AWS lambda medium security documentation change
Summary
Updated Lambda function code example to use Node.js 22.x runtime, added timeout configuration, expanded IAM permissions guidance, and improved authentication documentation
Security assessment
Added explicit guidance about required IAM permissions (lambda:InvokeFunctionUrl and lambda:InvokeFunction) and improved authentication documentation by showing proper credential handling. The permission changes enforce least privilege access control, and the authentication details help prevent credential exposure. The runtime update to Node.js 22.x might include security improvements but isn't explicitly stated.
Diff
diff --git a/lambda/latest/dg/response-streaming-tutorial.md b/lambda/latest/dg/response-streaming-tutorial.md index 8ee7d4ef2..d37eade99 100644 --- a//lambda/latest/dg/response-streaming-tutorial.md +++ b//lambda/latest/dg/response-streaming-tutorial.md @@ -64,12 +64,28 @@ Create a response streaming Lambda function with a function URL endpoint using t - 1. Copy the following code example into a file named `index.mjs`. - - import util from 'util'; - import stream from 'stream'; - const { Readable } = stream; - const pipeline = util.promisify(stream.pipeline); - - /* global awslambda */ - export const handler = awslambda.streamifyResponse(async (event, responseStream, _context) => { - const requestStream = Readable.from(Buffer.from(JSON.stringify(event))); - await pipeline(requestStream, responseStream); - }); + 1. Copy the following code example into a file named `index.js`. This function streams three responses, separated by 1 second. + + exports.handler = awslambda.streamifyResponse( + async (event, responseStream, _context) => { + // Metadata is a JSON serializable JS object. Its shape is not defined here. + const metadata = { + statusCode: 200, + headers: { + "Content-Type": "application/json", + "CustomHeader": "outerspace" + } + }; + + // Assign to the responseStream parameter to prevent accidental reuse of the non-wrapped stream. + responseStream = awslambda.HttpResponseStream.from(responseStream, metadata); + + responseStream.write("Streaming with Helper \n"); + await new Promise(r => setTimeout(r, 1000)); + responseStream.write("Hello 0 \n"); + await new Promise(r => setTimeout(r, 1000)); + responseStream.write("Hello 1 \n"); + await new Promise(r => setTimeout(r, 1000)); + responseStream.write("Hello 2 \n"); + await new Promise(r => setTimeout(r, 1000)); + responseStream.end(); + await responseStream.finished(); + } + ); @@ -79 +95 @@ Create a response streaming Lambda function with a function URL endpoint using t - zip function.zip index.mjs + zip function.zip index.js @@ -81 +97 @@ Create a response streaming Lambda function with a function URL endpoint using t - 3. Create a Lambda function with the `create-function` command. Replace the value of `--role` with the role ARN from the previous step. + 3. Create a Lambda function with the `create-function` command. Replace the value of `--role` with the role ARN from the previous step. This command sets the function timeout to 10 seconds, which allows the function to stream three responses. @@ -85 +101 @@ Create a response streaming Lambda function with a function URL endpoint using t - --runtime nodejs16.x \ + --runtime nodejs22.x \ @@ -87,0 +104 @@ Create a response streaming Lambda function with a function URL endpoint using t + --timeout 10 \ @@ -95 +112 @@ Create a response streaming Lambda function with a function URL endpoint using t - 1. Add a resource-based policy to your function to allow access to your function URL. Replace the value of `--principal` with your AWS account ID. + 1. Add a resource-based policy to your function that grants `lambda:InvokeFunctionUrl` and `lambda:InvokeFunction` permissions. Each statement must be added in a separate command. Replace the value of `--principal` with your AWS account ID. @@ -100 +117 @@ Create a response streaming Lambda function with a function URL endpoint using t - --statement-id 12345 \ + --statement-id UrlPolicyInvokeURL \ @@ -102,2 +119,7 @@ Create a response streaming Lambda function with a function URL endpoint using t - --function-url-auth-type AWS_IAM \ - --statement-id url + --function-url-auth-type AWS_IAM + + aws lambda add-permission \ + --function-name my-streaming-function \ + --action lambda:InvokeFunction \ + --statement-id UrlPolicyInvokeFunction \ + --principal 123456789012 @@ -111,0 +134,4 @@ Create a response streaming Lambda function with a function URL endpoint using t +###### Note + +If you get an error about `--invoke-mode`, you might need to upgrade to a [newer version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html). + @@ -120 +146,6 @@ Test your integration by invoking your function. You can open your function's UR - curl --request GET "<function_url>" --user "<key:token>" --aws-sigv4 "aws:amz:us-east-1:lambda" --no-buffer + curl --request GET "https://abcdefghijklm7nop7qrs740abcd.lambda-url.us-east-1.on.aws/" --user "AKIAIOSFODNN7EXAMPLE" --aws-sigv4 "aws:amz:us-east-1:lambda" --no-buffer + +Our function URL uses the `IAM_AUTH` authentication type. This means that you need to sign requests with both your [AWS access key and secret key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html). In the previous command, replace `AKIAIOSFODNN7EXAMPLE` with the AWS access key ID. Enter your AWS secret key when prompted. If you don't have your AWS secret key, you can [use temporary AWS credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html) instead. + +You should see a response like this: + @@ -122 +153,4 @@ Test your integration by invoking your function. You can open your function's UR -Our function URL uses the `IAM_AUTH` authentication type. This means that you need to sign requests with both your AWS access key and secret key. In the previous command, replace `<key:token>` with the AWS access key ID. Enter your AWS secret key when prompted. If you don't have your AWS secret key, you can [use temporary AWS credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html) instead. + Streaming with Helper + Hello 0 + Hello 1 + Hello 2