AWS lambda documentation change
Summary
Removed detailed tutorial section and restructured content to reference external getting-started guide. Changed section headers and updated links related to AWS CDK/SAM documentation.
Security assessment
The changes are organizational/structural documentation updates rather than security-related fixes. No security vulnerabilities or security feature enhancements are mentioned. The removed tutorial included IAM policy examples but this appears to be routine documentation restructuring rather than addressing a specific security issue.
Diff
diff --git a/lambda/latest/dg/foundation-iac.md b/lambda/latest/dg/foundation-iac.md index 63a9d3b8b..72be36033 100644 --- a//lambda/latest/dg/foundation-iac.md +++ b//lambda/latest/dg/foundation-iac.md @@ -5 +5 @@ -IaC tools for LambdaGetting started with IaC for Lambda +IaC tools for Lambda @@ -26 +26 @@ AWS SAM is an open-source framework built on top of CloudFormation. It provides -The CDK is a code-first approach to IaC. You can define your Lambda-based architecture using TypeScript, JavaScript, Python, Java, C#/.Net, or Go. Choose your preferred language and use programming elements like parameters, conditionals, loops, composition, and inheritance to define the desired outcome of your infrastructure. The CDK then generates the underlying CloudFormation templates for deployment. For an example of how to use Lambda with CDK, see [Deploying Lambda functions with the AWS CDK](./lambda-cdk-tutorial.html). +The CDK is a code-first approach to IaC. You can define your Lambda-based architecture using TypeScript, JavaScript, Python, Java, C#/.Net, or Go. Choose your preferred language and use programming elements like parameters, conditionals, loops, composition, and inheritance to define the desired outcome of your infrastructure. The CDK then generates the underlying CloudFormation templates for deployment. For an example of how to use Lambda with CDK, see [Deploying Lambda functions with AWS CDK](./lambda-cdk-tutorial.html). @@ -32,424 +32 @@ AWS also provides a service called AWS Infrastructure Composer to develop IaC te -In the Getting started with IaC for Lambda section below, you use Infrastructure Composer to develop a template for a serverless application based on an existing Lambda function. - -## Getting started with IaC for Lambda - -In this tutorial, you can get started using IaC with Lambda by creating an AWS SAM template from an existing Lambda function and then building out a serverless application in Infrastructure Composer by adding other AWS resources. - -As you carry out this tutorial, you’ll learn some fundamental concepts, like how AWS resources are specified in AWS SAM. You’ll also learn how to use Infrastructure Composer to build a serverless application you can deploy using AWS SAM or AWS CloudFormation. - -To complete this tutorial, you’ll carry out the following steps: - - * Create an example Lambda function - - * Use the Lambda console to view the AWS SAM template for the function - - * Export your function’s configuration to AWS Infrastructure Composer and design a simple serverless application based on your function’s configuration - - * Save an updated AWS SAM template you can use as a basis to deploy your serverless application - - - - -### Prerequisites - -In this tutorial, you use Infrastructure Composer’s [local sync](https://docs.aws.amazon.com/application-composer/latest/dg/reference-features-local-sync.html) feature to save your template and code files to your local build machine. To use this feature, you need a browser that supports the File System Access API, which allows web applications to read, write, and save files in your local file system . We recommend using either Google Chrome or Microsoft Edge. For more information about the File System Access API, see [What is the File System Access API?](https://docs.aws.amazon.com/application-composer/latest/dg/reference-fsa.html#reference-fsa-api) - -### Create a Lambda function - -In this first step, you create a Lambda function you can use to complete the rest of the tutorial. To keep things simple, you use the Lambda console to create a basic 'Hello world' function using the Python 3.11 runtime. - -###### To create a 'Hello world' Lambda function using the console - - 1. Open the [Lambda console](https://console.aws.amazon.com/lambda). - - 2. Choose **Create function**. - - 3. Leave **Author from scratch** selected, and under **Basic information** , enter `LambdaIaCDemo` for **Function name**. - - 4. For **Runtime** , select **Python 3.11**. - - 5. Choose **Create