Gate AWS Lambda role/external-id requirement behind --aws-lambda-skip-role-and-external-id

[mani-j9]

What changed?

Why

create-version and update-version-compute-config currently require --aws-lambda-assume-role-arn and --aws-lambda-assume-role-external-id whenever --aws-lambda-function-arn is set. The Temporal server governs whether these are actually mandatory via the global require_role_and_external_id setting (default true), so a role-less config is valid against servers where that setting is disabled — e.g. local dev against LocalStack. CLI's validation needs to be relaxed to allow role less config creation.

How

This PR allows the role less config by adding a new CLI parameter --aws-lambda-skip-role-and-external-id. By default the CLI keeps requiring both(role and id) fields and fails fast with an actionable client-side error that names the missing flag. Passing the flag specifically opts out of the client-side check and defers entirely to the server's policy.

Testing

With flag set as default true

mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment create-version --address 127.0.0.1:7333 --deployment-name test-deploy --build-id b-noRole \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1
Error: missing required AWS Lambda provider detail: role

mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment create-version --address 127.0.0.1:7333 --deployment-name test-deploy --build-id b-noEid \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1 \
  --aws-lambda-assume-role-arn arn:aws:iam::123456789012:role/MyServiceRole
Error: missing required AWS Lambda provider detail: role_external_id

mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment create-version --address 127.0.0.1:7333 --deployment-name test-deploy --build-id b-skipRole \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1 \
  --aws-lambda-assume-role-arn arn:aws:iam::123456789012:role/MyServiceRole \
  --aws-lambda-skip-role-and-external-id
Error: AWS Lambda provider detail "role" must not be set when --aws-lambda-skip-role-and-external-id is passed

mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment create-version --address 127.0.0.1:7333 --deployment-name test-deploy --build-id b-skipOnly \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1 \
  --aws-lambda-skip-role-and-external-id
Error: error creating worker deployment version: no Worker Deployment found with name 'test-deploy'; does your Worker Deployment have pollers?

mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment create-version --address 127.0.0.1:7333 --deployment-name test-deploy --build-id b-skipEid \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1 \
  --aws-lambda-assume-role-external-id external-id \
  --aws-lambda-skip-role-and-external-id
Error: AWS Lambda provider detail "role_external_id" must not be set when --aws-lambda-skip-role-and-external-id is passed

mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment update-version-compute-config --address 127.0.0.1:7333 --deployment-name test-deploy --build-id b-skipRole \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1 \
  --aws-lambda-assume-role-arn arn:aws:iam::123456789012:role/MyServiceRole \
  --aws-lambda-skip-role-and-external-id
Error: AWS Lambda provider detail "role" must not be set when --aws-lambda-skip-role-and-external-id is passed

mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment update-version-compute-config --address 127.0.0.1:7333 --deployment-name test-deploy --build-id b-skipOnly \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1 \
  --aws-lambda-skip-role-and-external-id
Error: error updating worker deployment version compute config: build ID 'b-skipOnly' not found in Worker Deployment 'test-deploy'
mani@manis-MacBook-Pro temporal-cli % 

for when the local server's require_role_and_external_id flag is set to false

mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment create-version --address 127.0.0.1:7333 --deployment-name skip-demo --build-id skip-test-1 \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1 \
  --aws-lambda-skip-role-and-external-id
Error: error creating worker deployment version: no Worker Deployment found with name 'skip-demo'; does your Worker Deployment have pollers?
mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment create-version --address 127.0.0.1:7333 --deployment-name skip-demo --build-id role-test-1 \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1 \
  --aws-lambda-assume-role-arn arn:aws:iam::123456789012:role/MyServiceRole \
  --aws-lambda-assume-role-external-id external-id
Error: error creating worker deployment version: no Worker Deployment found with name 'skip-demo'; does your Worker Deployment have pollers?
mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment create-version --address 127.0.0.1:7333 --deployment-name skip-demo --build-id skip-neg-1 \
  --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1 \
  --aws-lambda-assume-role-arn arn:aws:iam::123456789012:role/MyServiceRole \
  --aws-lambda-skip-role-and-external-id
Error: AWS Lambda provider detail "role" must not be set when --aws-lambda-skip-role-and-external-id is passed

mani@manis-MacBook-Pro temporal-cli % ./temporal worker deployment update-version-compute-config --address 127.0.0.1:7333 --deployment-name skip-demo --build-id poller-build --aws-lambda-function-arn arn:aws:lambda:us-east-1:123456789012:function:MyExampleFunction:1 --aws-lambda-skip-role-and-external-id

