How can I add database proxy in lambda via cloudformation?

Question

I am using cloudformation to provision lambda and RDS on AWS. But I don't know how to add database proxy on lambda. Below screenshot is from lambda console:

Does cloudformation support adding this? I can't see it in lambda and db proxy template.

Answer 1

The exact configuration I use in CloudFormation template is:

MyLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - Version: '2012-10-17' 
          Statement:
            - Effect: Allow
              Action:
                - rds-db:connect
              Resource:
                - <rds_proxy_arn>/*

where <rds_proxy_arn> is the ARN of the proxy but service is rds-db instead of rds and resource type is dbuser instead of db-proxy. For example, if your proxy's ARN is arn:aws:rds:us-east-1:123456789012:db-proxy:prx-0123456789abcdef01 the whole line should be arn:aws:rds-db:us-east-1:123456789012:db-proxy:prx-0123456789abcdef01/*.

After deployed, we can see a new link is added in Database Proxies of the Console.

Answer 2

As per the CloudFormation/Lambda documentation there is no option to specify the DB Proxy for a Lambda.

I don't see an option to add an RDS proxy while creating a Lambda function in the low level HTTP API also. Not sure why.

Answer 3

As per the following Github issue, it seems this is not required to connect lambda to RDS proxy. https://github.com/aws-cloudformation/aws-cloudformation-coverage-roadmap/issues/750

You merely need to provide the new connection details to lambda (e.g. using env variables to make it work)

Answer 4

After talking with AWS support, the screenshot in AWS console to add proxy on lambad is only to grant below IAM permission to lambda. That means it is an optional.

Allow: rds-db:connect
Allow: rds-db:*