feat: update SAM template automatically and add execution role with required lambda permissions to template

Author: bchampp

.github/workflows/update-sam-template.yml

@@ -0,0 +1,50 @@
+name: Update SAM Template
+
+on:
+  pull_request:
+    paths:
+      - "examples/**"
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ github.head_ref }}-${{ github.run_id}}-sam-template
+  cancel-in-progress: true
+
+jobs:
+  update-template:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          ref: ${{ github.head_ref }}
+
+      - name: Set up Python 3.13
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install Hatch
+        run: pip install hatch
+
+      - name: Setup SSH Agent
+        uses: webfactory/ssh-agent@v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.SDK_KEY }}
+    
+      - name: Generate SAM template
+        run: hatch run examples:generate-sam-template
+
+      - name: Commit and push changes
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+          git add .
+          if git diff --staged --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "chore: update SAM template" --no-verify
+            git push
+          fi

examples/cli.py

@@ -238,7 +238,44 @@ def generate_sam_template(*, skip_durable_config=False):
                 "Default": "https://lambda.us-west-2.amazonaws.com",
             }
         },
-        "Resources": {},
+        "Resources": {
+            "DurableFunctionRole": {
+                "Type": "AWS::IAM::Role",
+                "Properties": {
+                    "AssumeRolePolicyDocument": {
+                        "Version": "2012-10-17",
+                        "Statement": [
+                            {
+                                "Effect": "Allow",
+                                "Principal": {"Service": "lambda.amazonaws.com"},
+                                "Action": "sts:AssumeRole",
+                            }
+                        ],
+                    },
+                    "ManagedPolicyArns": [
+                        "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+                    ],
+                    "Policies": [
+                        {
+                            "PolicyName": "DurableExecutionPolicy",
+                            "PolicyDocument": {
+                                "Version": "2012-10-17",
+                                "Statement": [
+                                    {
+                                        "Effect": "Allow",
+                                        "Action": [
+                                            "lambda:CheckpointDurableExecution",
+                                            "lambda:GetDurableExecutionState",
+                                        ],
+                                        "Resource": "*",
+                                    }
+                                ],
+                            },
+                        }
+                    ],
+                },
+            }
+        },
     }
 
     for example in catalog["examples"]:
@@ -251,6 +288,7 @@ def generate_sam_template(*, skip_durable_config=False):
                 "CodeUri": "build/",
                 "Handler": example["handler"],
                 "Description": example["description"],
+                "Role": {"Fn::GetAtt": ["DurableFunctionRole", "Arn"]},
             },
         }
 

pyproject.toml

@@ -74,7 +74,7 @@ dependencies = [
 [tool.hatch.envs.examples.scripts]
 cli = "python examples/cli.py {args}"
 bootstrap = "python examples/cli.py bootstrap"
-generate-sam = "python examples/cli.py sam {args}"
+generate-sam-template = "python examples/cli.py sam {args}"
 build = "python examples/cli.py build"
 deploy = "python examples/cli.py deploy {args}"
 invoke = "python examples/cli.py invoke {args}"