|
Size: 4921
Comment:
|
Size: 3813
Comment:
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 1: | Line 1: |
| <<TableOfContents(2)>> |
|
| Line 4: | Line 6: |
| Lambda Java samples: * [[ https://docs.aws.amazon.com/lambda/latest/dg/lambda-samples.html | lambda samles ]] * [[ https://github.com/awsdocs/aws-lambda-developer-guide/tree/main/sample-apps/java-basic/ |sample apps java basic ]] |
|
| Line 5: | Line 11: |
| * https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html * https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html * https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html |
* [[ https://docs.aws.amazon.com/general/latest/gr/root-vs-iam.html | root vs iam ]] * [[ https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html | aws access keys best practices ]] * [[ https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html | IAM best practices ]] |
| Line 29: | Line 35: |
| == Localstack in Debian == * https://github.com/localstack/localstack * sudo apt install python3-pip * sudo apt install python-pip * pip3 install localstack * pip install localstack * .local/bin/localstack start * docker run --rm -it -p 4566:4566 -p 4571:4571 localstack/localstack * curl http://localhost:4566/health * pip3 install awscli * pip3 install awscli-local * .local/bin/awslocal kinesis list-streams * .local/bin/awslocal s3api list-buckets * PATH=$PATH:/usr/sbin:~/.local/bin in ~/.bashrc * docker exec -it silly_greider bash * awslocal s3api list-buckets * awslocal s3api create-bucket --bucket my-bucket --region us-east-1 * https://docs.aws.amazon.com/cli/latest/reference/s3api/ * echo "test" > test.txt * awslocal s3api put-object --bucket my-bucket --key dir-1/test.txt --body test.txt * awslocal s3api get-object --bucket my-bucket --key dir-1/test.txt test2.txt * cat test2.txt |
== IPv6 info == * [[ https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-ipv6-only-subnets-and-ec2-instances/ | introducing ipv6 only subnets and ec2 instances ]] * [[ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#amazon-dns | using instance addressing amazon-dns ]] * [[ https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-instance-addressing.html#working-with-ipv6-addresses | using instance addressing #working with ipv6 addresses ]] |
| Line 52: | Line 40: |
| === Localstack - lambda and s3 === '''run.sh''' {{{#!highlight bash zip py-my-function.zip lambda_function.py awslocal lambda delete-function --function-name py-my-function awslocal lambda create-function --function-name py-my-function --zip-file fileb://py-my-function.zip --handler lambda_function.lambda_handler --runtime python3.9 --role arn:aws:iam::000000000000:role/lambda-ex awslocal lambda invoke --function-name py-my-function --payload '{ "first_name": "Bob","last_name":"Squarepants" }' response.json cat response.json |
== Lambda authorizer (API gateway) == A lambda authorizer (API gateway) requires a resource based policy statement, with principalId and policy document. * [[ https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-lambda-authorizer-output.html | API gateway lambda authorizer output ]] JSON example {{{#!highlight json { "principalId": "user|12345", "policyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": "execute-api:Invoke", "Effect": "Allow", "Resource": "arn:aws:execute-api:region:account-id:api-id/stage/METHOD/path" } ] }, "context": { "stringKey": "value", "numberKey": 123, "booleanKey": true } } |
| Line 62: | Line 65: |
| '''lambda_function.py''' {{{#!highlight python import boto3 import os |
== Add inbound rule in RDS to a lambda function == {{{#!highlight shell RDS_DB_PORT=5432 RDS_SG=$(aws rds describe-db-instances --db-instance-identifier rds-instance-id \ --query "DBInstances[0].VpcSecurityGroups[*].VpcSecurityGroupId" --output text) echo "RDS security group $RDS_SG" |
| Line 67: | Line 72: |
| def lambda_handler(event, context): message = 'Hello {} {}!'.format(event['first_name'], event['last_name']) session = boto3.session.Session() |
LAMBDA_SG=$(aws lambda get-function-configuration --function-name lambda-function-name \ --query "VpcConfig.SecurityGroupIds[*]" --output text) echo "Lambda function security group $LAMBDA_SG" |
| Line 71: | Line 76: |
