# Amazon CloudFormation resources generated when AWS::Serverless::WebFunction is specified
<a name="sam-specification-generated-resources-webfunction"></a>

When you specify an `AWS::Serverless::WebFunction`, Amazon Serverless Application Model (Amazon SAM) generates the following base Amazon CloudFormation resources.

**`AWS::Lambda::WebFunction`**  
*`LogicalId`: *`{{<webfunction‑LogicalId>}}`  
*Referenceable property: *N/A (you must use the `LogicalId` to reference this Amazon CloudFormation resource)

**`AWS::Lambda::WebFunctionRevision`**  
*`LogicalId`: *`{{<webfunction‑LogicalId>}}Revision`  
*Referenceable property: *N/A (you must use the `LogicalId` to reference this Amazon CloudFormation resource)  
*Resource attributes: *`UpdateReplacePolicy: Retain`  
Every property of a revision is create-only, so a change to the function's code or configuration replaces the revision. Amazon SAM sets `UpdateReplacePolicy: Retain` so that Amazon CloudFormation keeps the replaced revision instead of deleting it. An endpoint can still route traffic to it through `RevisionWeights`, and Lambda doesn't delete a revision that an endpoint uses. The replaced revision is no longer part of the stack. Deleting the function deletes all of its revisions.  
The revision created by an update that fails and rolls back is also kept.  
To override this, set `UpdateReplacePolicy` on the `AWS::Serverless::WebFunction`. Amazon SAM then applies your value to every resource that it generates, including the Web Function endpoint.

**`AWS::Lambda::WebFunctionEndpoint`**  
*`LogicalId`: *`{{<webfunction‑LogicalId>}}Endpoint`  
*Referenceable property: *N/A (you must use the `LogicalId` to reference this Amazon CloudFormation resource)

All three resources use the same function name. If you don't specify the `FunctionName` property, Amazon SAM generates a name of the form `{{<webfunction‑LogicalId>}}-{{<stack-id-prefix>}}`, where {{stack-id-prefix}} is the first 8 characters of the stack ID's unique identifier. Amazon SAM shortens the logical ID if needed so that the name is at most 64 characters.

In addition to these Amazon CloudFormation resources, when `AWS::Serverless::WebFunction` is specified, Amazon SAM also generates Amazon CloudFormation resources for the following scenarios:

**Topics**
+ [ExecutionRoleArn property is not specified](#sam-specification-generated-resources-webfunction-iam-role)

## ExecutionRoleArn property is not specified
<a name="sam-specification-generated-resources-webfunction-iam-role"></a>

When you don't specify the `ExecutionRoleArn` property of an `AWS::Serverless::WebFunction`, Amazon SAM generates an `AWS::IAM::Role` Amazon CloudFormation resource with the `AWSLambdaBasicExecutionRole` Amazon managed policy attached.

The role trust policy allows the `lambda.amazonaws.com` service principal to assume the role.

**`AWS::IAM::Role`**  
*`LogicalId`: *`{{<webfunction‑LogicalId>}}Role`