This workshop consists of multiple levels of increasing difficulty. The basic track of this course uses the AWS Web Console. However, if you prefer working with the AWS CLI or with Terraform you may switch to one of these technologies at any stage in the course. If you stay on the basic track, there is nothing to install on your machine. If you want to switch to the CLI or to Terraform, you need to follow the optional installation instructions below.

At the start of the course, please take care of the following tasks:

You have received an AWS Account ID, an IAM user name and a password from the trainers. Please navigate to https://console.aws.amazon.com/, choose "IAM user", and enter the Account ID and then your credentials. This logs you into the console. From there you should be able to reach the service Lambda.

If you want to also work on some of the optional extra topics of this course, you need to install the AWS CLI on your machine. Please follow the AWS CLI installation instructions and choose the installation method best suited for your operating system.

In order to authenticate your CLI you need to first create an access key by performing the following steps:

1. Log in to the AWS Console with your credentials
2. Click on your name in the top right of the screen
3. Click My Security Credentials in the dropdown
4. Click Create Access Key under Access keys for CLI, SDK, & API access

Then you need to configure your CLI with access key ID and the secret access key

6. Type aws configure in your terminal
7. Copy your access key ID and the secret access key from the web console and paste them at the prompts
8. Choose eu-central-1 as the default region name
9. Test the connection by typing aws sts get-caller-identity in your terminal. You should see some basic information about your user.

Some optional extra topics also require Terraform, which you need to install on your machine. Please follow the Terraform installation instructions and choose the installation method best suited for your operating system.

In this level you will learn how to create a first simple function in AWS Lambda. You will also learn how to pass configuration parameters into a function using environment variables. Furthermore, you will see that AWS has a very strict, deny-by-default permission scheme.

Please work through the following steps:

1. Go to the AWS Lambda GUI
2. Click on Create function
3. Choose my-function-AWSUSER as the function name, replacing AWSUSER with you user name
4. Choose Node.js 14.x as the runtime
5. Open the section Change default execution role and note that the UI automatically creates an execution role behind the scenes, granting the function certain privileges
6. Click Create function
7. Copy the code from ./level-0/function/index.js and paste it into the code editor field
8. Press the Deploy button
9. Set environment variable NAME in the Configuration tab under Environment variables
10. Press the Test button and create a test event called test
11. Press the Test button again to run the test
12. Observe the test output

export AWSUSER=<your AWS username>

aws iam create-role --role-name lambda-exec-cli-"$AWSUSER" --assume-role-policy-document '{"Version": "2012-10-17","Statement": [{ "Effect": "Allow", "Principal": {"Service": "lambda.amazonaws.com"}, "Action": "sts:AssumeRole"}]}'

aws iam attach-role-policy --role-name lambda-exec-cli-"$AWSUSER" --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

zip -j function.zip level-0/function/index.js

export ACCOUNT_ID=<your account ID>

aws lambda create-function --function-name my-function-cli-"$AWSUSER" --zip-file fileb://function.zip --handler index.handler --runtime nodejs14.x --role arn:aws:iam::"$ACCOUNT_ID":role/lambda-exec-cli-"$AWSUSER"

aws lambda update-function-configuration --function-name my-function-cli-"$AWSUSER" --environment "Variables={NAME='$AWSUSER'}"

aws lambda invoke --function-name my-function-cli-"$AWSUSER" out --log-type Tail

aws lambda invoke --function-name my-function-cli-"$AWSUSER" out --log-type Tail --query 'LogResult' --output text |  base64 -d

export WORKDIR=<your work directory>
mkdir $WORKDIR
cp level-0/advanced/terraform/* $WORKDIR
cp -r level-0/function $WORKDIR

pushd $WORKDIR

terraform init

export TF_VAR_aws_user=<your AWS user name>

terraform apply

aws lambda invoke --function-name=$(terraform output -raw function_name) response.json

popd

To reach level 1, you'll need to learn about the following topics:

• Logging
• Event parameters
• Permissions

1. Go to the AWS Lambda UI
2. Click on Functions in the left navigation
3. Choose the function my-function-AWSUSER, which you created in level 0
4. Copy the code from ./level-1/function/index.js and paste it over the existing code in the editor field
5. Press the Deploy button
6. Press the Test button and create a test event called bob
7. Paste the following JSON object to the editor field

{
  "name": "Bob"
}

11. Press the Test button again to run the test
12. Navigate to the tab Monitor
13. Click View logs in CloudWatch
14. Look for a recent log stream and open it
15. Check for lines looking like this

2021-09-10T12:26:33.779Z c70ee5e7-4295-4408-a713-9f3ceaaa53e3 INFO Bob invoked me

2021-09-10T12:26:33.779Z c70ee5e7-4295-4408-a713-9f3ceaaa53e3 ERROR Oh noes!

