syntax = "proto3";

package envoy.extensions.filters.http.aws_lambda.v3;

import "envoy/type/matcher/v3/string.proto";

import "udpa/annotations/status.proto";
import "udpa/annotations/versioning.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.filters.http.aws_lambda.v3";
option java_outer_classname = "AwsLambdaProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/aws_lambda/v3;aws_lambdav3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: AWS Lambda]
// AWS Lambda :ref:`configuration overview <config_http_filters_aws_lambda>`.
// [#extension: envoy.filters.http.aws_lambda]

// AWS Lambda filter config
// [#next-free-field: 9]
message Config {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.filter.http.aws_lambda.v2alpha.Config";

  enum InvocationMode {
    // This is the more common mode of invocation, in which Lambda responds after it has completed the function. In
    // this mode the output of the Lambda function becomes the response of the HTTP request.
    SYNCHRONOUS = 0;

    // In this mode Lambda responds immediately but continues to process the function asynchronously. This mode can be
    // used to signal events for example. In this mode, Lambda responds with an acknowledgment that it received the
    // call which is translated to an HTTP 200 OK by the filter.
    ASYNCHRONOUS = 1;
  }

  // The ARN of the AWS Lambda to invoke when the filter is engaged
  // Must be in the following format:
  // arn:<partition>:lambda:<region>:<account-number>:function:<function-name>
  string arn = 1 [(validate.rules).string = {min_len: 1}];

  // Whether to transform the request (headers and body) to a JSON payload or pass it as is.
  bool payload_passthrough = 2;

  // Determines the way to invoke the Lambda function.
  InvocationMode invocation_mode = 3 [(validate.rules).enum = {defined_only: true}];

  // Indicates that before signing headers, the host header will be swapped with
  // this value. If not set or empty, the original host header value
  // will be used and no rewrite will happen.
  //
  // .. note::
  //     This rewrite affects both signing and host header forwarding. However, this
  //     option shouldn't be used with
  //     :ref:`HCM host rewrite <envoy_v3_api_field_config.route.v3.RouteAction.host_rewrite_literal>` given that the
  //     value set here would be used for signing whereas the value set in the HCM would be used
  //     for host header forwarding which is not the desired outcome.
  //
  //     Changing the value of the host header can result in a different route to be selected
  //     if an HTTP filter after AWS lambda re-evaluates the route (clears route cache).
  string host_rewrite = 4;

  // Specifies the credentials profile to be used from the AWS credentials file.
  // This parameter is optional. If set, it will override the value set in the AWS_PROFILE env variable and
  // the provider chain is limited to the AWS credentials file Provider.
  // If credentials configuration is provided, this configuration will be ignored.
  // If this field is provided, then the default providers chain specified in the documentation will be ignored.
  // (See :ref:`default credentials providers <config_http_filters_aws_lambda_credentials>`).
  string credentials_profile = 5;

  // Specifies the credentials to be used. This parameter is optional and if it is set,
  // it will override other providers and will take precedence over credentials_profile.
  // The provider chain is limited to the configuration credentials provider.
  // If this field is provided, then the default providers chain specified in the documentation will be ignored.
  // (See :ref:`default credentials providers <config_http_filters_aws_lambda_credentials>`).
  //
  // .. warning::
  //   Distributing the AWS credentials via this configuration should not be done in production.
  Credentials credentials = 6;

  // A list of request header string matchers that will be excluded from signing. The excluded header can be matched by
  // any patterns defined in the StringMatcher proto (e.g. exact string, prefix, regex, etc).
  // Headers such as ``x-amzn-cipher-suite``, ``x-amzn-tls-version``, ``x-amzn-vpc-id``, ``x-amzn-vpce-config`` and ``x-amzn-vpce-id``,
  // when included in the request and signed, can cause errors to be generated by the Lambda endpoint.
  //
  // Example:
  //
  // .. code-block:: yaml
  //
  //  match_excluded_headers:
  //  - prefix: x-amzn
  //  - exact: foo
  //  - exact: bar
  //
  // When applied, all headers that start with ``x-amzn`` and headers ``foo`` and ``bar`` will not be signed.
  repeated type.matcher.v3.StringMatcher match_excluded_headers = 7;

  // A list of request header string matchers that will be included during signing. The included header can be matched by
  // any patterns defined in the StringMatcher proto (e.g. exact string, prefix, regex, etc).
  // match_included_headers takes precedence over match_excluded_headers - if match_included_headers is set, only those headers will be signed and match_excluded_headers will be ignored.
  // Required headers for signing such as ``host`` will always be signed regardless of this setting. The required headers are determined via ``CanonicalHeaders`` section in the AWS documentation `here <https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html#create-canonical-request>`_.
  //
  // Example:
  //
  // .. code-block:: yaml
  //
  //  match_included_headers:
  //  - prefix: x-amzn
  //  - exact: foo
  //  - exact: bar
  //
  // When applied, all headers that start with ``x-amzn`` and headers ``foo`` and ``bar`` will be signed and all other headers will be excluded from signing except required headers.
  repeated type.matcher.v3.StringMatcher match_included_headers = 8;
}

// AWS Lambda Credentials config.
message Credentials {
  // AWS access key id.
  string access_key_id = 1 [(validate.rules).string = {min_len: 1}];

  // AWS secret access key.
  string secret_access_key = 2 [(validate.rules).string = {min_len: 1}];

  // AWS session token.
  // This parameter is optional. If it is set to empty string it will not be consider in the request.
  // It is required if temporary security credentials retrieved directly from AWS STS operations are used.
  string session_token = 3;
}

// Per-route configuration for AWS Lambda. This can be useful when invoking a different Lambda function or a different
// version of the same Lambda depending on the route.
message PerRouteConfig {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.filter.http.aws_lambda.v2alpha.PerRouteConfig";

  Config invoke_config = 1;
}
