Create an IAM role and IoT rule for your destination

Create execution role and policy

Create an IAM role that grants your function permission to access Amazon resources. You can also define the trust policy for the role using a JSON file.

aws iam create-role --role-name lambda-ex \ 
    --assume-role-policy-document file://lambda-trust-policy.json

The following shows the contents of the JSON file.

Contents of lambda-trust-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Create and test Lambda function

Perform the following steps to create a Amazon Lambda function that base64 decodes the payload data.

1. Write the code for decoding the payload data. For example, you can use the following sample Python code. Specify a name for the script, such as base64_decode.py.

   Contents of base64_decode.py

   // -----------------------------------------------------------
   // ----- Python script to decode incoming binary payload -----
   // -----------------------------------------------------------
   import json
   import base64
   
   def lambda_handler(event, context):
   
       message = json.dumps(event)
       print (message)
   
       payload_data = base64.b64decode(event["PayloadData"])
       print(payload_data)
       print(int(payload_data,16))

2. Create a deployment package as a zip file that contains the Python file and name it as base64_decode.zip. Use the CreateFunction API or the create-function CLI command to create a Lambda function for the sample code, base64_decode.py.

3. aws lambda create-function --function-name my-function \
   --zip-file fileb://base64_decode.zip --handler index.handler \ 
   --runtime python3.9 --role arn:aws:iam::123456789012:role/lambda-ex

   You should see the following output. You'll use the Amazon Resource Name (ARN) value from the output, FunctionArn, when creating the topic rule.

   {
       "FunctionName": "my-function",
       "FunctionArn": "arn:aws:lambda:us-east-1:123456789012:function:my-function",
       "Runtime": "python3.9",
       "Role": "arn:aws:iam::123456789012:role/lambda-ex",
       "Handler": "index.handler",
       "CodeSha256": "FpFMvUhayLkOoVBpNuNiIVML/tuGv2iJQ7t0yWVTU8c=",
       "Version": "$LATEST",
       "TracingConfig": {
           "Mode": "PassThrough"
       },
       "RevisionId": "88ebe1e1-bfdf-4dc3-84de-3017268fa1ff",
       ...
   }

4. To get logs for an invocation from the command line, use the --log-type option with the invoke command. The response includes a LogResult field that contains up to 4 KB of base64-encoded logs from the invocation.

   aws lambda invoke --function-name my-function out --log-type Tail

   You should receive a response with a StatusCode of 200. For more information about creating and using Lambda functions from the Amazon CLI, see Using Lambda with the Amazon CLI.

Create a topic rule

Use the CreateTopicRule API or the create-topic-rule CLI command to create a topic rule that sends a message to this Lambda function. You can also add a second rule action that republishes to an Amazon IoT topic. Name this topic rule as Sidewalkrule.

aws iot create-topic-rule --rule-name Sidewalkrule \ 
    --topic-rule-payload file://myrule.json

You can use the myrule.json file to specify more details about the rule. For example, the following JSON file shows how to republish to an Amazon IoT topic and send a message to a Lambda function.

{
    "sql": "SELECT * ",
    "actions": [
       {
            // You obtained this functionArn when creating the Lambda function using the 
            // create-function command.
            "lambda": {
                "functionArn": "arn:aws:lambda:us-east-1:123456789012:function:my-function"
             }
        },
        {
            // This topic can be used to observe messages exchanged between the device and 
            // Amazon IoT Core for Amazon Sidewalk after the device is connected.
             "republish": {
                 "roleArn": "arn:aws:iam::123456789012:role/service-role/SidewalkRepublishRole",
                 "topic": "project/sensor/observed"
             }
        }
    ],
}