AWS lambda documentation change
Summary
Restructured tutorial steps, removed AWS Cloud9/EC2 security group setup, simplified cluster creation, switched to CloudShell for connectivity, consolidated testing sections, and added troubleshooting guidance
Security assessment
Changes focus on simplifying workflow and updating procedures rather than addressing security vulnerabilities. While security-related elements like VPC endpoints and Secrets Manager remain, there's no evidence of patching a specific security flaw. The removal of EC2 security group creation is offset by updated VPC endpoint security group references to default configurations.
Diff
diff --git a/lambda/latest/dg/with-documentdb-tutorial.md b/lambda/latest/dg/with-documentdb-tutorial.md index 5e085dc4d..2ca49dd1b 100644 --- a//lambda/latest/dg/with-documentdb-tutorial.md +++ b//lambda/latest/dg/with-documentdb-tutorial.md @@ -5 +5 @@ -PrerequisitesCreate the AWS Cloud9 environmentCreate the Amazon EC2 security groupCreate the Amazon DocumentDB clusterCreate the secret in Secrets ManagerInstall the mongo shellConnect to the Amazon DocumentDB clusterActivate change streamsCreate interface VPC endpointsCreate the execution roleCreate the Lambda functionCreate the Lambda event source mappingTest your function - manual invokeTest your function - insert a recordTest your function - update a recordTest your function - delete a recordClean up your resources +Create the clusterCreate the secret in Secrets ManagerConnect to the clusterActivate change streamsCreate interface VPC endpointsCreate the execution roleCreate the Lambda functionCreate the Lambda event source mappingTest your functionTroubleshootingClean up your resources @@ -15,138 +15 @@ In this tutorial, you create a basic Lambda function that consumes events from a - * Test the end-to-end setup by inserting items into your Amazon DocumentDB database. - - - - -###### Topics - - * Prerequisites - - * Create the AWS Cloud9 environment - - * Create the Amazon EC2 security group - - * Create the Amazon DocumentDB cluster - - * Create the secret in Secrets Manager - - * Install the mongo shell - - * Connect to the Amazon DocumentDB cluster - - * Activate change streams - - * Create interface VPC endpoints - - * Create the execution role - - * Create the Lambda function - - * Create the Lambda event source mapping - - * Test your function - manual invoke - - * Test your function - insert a record - - * Test your function - update a record - - * Test your function - delete a record - - * Clean up your resources - - - - -## Prerequisites - -If you have not yet installed the AWS Command Line Interface, follow the steps at [Installing or updating the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) to install it. - -The tutorial requires a command line terminal or shell to run commands. In Linux and macOS, use your preferred shell and package manager. - -###### Note - -In Windows, some Bash CLI commands that you commonly use with Lambda (such as `zip`) are not supported by the operating system's built-in terminals. To get a Windows-integrated version of Ubuntu and Bash, [install the Windows Subsystem for Linux](https://docs.microsoft.com/en-us/windows/wsl/install-win10). - -## Create the AWS Cloud9 environment - - - -Before creating the Lambda function, you need to create and configure your Amazon DocumentDB cluster. The steps to set up your cluster in this tutorial is based on the procedure in [Get Started with Amazon DocumentDB](https://docs.aws.amazon.com/documentdb/latest/developerguide/get-started-guide.html). - -###### Note - -If you already have an Amazon DocumentDB cluster set up, ensure that you activate change streams and create the necessary interface VPC endpoints. Then, you can skip directly to the function creation steps. - -First, create an AWS Cloud9 environment. You’ll use this environment throughout this tutorial to connect to and query your Amazon DocumentDB cluster. - -###### To create an AWS Cloud9 environment - - 1. Open the [AWS Cloud9 console](https://console.aws.amazon.com/cloud9control/home#) and choose **Create environment**. - - 2. Create an environment with the following configuration: - - * Under **Details** : - - * **Name** : `DocumentDBCloud9Environment` - - * **Environment type** : New EC2 instance - - * Under **New EC2 instance** : - - * **Instance type** : `t2.micro` (1 GiB RAM + 1 vCPU) - - * **Platform** : Amazon Linux 2 - - * **Timeout** : 30 minutes - - * Under **Network settings** : - - * **Connection** : AWS Systems Manager (SSM) - - * Expand the **VPC settings** dropdown. - - * **Amazon Virtual Private Cloud (VPC)** :Choose your [default VPC](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html). - - * **Subnet** : No preference - - * Keep all other default settings. - - 3. Choose **Create**. Provisioning your new AWS Cloud9 environment can take several minutes. - - - - -## Create the Amazon EC2 security group - - - -Next, create an [Amazon EC2 security group](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html) with rules that