AWS Lambda: Advanced Coding Session - clda.co/aws-lambda-webinar

0-README.md

AWS Lambda: Advanced Coding Session (slides)

Live demos:

1. Amazon API Gateway Access Control
2. Amazon Kinesis Streams processing
3. Amazon Cognito Sync trigger
4. AWS CloudFormation Custom Resources

Additional resources

• Webinar Slides
• AWS Documentation: API Gateway, Kinesis, Cognito, CloudFormation
• Amazon Cognito Sync Manager for JavaScript (aws/amazon-cognito-js)
• Cloud Academy shortcuts:
  • Webinars
  • Blog
  • Community
  • Support

1-api-gateway-lambda-authorizer.py

def lambda_handler(event, context):
    # retrieve the Auth token
    token = event['authorizationToken']

    # this should be retrieved by verifying the token (fake)
    principal_id = 'abc123'

    policy = create_policy(event['methodArn'], principal_id)

    # simple fake check    
    if event['authorizationToken'] == "webinar":
        policy.allowAllMethods()
    else:
        policy.denyAllMethods()

    return policy.build()

def create_policy(method_arn, principal_id):
    # retrieve API details from Arn
    tmp = method_arn.split(':')
    region = tmp[3]
    account_id = tmp[4]
    api_id, stage = tmp[5].split('/')[:2]

    # create new AuthPolicy object (defined in the official Blueprint)
    policy = AuthPolicy(principal_id, account_id)
    policy.restApiId = api_id
    policy.region = region
    policy.stage = stage

    return policy

class AuthPolicy(object):
    """ Defined in the official Blueprint """

1-api-gateway-tests.sh

URL=YOUR_API_ENDPOINT
API_KEY=YOUR_API_KEY

# open API
echo "Open API"
curl $URL -w "\n"

# with API key
echo "With API key"
curl -H "x-api-key: $API_KEY" $URL -w "\n"

# custom Authorizer with Basic Auth
echo "Custom Authorizer"
curl -H "Authorization: webinar" $URL -w "\n"

1-api-gateway-velocity.vm

{
    "principal_id": "$context.authorizer.principalId"
}

2-kinesis-generate-events.py

import boto3
import time
import json
import random

client = boto3.client('kinesis', 'eu-west-1')
STREAM_NAME = 'events'

for index in range(1, 31):  # 30 iteratins
    time.sleep(0.5)
    n = random.randint(10, 100)  # random number btw 10 and 100
    print("Generating %s records for 'event%s'" % (n, index))
    # push n identical records (just the event name)
    client.put_records(
        StreamName=STREAM_NAME,
        Records=[
            {
                'Data': b'name-%s' % index,  # will be base64-encoded by boto
                'PartitionKey': 'my-partition-key-0001',  # arbitrary key
            } for i in range(n)
        ]
    )

2-kinesis-lambda-process-events.py

import boto3
import base64

DDB = boto3.resource('dynamodb').Table('events')

def lambda_handler(event, context):

    print("Received %s records" % len(event['Records']))  # logging is free!

    totals = {}
    for record in event['Records']:
        payload = base64.b64decode(record['kinesis']['data'])  # base64 decode
        if not payload in totals:
            totals[payload] = 0  # init to 0
        totals[payload] += 1  # simply inc

    # 1 DDB write for each event name in the given batch (counter update)
    for name, total in totals.iteritems():
        print("Recording %s %s events" % (total, name))  # logging is free!
        DDB.update_item(
            Key={'Name': name},
            UpdateExpression='ADD EventCount :val',
            ExpressionAttributeValues={':val': total},
        )

    return 'Successfully processed {} records.'.format(len(event['Records']))

3-cognito-lambda-sync-trigger.py

def lambda_handler(event, context):
    
    if event['eventType'] == 'SyncTrigger':

        records = event['datasetRecords']

        email = records.get('Email')  # may be None
        if email and email['newValue'].endswith('@cloudacademy.com'):
            # guess the Company name
            records['Company'] = {
                'newValue': 'Cloud Academy, Inc.',
                'op': 'replace',
            }

    print("New event: %s" % event)
    return event  # return same structure

3-cognito-sync.js

// init credentials
AWS.config.region = 'eu-west-1';
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
    IdentityPoolId: "YOUR_POOL_ID",
});

AWS.config.credentials.get(function(err){

    var syncClient = new AWS.CognitoSyncManager();

    syncClient.openOrCreateDataset('account', function(err, dataset) {
        // set Email record
        dataset.put('Email', '[email protected]', function(err, record){
            // sync the dataset
            dataset.synchronize({
                onSuccess: function(dataset) {
                    // verify that the Company record has been set
                    dataset.get('Company', function(err, data){
                        alert('Company: ' + data);
                    });
                }
            });

        });
    });

});