Tutorial: Using Amazon Lambda with Amazon DocumentDB Streams

Open the Cloud9 console and choose Create environment.

Create an environment with the following configuration:

Choose Create. Provisioning your new Amazon Cloud9 environment can take several minutes.

Open the EC2 console. Under Network and Security, choose Security groups.

Choose Create security group.

Create a security group with the following configuration:

Choose Create security group.

Open the DocumentDB console. Under Clusters, choose Create.

Create a cluster with the following configuration:

Choose Create cluster. Provisioning your DocumentDB cluster can take several minutes.

Open the Secrets Manager console and choose Store a new secret.

For Choose secret type, choose the following options:

For Configure secret, choose the following options:

Choose Next.

Choose Store.

Refresh the console to verify that you successfully stored the DocumentDBSecret secret.

Open the Cloud9 console. Next to the DocumentDBCloud9Environment environment you created earlier, click on the Open link under the Cloud9 IDE column.

In the terminal window, create the MongoDB repository file with the following command:

echo -e "[mongodb-org-5.0] \nname=MongoDB Repository\nbaseurl=https://repo.mongodb.org/yum/amazon/2/mongodb-org/5.0/x86_64/\ngpgcheck=1 \nenabled=1 \ngpgkey=https://www.mongodb.org/static/pgp/server-5.0.asc" | sudo tee /etc/yum.repos.d/mongodb-org-5.0.repo

Then, install the mongo shell with the following command:

sudo yum install -y mongodb-org-shell

To encrypt data in transit, download the public key for Amazon DocumentDB. The following command downloads a file named global-bundle.pem:

wget https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem

Open the DocumentDB console. Under Clusters, choose your cluster by choosing its cluster identifier.

In the Connectivity & security tab, under Connect to this cluster with the mongo shell, choose Copy.

In your Cloud9 environment, paste this command into the terminal. Replace <insertYourPassword> with the correct password.

In your Cloud9 environment, ensure that you’re still connected to your DocumentDB cluster.

In the terminal window, use the following command to create a new database called docdbdemo:

use docdbdemo

Then, use the following command to insert a record into docdbdemo:

db.products.insert({"hello":"world"})

You should see output that looks like this:

WriteResult({ "nInserted" : 1 })

Use the following command to list all databases:

show dbs

Ensure that your output contains the docdbdemo database:

docdbdemo  0.000GB

Open the VPC console. In the left menu, under Virtual private cloud, choose Endpoints.

Choose Create endpoint. Create an endpoint with the following configuration:

Again, choose Create endpoint. Create an endpoint with the following configuration:

Open the Policies page in the IAM console and choose Create policy.

Choose the JSON tab. In the following policy, replace the Secrets Manager resource ARN in the final line of the statement with your secret ARN from earlier, and copy the policy into the editor.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "LambdaESMNetworkingAccess",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeVpcs",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups",
                "kms:Decrypt"
            ],
            "Resource": "*"
        },
        {
            "Sid": "LambdaDocDBESMAccess",
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBClusters",
                "rds:DescribeDBClusterParameters",
                "rds:DescribeDBSubnetGroups"
            ],
            "Resource": "*"
        },
        {
            "Sid": "LambdaDocDBESMGetSecretValueAccess",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue"
            ],
            "Resource": "arn:aws:secretsmanager:us-east-1:123456789012:secret:DocumentDBSecret"
        }
    ]
}

Choose Next: Tags, then choose Next: Review.

For Name, enter AWSDocumentDBLambdaPolicy.

Choose Create policy.

Open the Roles page in the IAM console and choose Create role.

For Select trusted entity, choose the following options:

For Add permissions, choose the AWSDocumentDBLambdaPolicy policy you just created, as well as the AWSLambdaBasicExecutionRole to give your function permissions to write to Amazon CloudWatch Logs.

Choose Next.

For Role name, enter AWSDocumentDBLambdaExecutionRole.

Choose Create role.

Copy the sample code into a file named index.js.

Create a deployment package with the following command.

zip function.zip index.js

Use the following CLI command to create the function. Replace us-east-1 with the region, and 123456789012 with your account ID.

aws lambda create-function --function-name ProcessDocumentDBRecords \
    --zip-file fileb://function.zip --handler index.handler --runtime nodejs20.x \
    --region us-east-1 \
    --role arn:aws:iam::123456789012:role/AWSDocumentDBLambdaExecutionRole

Open the Functions page in the Lambda console.

Choose the ProcessDocumentDBRecords function you created earlier.

Choose the Configuration tab, then choose Triggers in the left menu.

Choose Add trigger.

Under Trigger configuration, for the source, select DocumentDB.

Create the event source mapping with the following configuration:

Choose Add. Creating your event source mapping can take a few minutes.

Open the Functions page in the Lambda console.

Choose the Monitor tab, then choose View CloudWatch logs. This takes you to the specific log group associated with your function in the CloudWatch console.

Choose the most recent log stream. Within the log messages, you should see the event JSON.

Reconnect to your DocumentDB cluster in your Cloud9 environment.

Use this command to ensure that you’re currently using the docdbdemo database:

use docdbdemo

Insert a record into the products collection of the docdbdemo database:

db.products.insert({"name":"Pencil", "price": 1.00})

Open the Functions page of the Lambda console.

Select the function that you created.

Choose Actions, Delete.

Type delete in the text input field and choose Delete.

Open the Roles page of the IAM console.

Select the execution role that you created.

Choose Delete.

Enter the name of the role in the text input field and choose Delete.

Open the VPC console. In the left menu, under Virtual private cloud, choose Endpoints.

Select the endpoints you created.

Choose Actions, Delete VPC endpoints.

Enter delete in the text input field.

Choose Delete.

Open the DocumentDB console.

Choose the DocumentDB cluster you created for this tutorial, and disable deletion protection.

In the main Clusters page, choose your DocumentDB cluster again.

Choose Actions, Delete.

For Create final cluster snapshot, select No.

Enter delete in the text input field.

Choose Delete.

Open the Secrets Manager console.

Choose the secret you created for this tutorial.

Choose Actions, Delete secret.

Choose Schedule deletion.

Open the EC2 console. Under Network and Security, choose Security groups.

Select the security group you created for this tutorial.

Choose Actions, Delete security groups.

Choose Delete.

Open the Cloud9 console.

Select the environment you created for this tutorial.

Choose Delete.

Enter delete in the text input field.

Choose Delete.