvmImageHooks.validate`	enum	—	Allowed: `DISABLED, ENABLED`
`hooks.microvmImageHooks.validateTimeoutInSeconds`	integer	—
`hooks.port`	integer	—
`logging`	object	yes	Configuration for MicroVM image logging.
`logging.cloudWatch`	object	—	LambdaMicrovmImageCloudWatchLogging is a nested property type of AWS::Lambda::MicrovmImage.
`logging.cloudWatch.logGroup`	string	—
`logging.cloudWatch.logStream`	string	—
`logging.disabled`	boolean	—
`name`	string	yes	Unique name for the MicroVM image within the account.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resources`	array<object>	yes
`resources[].minimumMemoryInMiB`	integer	yes
`tags`	array<object>	—	Key-value pairs to associate with the MicroVM image for organization and management.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Timestamp when the MicroVM image was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`imageArn`	string	—	ARN of the MicroVM image.
`lastSyncTime`	string	—
`latestActiveImageVersion`	string	—	The latest active version of the MicroVM image.
`latestFailedImageVersion`	string	—	The latest failed version of the MicroVM image.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	enum	—	Current state of the MicroVM image. Allowed: `CREATING, CREATED, CREATE_FAILED, UPDATING, UPDATED, UPDATE_FAILED, DELETING, DELETE_FAILED…`
`updatedAt`	string	—	Timestamp when the MicroVM image was updated.

LambdaNetworkConnector # CLOUD CONTROL · AWS::Lambda::NetworkConnector

LambdaNetworkConnector manages AWS::Lambda::NetworkConnector through the AWS Cloud Control API.

kubectl get lambdanetworkconnectors · example on GitHub

Example

# LambdaNetworkConnector — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdanetworkconnector
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaNetworkConnector
metadata:
  name: example-lambdanetworkconnector
  namespace: default
spec:
  configuration:
    vpcEgressConfiguration:
      associatedComputeResourceTypes:
      - example
      networkProtocol: IPv4
      securityGroupIds:
      - example
      subnetIds:
      - example
  name: example-lambdanetworkconnector
  operatorRole: example
  providerRef:
    name: example-lambdanetworkconnector
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`configuration`	object	yes	LambdaNetworkConnectorConfig is a nested property type of AWS::Lambda::NetworkConnector.
`configuration.vpcEgressConfiguration`	object	yes	LambdaNetworkConnectorVpcEgressConfiguration is a nested property type of AWS::Lambda::NetworkConnector.
`configuration.vpcEgressConfiguration.associatedComputeResourceTypes`	array<string>	yes	The types of Lambda compute resources that can use this connector.
`configuration.vpcEgressConfiguration.networkProtocol`	enum	—	The network protocol for the connector. Allowed: `IPv4, DualStack`
`configuration.vpcEgressConfiguration.securityGroupIds`	array<string>	—	The IDs of the VPC security groups to attach to the ENIs.
`configuration.vpcEgressConfiguration.subnetIds`	array<string>	yes	The IDs of the VPC subnets where Lambda provisions elastic network interfaces (ENIs).
`name`	string	—	Create-only in AWS: changing it requires replacing the resource.
`operatorRole`	string	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A list of tags to apply to the network connector.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	enum	—	Read-only: reported by AWS after creation. Allowed: `PENDING, ACTIVE, INACTIVE, FAILED, DELETING, DELETE_FAILED`

LambdaPermission # GA

LambdaPermission is the Schema for managing Lambda resource-based policy statements.

kubectl get lambdapermissions · example on GitHub

Example

# LambdaPermission — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdapermission
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaPermission
metadata:
  name: example-lambdapermission
  namespace: default
spec:
  action: example
  functionArn: arn:aws:iam::123456789012:role/example-role
  functionRef:
    functionName: example-lambdapermission
    name: example-lambdapermission
  principal: example
  providerRef:
    name: example-lambdapermission
    region: us-east-1
  sourceAccount: example
  sourceArn: arn:aws:iam::123456789012:role/example-role
  statementId: example-id

Spec

Field	Type	Required	Description
`action`	string	yes	Action is the Lambda API action that the principal can use (e.g.
`functionArn`	string	—	FunctionArn is a direct Lambda function ARN or name.
`functionRef`	object	—	FunctionRef references the Lambda function to grant permission on.
`functionRef.functionName`	string	—	FunctionName is a direct AWS Lambda function name or ARN.
`functionRef.name`	string	—	Name of a LambdaFunction CR in the same namespace.
`principal`	string	yes	Principal is the AWS service or account that is being granted permission (e.g.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`sourceAccount`	string	—	SourceAccount restricts permissions to resources owned by this account.
`sourceArn`	string	—	SourceArn restricts which resource the principal can invoke the function from.
`statementId`	string	yes	StatementId is a unique identifier for this permission statement.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`statementExists`	boolean	—	StatementExists is true when the permission statement is confirmed in AWS.

LambdaProvisionedConcurrency # GA

LambdaProvisionedConcurrency is the Schema for managing Lambda provisioned concurrency configs.

kubectl get lambdaprovisionedconcurrencies · example on GitHub

Example

# LambdaProvisionedConcurrency — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdaprovisionedconcurrency
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaProvisionedConcurrency
metadata:
  name: example-lambdaprovisionedconcurrency
  namespace: default
spec:
  functionName: example-lambdaprovisionedconcurrency
  functionRef:
    functionName: example-lambdaprovisionedconcurrency
    name: example-lambdaprovisionedconcurrency
  providerRef:
    name: example-lambdaprovisionedconcurrency
    region: us-east-1
  provisionedConcurrentExecutions: 1
  qualifier: example

Spec

Field	Type	Required	Description
`functionName`	string	—	FunctionName is a direct Lambda function name or ARN.
`functionRef`	object	—	FunctionRef references a LambdaFunction CR.
`functionRef.functionName`	string	—	FunctionName is a direct AWS Lambda function name or ARN.
`functionRef.name`	string	—	Name of a LambdaFunction CR in the same namespace.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`provisionedConcurrentExecutions`	integer	yes	ProvisionedConcurrentExecutions is the amount of provisioned concurrency.
`qualifier`	string	yes	Qualifier is the version number or alias name the config applies to.

Status

Field	Type	Required	Description
`allocatedConcurrentExecutions`	integer	—	AllocatedConcurrentExecutions is the amount currently allocated.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`functionName`	string	—	FunctionName is the resolved function name or ARN the config was applied to.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`status`	string	—	Status is the provisioned concurrency status (IN_PROGRESS, READY, FAILED).

LambdaResourcePolicy # CLOUD CONTROL · AWS::Lambda::ResourcePolicy

LambdaResourcePolicy manages AWS::Lambda::ResourcePolicy through the AWS Cloud Control API.

kubectl get lambdaresourcepolicies · example on GitHub

Example

# LambdaResourcePolicy — Lambda
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/lambda.html#lambdaresourcepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: LambdaResourcePolicy
metadata:
  name: example-lambdaresourcepolicy
  namespace: default
spec:
  providerRef:
    name: example-lambdaresourcepolicy
    region: us-east-1
  resourceArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`policyDocument`	object	yes	The policy document you want to add to your LAM resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceArn`	string	yes	The Amazon Resource Name (ARN) of the LAM resource you want to add the policy to.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.