function**. - - - - -### View the AWS SAM template for your function - -Before you export your function configuration to Infrastructure Composer, use the Lambda console to view your function's current configuration as an AWS SAM template. By following the steps in this section, you'll learn about the anatomy of an AWS SAM template and how to define resources like Lambda functions to start specifying a serverless application. - -###### To view the AWS SAM template for your function - - 1. Open the [Functions page](https://console.aws.amazon.com/lambda/home#/functions) of the Lambda console. - - 2. Choose the function you just created (`LambdaIaCDemo`). - - 3. In the **Function overview** pane, choose **Template**. - -In place of the diagram representing your function’s configuration, you’ll see an AWS SAM template for your function. The template should look like the following. - - # This AWS SAM template has been generated from your function's - # configuration. If your function has one or more triggers, note - # that the AWS resources associated with these triggers aren't fully - # specified in this template and include placeholder values.Open this template - # in AWS Application Composer or your favorite IDE and modify - # it to specify a serverless application with other AWS resources. - AWSTemplateFormatVersion: '2010-09-09' - Transform: AWS::Serverless-2016-10-31 - Description: An AWS Serverless Specification template describing your function. - Resources: - LambdaIaCDemo: - Type: AWS::Serverless::Function - Properties: - CodeUri: . - Description: '' - MemorySize: 128 - Timeout: 3 - Handler: lambda_function.lambda_handler - Runtime: python3.11 - Architectures: - - x86_64 - EventInvokeConfig: - MaximumEventAgeInSeconds: 21600 - MaximumRetryAttempts: 2 - EphemeralStorage: - Size: 512 - RuntimeManagementConfig: - UpdateRuntimeOn: Auto - SnapStart: - ApplyOn: None - PackageType: Zip - Policies: - Statement: - - Effect: Allow - Action: - - logs:CreateLogGroup - Resource: arn:aws:logs:us-east-1:123456789012:* - - Effect: Allow - Action: - - logs:CreateLogStream - - logs:PutLogEvents - Resource: - - >- - arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/LambdaIaCDemo:* - - - - -Let’s take a moment to look at the YAML template for your function and understand some key concepts. - -The template starts with the declaration `Transform: AWS::Serverless-2016-10-31`. This declaration is required because behind the scenes, AWS SAM templates are deployed through AWS CloudFormation. Using the `Transform` statement identifies the template as an AWS SAM template file. - -Following the `Transform` declaration comes the `Resources` section. This is where the AWS resources you want to deploy with your AWS SAM template are defined. AWS SAM templates can contain a combination of AWS SAM resources and AWS CloudFormation resources. This is because during deployment, AWS SAM templates expand to AWS CloudFormation templates, so any valid AWS CloudFormation syntax can be added to an AWS SAM template. - -At the moment, there is just one resource defined in the `Resources` section of the template, your Lambda function `LambdaIaCDemo`. To add a Lambda function to an AWS SAM template, you use the `AWS::Serverless::Function` resource type. The `Properties` of a Lambda function resource define the function’s runtime, function handler, and other configuration options. The path to your function’s source code that AWS SAM should use to deploy the function is also defined here. To learn more about Lambda function resources in AWS SAM, see [AWS::Serverless::Function](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html) in the _AWS SAM Developer Guide_. - -As well as the function properties and configurations, the template also specifies an AWS Identity and Access Management (IAM) policy for your function. This policy gives your function permission to write logs to Amazon CloudWatch Logs. When you create a function in the Lambda console, Lambda automatically attaches this policy to your function. To learn more about specifying an IAM policy for a function in an AWS SAM template, see the `policies` property on the [AWS::Serverless::Function](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html) page of the _AWS SAM Developer Guide_. - -To learn more about the structure of AWS SAM templates, see [AWS SAM template anatomy](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-specification-template-anatomy.html). - -### Use AWS Infrastructure Composer to design a serverless application - -To start building out a simple serverless application using your function’s AWS