AWS code-library medium security documentation change
Summary
Updated Lambda function examples to use LambdaRuntime instead of LambdaHandler protocol, added error handling for environment variables/log levels, and introduced explicit debug logging configuration
Security assessment
Added explicit 'enableDebugLogging' function configures LOG_LEVEL=DEBUG and validates environment variables. This demonstrates security-sensitive logging configuration and adds error cases for misconfigured security settings. While not fixing a specific vulnerability, it documents security controls.
Diff
diff --git a/code-library/latest/ug/lambda_example_lambda_Scenario_GettingStartedFunctions_section.md b/code-library/latest/ug/lambda_example_lambda_Scenario_GettingStartedFunctions_section.md index 8c4ac23ed..09690821d 100644 --- a//code-library/latest/ug/lambda_example_lambda_Scenario_GettingStartedFunctions_section.md +++ b//code-library/latest/ug/lambda_example_lambda_Scenario_GettingStartedFunctions_section.md @@ -4781 +4781 @@ Define the first Lambda function, which simply increments the specified value. - from: "1.0.0-alpha"), + branch: "main"), @@ -4818,18 +4818 @@ Define the first Lambda function, which simply increments the specified value. - /// A Swift AWS Lambda Runtime `LambdaHandler` lets you both perform needed - /// initialization and handle AWS Lambda requests. There are other handler - /// protocols available for other use cases. - @main - struct IncrementLambda: LambdaHandler { - - /// Initialize the AWS Lambda runtime. - /// - /// ^ The logger is a standard Swift logger. You can control the verbosity - /// by setting the `LOG_LEVEL` environment variable. - init(context: LambdaInitializationContext) async throws { - // Display the `LOG_LEVEL` configuration for this process. - context.logger.info( - "Log Level env var : \(ProcessInfo.processInfo.environment["LOG_LEVEL"] ?? "info" )" - ) - } - - /// The Lambda function's entry point. Called by the Lambda runtime. + /// The Lambda function body. @@ -4845 +4828,2 @@ Define the first Lambda function, which simply increments the specified value. - func handle(_ event: Request, context: LambdaContext) async throws -> Response { + let incrementLambdaRuntime = LambdaRuntime { + (event: Request, context: LambdaContext) -> Response in @@ -4859 +4843,4 @@ Define the first Lambda function, which simply increments the specified value. - } + + // Run the Lambda runtime code. + + try await incrementLambdaRuntime.run() @@ -4885 +4872 @@ Define the second Lambda function, which performs an arithmetic operation on two - from: "1.0.0-alpha"), + branch: "main"), @@ -4941,17 +4927,0 @@ Define the second Lambda function, which performs an arithmetic operation on two - /// A Swift AWS Lambda Runtime `LambdaHandler` lets you both perform needed - /// initialization and handle AWS Lambda requests. There are other handler - /// protocols available for other use cases. - @main - struct CalculatorLambda: LambdaHandler { - - /// Initialize the AWS Lambda runtime. - /// - /// ^ The logger is a standard Swift logger. You can control the verbosity - /// by setting the `LOG_LEVEL` environment variable. - init(context: LambdaInitializationContext) async throws { - // Display the `LOG_LEVEL` configuration for this process. - context.logger.info( - "Log Level env var : \(ProcessInfo.processInfo.environment["LOG_LEVEL"] ?? "info" )" - ) - } - @@ -4968 +4938,2 @@ Define the second Lambda function, which performs an arithmetic operation on two - func handle(_ event: Request, context: LambdaContext) async throws -> Response { + let calculatorLambdaRuntime = LambdaRuntime { + (_ event: Request, context: LambdaContext) -> Response in @@ -4975 +4946 @@ Define the second Lambda function, which performs an arithmetic operation on two - actionFunc = actions[action] + actionFunc = await actions[action] @@ -4993 +4964,2 @@ Define the second Lambda function, which performs an arithmetic operation on two - } + + try await calculatorLambdaRuntime.run() @@ -5042,2 +5014 @@ Define the main program that will invoke the two Lambda functions. - /// An example that demonstrates how to watch an transcribe event stream to - /// transcribe audio from a file to the console. + /// An example demonstrating a variety of important AWS Lambda functions. @@ -5155,0 +5127,4 @@ Define the main program that will invoke the two Lambda functions. + guard let role = output.role else { + throw ExampleError.roleCreateError + } + @@ -5167,4 +5141,0 @@ Define the main program that will invoke the two Lambda functions. - guard let role = output.role else { - throw ExampleError.roleCreateError - } - @@ -5198 +5169 @@ Define the main program that will invoke the two Lambda functions. - /// - name: The name of the AWS Lambda function to create. + /// - functionName: The name of the AWS Lambda function to create. @@ -5204 +5175 @@ Define the main program that will invoke the two Lambda functions. - func createFunction(lambdaClient: LambdaClient, name: String, + func createFunction(lambdaClient: LambdaClient, functionName: String, @@ -5219 +5190 @@ Define the main program