Using Lambda with infrastructure as code (IaC)

Lambda functions rarely run in isolation. Instead, they often form part of a serverless application with other resources such as databases, queues, and storage. With infrastructure as code (IaC), you can automate your deployment processes to quickly and repeatably deploy and update whole serverless applications involving many separate Amazon resources. This approach speeds up your development cycle, makes configuration management easier, and ensures that your resources are deployed the same way every time.

IaC tools for Lambda

Amazon also provides a service called Amazon Infrastructure Composer to develop IaC templates using a simple graphical interface. With Infrastructure Composer, you design an application architecture by dragging, grouping, and connecting Amazon Web Services services in a visual canvas. Infrastructure Composer then creates an Amazon SAM template or an Amazon CloudFormation template from your design that you can use to deploy your application.

In the Getting started with IaC for Lambda section below, you use Infrastructure Composer to develop a template for a serverless application based on an existing Lambda function.

Getting started with IaC for Lambda

In this tutorial, you can get started using IaC with Lambda by creating an Amazon SAM template from an existing Lambda function and then building out a serverless application in Infrastructure Composer by adding other Amazon resources.

As you carry out this tutorial, you’ll learn some fundamental concepts, like how Amazon resources are specified in Amazon SAM. You’ll also learn how to use Infrastructure Composer to build a serverless application you can deploy using Amazon SAM or Amazon CloudFormation.

To complete this tutorial, you’ll carry out the following steps:

Prerequisites

In this tutorial, you use Infrastructure Composer’s local sync feature to save your template and code files to your local build machine. To use this feature, you need a browser that supports the File System Access API, which allows web applications to read, write, and save files in your local file system . We recommend using either Google Chrome or Microsoft Edge. For more information about the File System Access API, see What is the File System Access API?

Create a Lambda function

In this first step, you create a Lambda function you can use to complete the rest of the tutorial. To keep things simple, you use the Lambda console to create a basic 'Hello world' function using the Python 3.11 runtime.

View the Amazon SAM template for your function

Before you export your function configuration to Infrastructure Composer, use the Lambda console to view your function's current configuration as an Amazon SAM template. By following the steps in this section, you'll learn about the anatomy of an Amazon SAM template and how to define resources like Lambda functions to start specifying a serverless application.

Let’s take a moment to look at the YAML template for your function and understand some key concepts.

The template starts with the declaration Transform: AWS::Serverless-2016-10-31. This declaration is required because behind the scenes, Amazon SAM templates are deployed through Amazon CloudFormation. Using the Transform statement identifies the template as an Amazon SAM template file.

Following the Transform declaration comes the Resources section. This is where the Amazon resources you want to deploy with your Amazon SAM template are defined. Amazon SAM templates can contain a combination of Amazon SAM resources and Amazon CloudFormation resources. This is because during deployment, Amazon SAM templates expand to Amazon CloudFormation templates, so any valid Amazon CloudFormation syntax can be added to an Amazon SAM template.

At the moment, there is just one resource defined in the Resources section of the template, your Lambda function LambdaIaCDemo. To add a Lambda function to an Amazon SAM template, you use the AWS::Serverless::Function resource type. The Properties of a Lambda function resource define the function’s runtime, function handler, and other configuration options. The path to your function’s source code that Amazon SAM should use to deploy the function is also defined here. To learn more about Lambda function resources in Amazon SAM, see AWS::Serverless::Function in the Amazon SAM Developer Guide.

As well as the function properties and configurations, the template also specifies an Amazon Identity and Access Management (IAM) policy for your function. This policy gives your function permission to write logs to Amazon CloudWatch Logs. When you create a function in the Lambda console, Lambda automatically attaches this policy to your function. To learn more about specifying an IAM policy for a function in an Amazon SAM template, see the policies property on the AWS::Serverless::Function page of the Amazon SAM Developer Guide.

To learn more about the structure of Amazon SAM templates, see Amazon SAM template anatomy.

Use Amazon Infrastructure Composer to design a serverless application

To start building out a simple serverless application using your function’s Amazon SAM template as a starting point, you export your function configuration to Infrastructure Composer and activate Infrastructure Composer’s local sync mode. Local sync automatically saves your function’s code and your Amazon SAM template to your local build machine and keeps your saved template synced as you add other Amazon resources in Infrastructure Composer.