Error: error updating worker deployment version compute config: default: lambda GetFunction failed: operation error Lambda: GetFunction, get identity: get credentials: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, request canceled, context deadline exceeded
mani@manis-MacBook-Pro temporal-cli % 

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

mani seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Pull request overview

This PR removes client-side enforcement of AWS Lambda assume-role ARN and external ID when configuring Worker Deployment compute settings, relying instead on Temporal server-side policy (require_role_and_external_id) so that role-less configurations (e.g., LocalStack/dev setups) are not blocked by the CLI.

Changes:

• Relaxed CLI validation so AWS Lambda compute provider details only require the function ARN.
• Updated CLI flag documentation/help text to no longer claim role/external ID are always required when a function ARN is set.
• Updated create-version error tests to assert server-side rejection when role/external ID are omitted under default server settings.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
internal/temporalcli/commands.yaml	Updated flag descriptions to remove unconditional “required” wording for AWS Lambda role/external ID.
internal/temporalcli/commands.worker.deployment.go	Relaxed AWS Lambda provider-details validation to only require ARN.
internal/temporalcli/commands.worker.deployment_test.go	Updated error expectations to match server-side validation messages.
internal/temporalcli/commands.gen.go	Regenerated/updated Cobra flag help strings consistent with updated YAML descriptions.

Comments suppressed due to low confidence (3)

internal/temporalcli/commands.yaml:1487

• The update-version compute config command has the same documentation issue: clarify that this flag only applies when --aws-lambda-function-arn is being used, and that server-side settings may still require it.

          AWS IAM role ARN that the Temporal server will assume when invoking
          the Lambda function that spawns a new Worker in this Worker
          Deployment Version.

internal/temporalcli/commands.yaml:1493

• Likewise, clarify that the external ID is only applicable alongside the AWS Lambda function ARN (and role ARN), and may still be required depending on server configuration.

          Temporal server will enforce that the AWS IAM trust policy associated
          with the AWS IAM role specified in --aws-lambda-assume-role-arn has
          an aws:ExternalId condition that matches the supplied value.

internal/temporalcli/commands.gen.go:4039

• Same documentation concern for update-version-compute-config: the help text should clarify these flags are only applicable with --aws-lambda-function-arn, and that server-side configuration may still require them.

	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleArn, "aws-lambda-assume-role-arn", "", "AWS IAM role ARN that the Temporal server will assume when invoking the Lambda function that spawns a new Worker in this Worker Deployment Version.")
	s.Command.Flags().StringVar(&s.AwsLambdaAssumeRoleExternalId, "aws-lambda-assume-role-external-id", "", "Temporal server will enforce that the AWS IAM trust policy associated with the AWS IAM role specified in --aws-lambda-assume-role-arn has an aws:ExternalId condition that matches the supplied value.")

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[02strich]

I am sorry for the long delay on review. Instead of making the existing flags optional, I would prefer to have a new flag that indicates that the user wants to disable the security setting - and then either that or the external ID flag need to be set. That way there is no oopsie moment risk.

[ks-temporal]

Continue from a previous comment: I think this should clarify whether the two flags (or one of them) can still be passed if this flag is passed? i.e., which of these:

Both are required unless this flag is passed, in which case both must be omitted. (may need to reword)

vs.

Both are required if this flag is not provided, otherwise they are treated as optional.

[mani-j9]

done, reworded this to specfically call out that the optional bit, let me know if you had any suggestions on the latest revision.