🐛 Fix resource policy limit with many scheduled events#1439
Open
🐛 Fix resource policy limit with many scheduled events#1439
Conversation
Each scheduled event added its own AddPermission statement with a specific SourceArn, causing the Lambda resource policy to exceed AWS's 20KB limit when many events were configured. Replace per-rule permissions with a single wildcard permission that covers all EventBridge rules. _clear_policy() already removes old per-rule statements on each update, so the migration is seamless.
monkut
commented
Mar 23, 2026
| SourceAccount=account_id, | ||
| ) | ||
| except self.lambda_client.exceptions.ResourceConflictException: | ||
| # Permission already exists |
Collaborator
Author
There was a problem hiding this comment.
Add logging that: 'permission already exists'
| # Add a single wildcard permission for all EventBridge rules instead of | ||
| # one per rule, to stay within the 20KB resource policy limit (#1415). | ||
| has_scheduled_events = any(e.get("expression") or e.get("expressions") for e in events) | ||
| if has_scheduled_events: |
Collaborator
Author
There was a problem hiding this comment.
if has_scheduled_events is false, is it necessary to then loop through events.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #1415
create_event_permission()with a specificSourceArn, adding a new policy statement per rulearn:aws:events:{region}:{account}:rule/*permission added once before scheduling events_clear_policy()already removes old per-rule statements on eachzappa update, so the migration from per-rule to wildcard is seamlessSourceAccountto restrict invocations to the same AWS accountTest plan