To export your function to Infrastructure Composer, you need permission to use certain API actions. If you're unable to export your function, see Required permissions and make sure you have the permissions you need.

Now that you’ve added these extra resources, let’s take a look at the updated Amazon SAM template Infrastructure Composer has created.

Your Amazon SAM template should now contain the following additional resources and properties:

The complete final Amazon SAM template should look like the following.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: An AWS Serverless Specification template describing your function.
Resources:
  LambdaIaCDemo:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: .
      Description: ''
      MemorySize: 128
      Timeout: 3
      Handler: lambda_function.lambda_handler
      Runtime: python3.11
      Architectures:
        - x86_64
      EventInvokeConfig:
        MaximumEventAgeInSeconds: 21600
        MaximumRetryAttempts: 2
      EphemeralStorage:
        Size: 512
      RuntimeManagementConfig:
        UpdateRuntimeOn: Auto
      SnapStart:
        ApplyOn: None
      PackageType: Zip
      Policies:
        - Statement:
            - Effect: Allow
              Action:
                - logs:CreateLogGroup
              Resource: arn:aws:logs:us-east-1:594035263019:*
            - Effect: Allow
              Action:
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource:
                - arn:aws:logs:us-east-1:594035263019:log-group:/aws/lambda/LambdaIaCDemo:*
        - DynamoDBCrudPolicy:
            TableName: !Ref LambdaIaCTable
      Events:
        LambdaIaCQueue:
          Type: SQS
          Properties:
            Queue: !GetAtt LambdaIaCQueue.Arn
            BatchSize: 1
      Environment:
        Variables:
          LAMBDAIACTABLE_TABLE_NAME: !Ref LambdaIaCTable
          LAMBDAIACTABLE_TABLE_ARN: !GetAtt LambdaIaCTable.Arn
  LambdaIaCQueue:
    Type: AWS::SQS::Queue
    Properties:
      MessageRetentionPeriod: 345600
  LambdaIaCTable:
    Type: AWS::DynamoDB::Table
    Properties:
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      BillingMode: PAY_PER_REQUEST
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      StreamSpecification:
        StreamViewType: NEW_AND_OLD_IMAGES

Deploy your serverless application using Amazon SAM (optional)

If you want to use Amazon SAM to deploy a serverless application using the template you just created in Infrastructure Composer, you first need to install the Amazon SAM CLI. To do this, follow the instructions in Installing the Amazon SAM CLI.

Before you deploy your application, you also need to update the function code that Infrastructure Composer saved along with your template. At the moment, the lambda_function.py file that Infrastructure Composer saved contains only the basic 'Hello world' code that Lambda provided when you created the function.

To update your function code, copy the following code and paste it into the lambda_function.py file Infrastructure Composer saved to your local build machine. You specified the directory for Infrastructure Composer to save this file to when you activated Local Sync mode.

This code accepts a key value pair in a message from the Amazon SQS queue you created in Infrastructure Composer. If both the key and value are strings, the code then uses them to write an item to the DynamoDB table defined in your template.

import boto3
import os
import json

# define the DynamoDB table that Lambda will connect to
tablename = os.environ['LAMBDAIACTABLE_TABLE_NAME']

# create the DynamoDB resource
dynamo = boto3.client('dynamodb')

def lambda_handler(event, context):
    # get the message out of the SQS event
    message = event['Records'][0]['body']
    data = json.loads(message)
    # write event data to DDB table
    if check_message_format(data):
        key = next(iter(data))
        value = data[key]
        dynamo.put_item(
            TableName=tablename,
            Item={
                'id': {'S': key},
                'Value': {'S': value}
            }
        )
    else:
        raise ValueError("Input data not in the correct format")

# check that the event object contains a single key value  
# pair that can be written to the database
def check_message_format(message):
    if len(message) != 1:
        return False
        
    key, value = next(iter(message.items()))
    
    if not (isinstance(key, str) and isinstance(value, str)):
        return False

    else:
        return True

During the deployment process, Amazon SAM creates the following resources in your Amazon Web Services account:

Amazon SAM also creates the necessary IAM roles and policies so that your Lambda function can read messages from the Amazon SQS queue and perform CRUD operations on the DynamoDB table.

Testing your deployed application (optional)

To confirm that your serverless application deployed correctly, send a message to your Amazon SQS queue containing a key value pair and check that Lambda writes an item into your DynamoDB table using these values.