Step 2: Create a Lambda function - Amazon MemoryDB for Redis
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Step 2: Create a Lambda function

To create a Lambda function, take these steps.

Step 2.1: Create the deployment package

In this tutorial, we provide example code in Python for your Lambda function.


The following example Python code reads and writes an item to your MemoryDB cluster. Copy the code and save it into a file named Be sure to replace the cluster_endpoint value in the code with the endpoint address you copied in step 1.2.

from typing import Tuple, Union from urllib.parse import ParseResult, urlencode, urlunparse import botocore.session import redis from botocore.model import ServiceId from botocore.signers import RequestSigner from cachetools import TTLCache, cached import uuid class MemoryDBIAMProvider(redis.CredentialProvider): def __init__(self, user, cluster_name, region="us-east-1"): self.user = user self.cluster_name = cluster_name self.region = region session = botocore.session.get_session() self.request_signer = RequestSigner( ServiceId("memorydb"), self.region, "memorydb", "v4", session.get_credentials(), session.get_component("event_emitter"), ) # Generated IAM tokens are valid for 15 minutes @cached(cache=TTLCache(maxsize=128, ttl=900)) def get_credentials(self) -> Union[Tuple[str], Tuple[str, str]]: query_params = {"Action": "connect", "User": self.user} url = urlunparse( ParseResult( scheme="https", netloc=self.cluster_name, path="/", query=urlencode(query_params), params="", fragment="", ) ) signed_url = self.request_signer.generate_presigned_url( {"method": "GET", "url": url, "body": {}, "headers": {}, "context": {}}, operation_name="connect", expires_in=900, region_name=self.region, ) # RequestSigner only seems to work if the URL has a protocol, but # MemoryDB only accepts the URL without a protocol # So strip it off the signed URL before returning return (self.user, signed_url.removeprefix("https://")) def lambda_handler(event, context): username = "iam-user-01" # replace with your user id cluster_name = "cluster-01" # replace with your cache name cluster_endpoint = "" # replace with your cluster endpoint creds_provider = MemoryDBIAMProvider(user=username, cluster_name=cluster_name) redis_client = redis.Redis(host=cluster_endpoint, port=6379, credential_provider=creds_provider, ssl=True, ssl_cert_reqs="none") key='uuid' # create a random UUID - this will be the sample element we add to the cluster uuid_in = uuid.uuid4().hex redis_client.set(key, uuid_in) result = redis_client.get(key) decoded_result = result.decode("utf-8") # check the retrieved item matches the item added to the cluster and print # the results if decoded_result == uuid_in: print(f"Success: Inserted {uuid_in}. Fetched {decoded_result} from MemoryDB.") else: raise Exception(f"Bad value retrieved. Expected {uuid_in}, got {decoded_result}") return "Fetched value from MemoryDB"

This code uses the Python redis-py library to put items into your cluster and retrieve them. This code uses cachetools to cache generated IAM Auth tokens for 15 mins. To create a deployment package containing redis-py and cachetools, carry out the following steps.

In your project directory containing the source code file, create a folder package to install the redis-py and cachetools libraries into.

mkdir package

Install redis-py and cachetools using pip.

pip install --target ./package redis pip install --target ./package cachetools

Create a .zip file containing the redis-py and cachetools libraries. In Linux and MacOS, run the following command. In Windows, use your preferred zip utility to create a .zip file with the redis-py and cachetools libraries at the root.

cd package zip -r ../

Add your function code to the .zip file. In Linux and macOS, run the following command. In Windows, use your preferred zip utility to add to the root of your .zip file.

cd .. zip

Step 2.2: Create the IAM role (execution role)

Attach the Amazon managed policy named AWSLambdaVPCAccessExecutionRole to the role.

aws iam attach-role-policy \ --role-name "memorydb-iam-auth-app" \ --policy-arn "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"

Step 2.3: Upload the deployment package (create the Lambda function)

In this step, you create the Lambda function (AccessMemoryDB) using the create-function Amazon CLI command.

From the project directory that contains your deployment package .zip file, run the following Lambda CLI create-function command.

For the role option, use the ARN of the execution role you created in step 2.2. For the vpc-config enter comma separated lists of your default VPC's subnets and your default VPC's security group ID. You can find these values in the Amazon VPC console. To find your default VPC's subnets, choose Your VPCs, then choose your Amazon account's default VPC. To find the security group for this VPC, go to Security and choose Security groups. Ensure that you have the us-east-1 region selected.

aws lambda create-function \ --function-name AccessMemoryDB \ --region us-east-1 \ --zip-file fileb:// \ --role arn:aws:iam::123456789012:role/memorydb-iam-auth-app \ --handler app.lambda_handler \ --runtime python3.12 \ --timeout 30 \ --vpc-config SubnetIds=comma-separated-vpc-subnet-ids,SecurityGroupIds=default-security-group-id