An exercise in creating an AWS Lambda.

This repository uses Github actions to build and deploy an AWS Lambda function.
AWS S3 notifies the Lambda on any upload events, the Lambda sends an email for each event.

• AWS CLI Credentials
• Github Repository (CI/CD)

Github actions is used to build the container image for every push. The image name is determined by ${{ github.ref_name }}

Note: During the build, Github secrets is used to set the sender and reciver email addresses. replacing the secrets in github will ensure the image contains the addresses.

SENDER_EMAIL: ${{ secrets.SENDER_EMAIL }}
RECIPIENT_EMAIL: ${{ secrets.RECIPIENT_EMAIL }}

At runtime the email addresses can be changed by running:

aws lambda update-function-configuration --function-name 'octo-waddle' --environment "Variables={SENDER=${sender_email},RECIPIENT=${recipient_email}}"

• Lambda S3 Example
• Lambda functions defined as container images
• SES
• Github Actions

Follow the below steps to create the required resources.

export AWS_REGION='eu-west-1'
export LAMBDA_NAME='octo-waddle'

Additionaly the following is required:

• aws_account_id
• image_name
• image_tag
• sender_email
• recipient_email

• Create an S3 Bucket

aws s3api create-bucket --bucket "${LAMBDA_NAME}" --create-bucket-configuration '{LocationConstraint="eu-west-1"}'

• Add a policy to our S3 bucket

aws s3api put-bucket-policy --bucket "${LAMBDA_NAME}" --policy file://policies/octo-waddle-bucket-policy.json

• Create an IAM role

aws iam create-role --role-name "${LAMBDA_NAME}" --assume-role-policy-document file://policies/octo-waddle-trust-relationship.json --tags '[{"Key": "Name", "Value": "octo-waddle"}]' --description 'octo-waddle role'

• Create IAM policies for our Role and attach them

sed -i "s/AWS_REGION/${AWS_REGION}/g" ./policies/*
sed -i "s/LAMBDA_NAME/${LAMBDA_NAME}/g" ./policies/*
sed -i "s/AWS_ACCOUNT_ID/${aws_account_id}/g" ./policies/*

for file in $(find ./policies -type file ! -iname "*trust*" ! -iname "*bucket*" -exec basename {} \;); do
  policy_name="$(echo ${file}| cut -d '.' -f1)"
  aws iam create-policy --policy-name "${policy_name}" --tags "[{\"Key\": \"Name\", \"Value\": \"${policy_name}\"}]" --policy-document "file://policies/${file}" --description "${policy_name}";
  aws iam attach-role-policy --policy-arn "arn:aws:iam::${aws_account_id}:policy/${policy_name}" --role-name "${LAMBDA_NAME}";
done

• Create ECR repository

aws ecr create-repository --repository-name "${LAMBDA_NAME}" --image-scanning-configuration scanOnPush=true

• Create the Lambda function

aws lambda create-function --function-name "${LAMBDA_NAME}" --package-type 'Image' --image-config '{"Command": ["main.handler"]}' --code "{\"ImageUri\": \"${aws_account_id}.dkr.ecr.${AWS_REGION}.amazonaws.com/${image_name}:${image_tag}\"}" --environment "Variables={SENDER=${sender_email},RECIPIENT=${recipient_email}}" --role "arn:aws:iam::${aws_account_id}:role/octo-waddle" --description 'An Amazon S3 trigger that retrieves metadata for the object that has been updated.'

• Allow AWS S3 to invoke AWS Lambda

aws lambda add-permission --function-name "${LAMBDA_NAME}" --statement-id "s3_invoke_octo-waddle" --action "lambda:InvokeFunction" --principal s3.amazonaws.com --source-arn "arn:aws:s3:::octo-waddle" --source-account "${aws_account_id}"

• Add a notification configuration to the S3 bucket

aws s3api put-bucket-notification-configuration --bucket "${LAMBDA_NAME}" --notification-configuration "file://policies/octo-waddle-bucket-notification.json"

• Create an SES email identity

aws sesv2 create-email-identity --email-identity "${sender_email}" --tags "{\"Key\": \"Name\", \"Value\": \"${LAMBDA_NAME}-sender\"}"

Complete the verification step by following the instructions in the email

• Build and Tag container image

docker build --tag "${aws_account_id}.dkr.ecr.${AWS_REGION}.amazonaws.com/${image_name}:${image_tag}" .

Set image_name and image_tag environment variables

• Login to ECR

aws ecr get-login-password | docker login --username AWS --password-stdin "${aws_account_id}.dkr.ecr.${AWS_REGION}.amazonaws.com"

• Push the container image

docker push "${aws_account_id}.dkr.ecr.${AWS_REGION}.amazonaws.com/${image_name}:${image_tag}"