allow traffic between your Amazon DocumentDB cluster and your AWS Cloud9 environment. - -###### To create an EC2 security group - - 1. Open the [EC2 console](https://console.aws.amazon.com/ec2). Under **Network and Security** , choose **Security groups**. - - 2. Choose **Create security group**. - - 3. Create a security group with the following configuration: - - * Under **Basic details** : - - * **Security group name** : `DocDBTutorial` - - * **Description** : Security group for traffic between AWS Cloud9 and Amazon DocumentDB. - - * **VPC** : Choose your [default VPC](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html). - - * Under **Inbound rules** , choose **Add rule**. Create a rule with the following configuration: - - * **Type** : Custom TCP - - * **Port range** : 27017 - - * **Source** : Custom - - * In the search box next to **Source** , choose the security group for the AWS Cloud9 environment you created in the previous step. To see a list of available security groups, enter `cloud9` in the search box. Choose the security group with the name `aws-cloud9-<environment_name>`. - - * Keep all other default settings. - - 4. Choose **Create security group**. + * Test the setup by inserting items into your Amazon DocumentDB database. @@ -159,6 +21,0 @@ Next, create an [Amazon EC2 security group](https://docs.aws.amazon.com/AWSEC2/l - - -In this step, you’ll create an Amazon DocumentDB cluster using the security group from the previous step. - -###### To create an Amazon DocumentDB cluster - @@ -169,11 +26 @@ In this step, you’ll create an Amazon DocumentDB cluster using the security gr - * For **Cluster type** , choose Instance Based Cluster. - - * Under **Configuration** : - - * **Engine version** : 5.0.0 - - * **Instance class** : db.t3.medium (free trial eligible) - - * **Number of instances** : 1 - - * Under **Authentication** : + * For **Cluster type** , choose **Instance-based cluster**. This is the default option. @@ -181 +28 @@ In this step, you’ll create an Amazon DocumentDB cluster using the security gr - * Enter the **Username** and **Password** needed to connect to your cluster (same credentials as you used to create the secret in the previous step). In **Confirm password** , confirm your password. + * Under **Cluster configuration** , make sure that **Engine version** 5.0.0 is selected. This is the default option. @@ -183 +30 @@ In this step, you’ll create an Amazon DocumentDB cluster using the security gr - * Toggle on **Show advanced settings**. + * Under **Instance configuration** : @@ -185 +32 @@ In this step, you’ll create an Amazon DocumentDB cluster using the security gr - * Under **Network settings** : + * For **DB instance class** , select **Memory optimized classes**. This is the default option. @@ -187 +34 @@ In this step, you’ll create an Amazon DocumentDB cluster using the security gr - * **Virtual Private Cloud (VPC)** : Choose your [default VPC](https://docs.aws.amazon.com/vpc/latest/userguide/default-vpc.html). + * For **Number of regular replica instances** , choose 1. @@ -189 +36 @@ In this step, you’ll create an Amazon DocumentDB cluster using the security gr - * **Subnet group** : default + * For **Instance class** , use the default selection. @@ -191 +38 @@ In this step, you’ll create an Amazon DocumentDB cluster using the security gr - * **VPC security groups** : In addition to `default (VPC)`, choose the `DocDBTutorial (VPC)` security group you created in the previous step. + * Under **Authentication** , enter a username for the primary user, and then choose **Self managed**. Enter a password, then confirm it. @@ -195 +42 @@ In this step, you’ll create an Amazon DocumentDB cluster using the security gr - 3. Choose **Create cluster**. Provisioning your Amazon DocumentDB cluster can take several minutes. + 3. Choose **Create cluster**. @@ -202,3 +49 @@ In this step, you’ll create an Amazon DocumentDB cluster using the security gr - - -To access your Amazon DocumentDB cluster manually, you must provide username and password credentials. For Lambda to access your cluster, you must provide a Secrets Manager secret that contains these same access credentials when setting up your event source mapping. In this step, you’ll create this secret. +While Amazon DocumentDB is creating your cluster, create an AWS Secrets Manager secret to store your database credentials. You'll provide this secret when you create the Lambda event source mapping in a later step. @@ -216 +61 @@ To access your Amazon DocumentDB cluster manually, you must provide username and - * Under **Credentials** , enter the username and password you’ll use to access your Amazon DocumentDB cluster. + * Under **Credentials** , enter the same username and password that you used to create your Amazon DocumentDB cluster. @@ -224 +69 @@ To access your Amazon DocumentDB cluster manually, you must provide username and - * **Secret name** – `DocumentDBSecret` + * **Secret name** : `DocumentDBSecret` @@ -237,11 +82 @@ To access your Amazon DocumentDB cluster manually, you must provide username and