aws_lambda_nodejs: default bundling option never bundle AWS SDK

[cm-iwata]

Describe the issue

If deploy a NodejsFunction with code like the one below, the AWS SDK specified in package.json will not be bundled in the assets.

new nodejs.NodejsFunction(this, 'my-handler', {
 bundling: {
     network: 'host',
     securityOpt: 'no-new-privileges',
     user: 'user:group',
     volumesFrom: ['777f7dc92da7'],
     volumes: [{ hostPath: '/host-path', containerPath: '/container-path' }],
  },
});

As a result, our application will use the AWS SDK built into the Lambda execution environment by default.

The Lambda documentation states the following and recommends including the AWS SDK in your deployment package.

Control the dependencies in your function's deployment package. The AWS Lambda execution environment contains a number of libraries. For the Node.js and Python runtimes, these include the AWS SDKs. To enable the latest set of features and security updates, Lambda will periodically update these libraries. These updates may introduce subtle changes to the behavior of your Lambda function. To have full control of the dependencies your function uses, package all of your dependencies with your deployment package.

https://docs.aws.amazon.com/lambda/latest/dg/nodejs-handler.html#nodejs-best-practices

The default bundling options may break AWS SDK compatibility, so I think the CDK documentation should also clearly warn about this.

Links

https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_lambda_nodejs.BundlingOptions.html

[nmussy]

This is very fair, the intended meaning of "package all of your dependencies" is not to just list them in your package.json, but to use a bundler like esbuild or webpack yourself instead of having the CDK create the bundle. "Bundling your dependencies" might be clearer and avoid the confusion between packaging and package.json.