SAM template as a starting point, you export your function configuration to Infrastructure Composer and activate Infrastructure Composer’s local sync mode. Local sync automatically saves your function’s code and your AWS SAM template to your local build machine and keeps your saved template synced as you add other AWS resources in Infrastructure Composer. - -###### To export your function to Infrastructure Composer - - 1. In the **Function Overview** pane, choose **Export to Application Composer**. - -To export your function's configuration and code to Infrastructure Composer, Lambda creates an Amazon S3 bucket in your account to temporarily store this data. - - 2. In the dialog box, choose **Confirm and create project** to accept the default name for this bucket and export your function's configuration and code to Infrastructure Composer. - - 3. (Optional) To choose another name for the Amazon S3 bucket that Lambda creates, enter a new name and choose **Confirm and create project**. Amazon S3 bucket names must be globally unique and follow the [bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html). - -Selecting **Confirm and create project** opens the Infrastructure Composer console. On the _canvas_ , you’ll see your Lambda function. - - 4. From the **Menu** dropdown, choose **Activate local sync**. - - 5. In the dialog box that opens, choose **Select folder** and select a folder on your local build machine. - - 6. Choose **Activate** to activate local sync. - - - - -To export your function to Infrastructure Composer, you need permission to use certain API actions. If you're unable to export your function, see [Required permissions](./services-appcomposer.html#services-appcomposer-permissions) and make sure you have the permissions you need. - -###### Note - -Standard [Amazon S3 pricing](https://aws.amazon.com/s3/pricing) applies for the bucket Lambda creates when you export a function to Infrastructure Composer. The objects that Lambda puts into the bucket are automatically deleted after 10 days, but Lambda doesn't delete the bucket itself. - -To avoid additional charges being added to your AWS account, follow the instructions in [Deleting a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/delete-bucket.html) after you have exported your function to Infrastructure Composer. For more information about the Amazon S3 bucket Lambda creates, see [Using AWS Lambda with AWS Infrastructure Composer](./services-appcomposer.html). - -###### To design your serverless application in Infrastructure Composer - -After activating local sync, changes you make in Infrastructure Composer will be reflected in the AWS SAM template saved on your local build machine. You can now drag and drop additional AWS resources onto the Infrastructure Composer canvas to build out your application. In this example, you add an Amazon SQS simple queue as a trigger for your Lambda function and a DynamoDB table for the function to write data to. - - 1. Add an Amazon SQS trigger to your Lambda function by doing the following: - - 1. In the search field in the **Resources** palette, enter `SQS`. - - 2. Drag the **SQS Queue** resource onto your canvas and position it to the left of your Lambda function. - - 3. Choose **Details** , and for **Logical ID** enter `LambdaIaCQueue`. - - 4. Choose **Save**. - - 5. Connect your Amazon SQS and Lambda resources by clicking on the **Subscription** port on the SQS queue card and dragging it to the left hand port on the Lambda function card. The appearance of a line between the two resources indicates a successful connection. Infrastructure Composer also displays a message at the bottom of the canvas indicating that the two resources are successfully connected. - - 2. Add an Amazon DynamoDB table for your Lambda function to write data to by doing the following: - - 1. In the search field in the **Resources** palette, enter `DynamoDB`. - - 2. Drag the **DynamoDB Table** resource onto your canvas and position it to the right of your Lambda function. - - 3. Choose **Details** , and for **Logical ID** enter `LambdaIaCTable`. - - 4. Choose **Save**. - - 5. Connect the DynamoDB table to your Lambda function by clicking on the right hand port of the Lambda function card and dragging it to the left hand port on the DynamoDB card. - - - - -Now that you’ve added these extra resources, let’s take a look at the updated AWS SAM template Infrastructure Composer has created. - -###### To view your updated AWS SAM template - - * On the Infrastructure Composer canvas, choose **Template** to switch from the canvas view to the template view. - -