that will invoke the two Lambda functions. - functionName: name, + functionName: functionName, @@ -5225,0 +5197,2 @@ Define the main program that will invoke the two Lambda functions. + print("*** Error creating Lambda function:") + dump(error) @@ -5237 +5210 @@ Define the main program that will invoke the two Lambda functions. - input: GetFunctionInput(functionName: name) + input: GetFunctionInput(functionName: functionName) @@ -5253 +5226 @@ Define the main program that will invoke the two Lambda functions. - /// - name: The name of the AWS Lambda function to update. + /// - functionName: The name of the AWS Lambda function to update. @@ -5259 +5232 @@ Define the main program that will invoke the two Lambda functions. - func updateFunctionCode(lambdaClient: LambdaClient, name: String, + func updateFunctionCode(lambdaClient: LambdaClient, functionName: String, @@ -5278 +5251 @@ Define the main program that will invoke the two Lambda functions. - functionName: name, + functionName: functionName, @@ -5293 +5266 @@ Define the main program that will invoke the two Lambda functions. - functionName: name + functionName: functionName @@ -5304,0 +5278,50 @@ Define the main program that will invoke the two Lambda functions. + /// Tell the server-side component to log debug output by setting its + /// environment's `LOG_LEVEL` to `DEBUG`. + /// + /// - Parameters: + /// - lambdaClient: The `LambdaClient` to use. + /// - functionName: The name of the AWS Lambda function to enable debug + /// logging for. + /// + /// - Throws: `ExampleError.environmentResponseMissingError`, + /// `ExampleError.updateFunctionConfigurationError`, + /// `ExampleError.environmentVariablesMissingError`, + /// `ExampleError.logLevelIncorrectError`, + /// `ExampleError.updateFunctionConfigurationError` + func enableDebugLogging(lambdaClient: LambdaClient, functionName: String) async throws { + let envVariables = [ + "LOG_LEVEL": "DEBUG" + ] + let environment = LambdaClientTypes.Environment(variables: envVariables) + + do { + let output = try await lambdaClient.updateFunctionConfiguration( + input: UpdateFunctionConfigurationInput( + environment: environment, + functionName: functionName + ) + ) + + guard let response = output.environment else { + throw ExampleError.environmentResponseMissingError + } + + if response.error != nil { + throw ExampleError.updateFunctionConfigurationError + } + + guard let retVariables = response.variables else { + throw ExampleError.environmentVariablesMissingError + } + + for envVar in retVariables { + if envVar.key == "LOG_LEVEL" && envVar.value != "DEBUG" { + print("*** Log level is not set to DEBUG!") + throw ExampleError.logLevelIncorrectError + } + } + } catch { + throw ExampleError.updateFunctionConfigurationError + } + } + @@ -5455 +5478 @@ Define the main program that will invoke the two Lambda functions. - if try await createFunction(lambdaClient: lambdaClient, name: basicsFunctionName, + if try await createFunction(lambdaClient: lambdaClient, functionName: basicsFunctionName, @@ -5456,0 +5480 @@ Define the main program that will invoke the two Lambda functions. + print("Running increment function calls...") @@ -5464,0 +5489,2 @@ Define the main program that will invoke the two Lambda functions. + } else { + print("*** Failed to create the increment function.") @@ -5466,0 +5493,5 @@ Define the main program that will invoke the two Lambda functions. + // Enable debug logging. + + print("\nEnabling debug logging...") + try await enableDebugLogging(lambdaClient: lambdaClient, functionName: basicsFunctionName) + @@ -5472 +5503 @@ Define the main program that will invoke the two Lambda functions. - if try await updateFunctionCode(lambdaClient: lambdaClient, name: "lambda-basics-function", + if try await updateFunctionCode(lambdaClient: lambdaClient, functionName: basicsFunctionName, @@ -5473,0 +5505 @@ Define the main program that will invoke the two Lambda functions. + print("Running calculator function calls...") @@ -5576,0 +5609,10 @@ Define the main program that will invoke the two Lambda functions. + /// Unable to update the function configuration. + case updateFunctionConfigurationError + /// The environment response is missing after an + /// UpdateEnvironmentConfiguration attempt. + case environmentResponseMissingError + /// The environment variables are missing from the EnvironmentResponse and + /// no errors occurred. + case environmentVariablesMissingError + /// The log level is incorrect after attempting to set it. + case logLevelIncorrectError @@ -5603,0 +5646,8 @@ Define the main program that will invoke the two Lambda functions. + case .updateFunctionConfigurationError: + return "Unable to update the AWS lambda function configuration." + case .environmentResponseMissingError: + return "The environment is missing from the response after updating the function configuration." + case .environmentVariablesMissingError: + return "While no error occurred, no environment variables were returned following function configuration." + case .logLevelIncorrectError: + return "The log level is incorrect after attempting to set it to DEBUG."