| s3_client = session.client( service_name='s3', aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"], aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"], endpoint_url='http://localhost:4566', ) buckets=[] for bucket in s3_client.list_buckets()['Buckets']: buckets.append(bucket['Name']) response = s3_client.create_bucket(Bucket='examplebucket') body = { 'message' : message, 'buckets' : buckets, 'AWS_ACCESS_KEY_ID' : os.environ["AWS_ACCESS_KEY_ID"], 'AWS_SECRET_ACCESS_KEY' : os.environ["AWS_SECRET_ACCESS_KEY"] } s3_client.put_object(Body=str(body), Bucket='examplebucket', Key='examplebucket/response.txt') return body |
aws ec2 authorize-security-group-ingress --group-id $RDS_SG \ --protocol tcp -port $RDS_DB_PORT --source-group $LAMBDA_SG |
| Line 95: | Line 80: |
| == Access localstack from docker container == {{{#!highlight bash docker run -d --name localstack --rm -it -p 4566:4566 -p 4571:4571 localstack/localstack docker exec -it localstack bash lsb_release -a curl http://localhost:4566/health awslocal s3api list-buckets awslocal s3api create-bucket --bucket my-bucket echo "test" > test.txt awslocal s3api put-object --bucket my-bucket --key dir-1/test.txt --body test.txt awslocal s3api get-object --bucket my-bucket --key dir-1/test.txt test2.txt cat test2.txt apt install nano vim yajl-tools -y https://hub.docker.com/r/localstack/localstack https://github.com/localstack/localstack node -v # v14.18.1 python -V # Python 3.8.12 pip3 freeze curl http://localhost:4566/health | json_reformat awslocal ec2 run-instances --image-id prod-df2jln3gjtwps --count 1 --instance-type t2.micro awslocal ec2 describe-instances --filters "Name=instance-type,Values=t2.micro" --query "Reservations[].Instances[].InstanceId" awslocal ec2 describe-instances |
== Stuff == {{{ aws lambda list-functions aws ecs describe-task-definition -- task-definition # a task definition sets a docker image for a task/container |
Contents
AWS
Amazon Web Services
Lambda Java samples:
User credentials
Instead of sharing the credentials of the AWS account root user, create individual IAM users, granting each user only the permissions they require.
Follow the best practice of using the root user only to create your first IAM user.
There are two types of credentials:
- Root user credentials, allow full access to all resources in the AWS account.
- IAM credentials, control access to AWS services and resources for users in your AWS account
Serverless blog web application architecture
https://s3.amazonaws.com/aws-lambda-serverless-web-refarch/RefArch_BlogApp_Serverless.png
- Amazon Route 53 (routes to specific places based on region)
Amazon CloudFront (deliver static content per region hosted inside S3)
- Amazon Simple Storage Service (S3)
- Amazon Cognito (Authentication and authorization)
- Amazon API Gateway (routes requests to backend logic)
- AWS Lambda (backend business logic)
- AWS DynamoDB (managed DB)
- AWS Identity and Access Management (IAM) - web service to control access to AWS resources
IPv6 info
Lambda authorizer (API gateway)
A lambda authorizer (API gateway) requires a resource based policy statement, with principalId and policy document.
JSON example
1 {
2 "principalId": "user|12345",
3 "policyDocument": {
4 "Version": "2012-10-17",
5 "Statement": [
6 {
7 "Action": "execute-api:Invoke",
8 "Effect": "Allow",
9 "Resource": "arn:aws:execute-api:region:account-id:api-id/stage/METHOD/path"
10 }
11 ]
12 },
13 "context": {
14 "stringKey": "value",
15 "numberKey": 123,
16 "booleanKey": true
17 }
18 }
Add inbound rule in RDS to a lambda function
1 RDS_DB_PORT=5432
2 RDS_SG=$(aws rds describe-db-instances --db-instance-identifier rds-instance-id \
3 --query "DBInstances[0].VpcSecurityGroups[*].VpcSecurityGroupId" --output text)
4 echo "RDS security group $RDS_SG"
5
6 LAMBDA_SG=$(aws lambda get-function-configuration --function-name lambda-function-name \
7 --query "VpcConfig.SecurityGroupIds[*]" --output text)
8 echo "Lambda function security group $LAMBDA_SG"
9
10 aws ec2 authorize-security-group-ingress --group-id $RDS_SG \
11 --protocol tcp -port $RDS_DB_PORT --source-group $LAMBDA_SG
Stuff
aws lambda list-functions aws ecs describe-task-definition -- task-definition # a task definition sets a docker image for a task/container