16. Navigate to the tab Configuration and click on the category Permissions.
17. Observe the logging permissions which were assigned to your function automatically.

export AWSUSER=<your AWS username>

export ACCOUNT_ID=<your account ID>

zip -j function.zip level-1/function/index.js

aws lambda update-function-code --function-name my-function-cli-"$AWSUSER" --zip-file fileb://function.zip

aws lambda invoke --function-name my-function-cli-"$AWSUSER" --cli-binary-format raw-in-base64-out --payload '{ "name": "Bob" }' out --log-type Tail

aws logs describe-log-streams --log-group-name=/aws/lambda/my-function-cli-"$AWSUSER"

aws logs get-log-events --log-group-name=/aws/lambda/my-function-cli-"$AWSUSER" --log-stream-name=<name of latest log stream>

export WORKDIR=<your work directory>
export TF_VAR_aws_user=<your AWS user name>

cp -r level-1/function $WORKDIR

pushd

terraform apply

aws lambda invoke --function-name my-function-cli-"$AWSUSER" --cli-binary-format raw-in-base64-out --payload '{ "name": "Bob" }' out --log-type Tail

aws logs describe-log-streams --log-group-name=/aws/lambda/my-function-cli-"$AWSUSER"

aws logs get-log-events --log-group-name=/aws/lambda/my-function-cli-"$AWSUSER" --log-stream-name=<name of latest log stream>

popd

To reach level 2, you will learn about tracing in your function using AWS XRay. Additionally, we will use a DynamoDB table, which will allow us to trace calls from the function to the table.

We modify the the function to read a joke from a joke table and change the function parameters to receive a jokeID parameter by which it reads from the database.

1. Go to the AWS Lambda UI
2. Click on Functions in the left navigation
3. Choose the function my-function-AWSUSER, which you updated in level 1
4. Run npm install in the folder ./level-2/function
5. Create a zip file from the folder ./level-2/function and upload it to the function
6. Press the Deploy button
7. Grant DynamoDB permission to function
8. Grant XRay permission to function
9. In the Configuration tab of the lambda function, select the Monitoring and operations tools, click edit and enable Active tracing in the AWS X-Ray section.
10. On the functions Test tab create a test event with the following payload { "jokeID": "1" } and click the Test button. You should see the joke loaded from the database in the response.
11. On the Monitor tab, select the Traces menu option and inspect the service map as well as the individual traces. Click on one of the traces to get familiar of what info you have available, such as how long the request to query the DynamoDB took.

export AWSUSER=<your AWS username>

export ACCOUNT_ID=<your account ID>

aws iam attach-role-policy --role-name lambda-exec-cli-"$AWSUSER" --policy-arn arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess

aws iam create-policy --policy-name read-jokes-db-table-cli-"$AWSUSER" --policy-document '{ "Version": "2012-10-17", "Statement": [{ "Sid": "ReadWriteTable", "Effect": "Allow", "Action": [ "dynamodb:BatchGetItem", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan" ], "Resource": "arn:aws:dynamodb:eu-central-1:'$ACCOUNT_ID':table/Jokes" }]}'

aws iam attach-role-policy --role-name lambda-exec-cli-"$AWSUSER" --policy-arn arn:aws:iam::"$ACCOUNT_ID":policy/read-jokes-db-table-cli-"$AWSUSER"

pushd ./level-2/function
npm install
zip -r function.zip ./*
popd

aws lambda update-function-code --function-name my-function-cli-"$AWSUSER" --zip-file fileb://level-2/function/function.zip

aws lambda update-function-configuration --function-name my-function-cli-"$AWSUSER" --tracing-config "Mode=Active"

aws lambda invoke --function-name my-function-cli-"$AWSUSER" out --cli-binary-format raw-in-base64-out --payload '{ "jokeID": "1" }' --log-type Tail --query 'LogResult' --output text |  base64 -d

aws xray get-service-graph --start-time $(($(date +"%s") -1200)) --end-time $(date +"%s")

export WORKDIR=<your work directory>
export TF_VAR_aws_user=<your AWS user name>

cp level-2/advanced/terraform/* $WORKDIR
cp -r level-2/function $WORKDIR

pushd $WORKDIR/function
npm install
popd

pushd $WORKDIR

terraform apply

aws lambda update-function-configuration --function-name my-function-tf-"$AWSUSER" --tracing-config "Mode=Active"

aws lambda invoke --function-name my-function-tf-"$AWSUSER" out --cli-binary-format raw-in-base64-out --payload '{ "jokeID": "1" }' --log-type Tail --query 'LogResult' --output text |  base64 -d

aws xray get-service-graph --start-time $(($(date +"%s") -1200)) --end-time $(date +"%s")

popd

To reach this level, we'll make sure our function terminates in an orderly fashion within the timeout limit it is configured with. This means, aborting IO operations or long running calculations when the function time runs out, or at least return to your program flow to handle the return values. To do this, .
The AWS Lambda frameworks allow us to poll how much time is still left in a function call, which simplifies this.

Before you deploy the improved function to lambda, inspect the provided code. You will notice the following points:

• The usage of context.getRemainingTimeInMillis() to receive from Lambda how much time is left in our function
• An additional grace period, we retain for our function in TIMEOUT_GRACE_PERIOD_IN_MILLIS
• That we trigger a promise, that rejects when the remaining time is below the grace period.

Note!

Some AWS resources support the usage of an AbortController to terminate those actions. When doing IO operations using resources that do not support it or doing long running computations, make sure you set timeouts or implement a timeout check yourself.

1. Inspect the provided code as described above
2. Click on Functions in the left navigation
3. Choose the function my-function-AWSUSER, which you created in level 0
4. In the Configuration tab of the function, select the General configuration menu and set the timeout to 1 second
5. Note that now only <20ms will be available for the DynamoDB query, because our grace period is set to 980ms
6. Create a zip file from the function folder and upload it to the function
7. Press the Deploy button
8. On the functions Test tab create a test event with the following payload { "jokeID": "1" } and click the Test button. You should see the function returning successfully, but with a message, that it reached the timeout.
9. Set the timeout to 2 seconds and try again. This time, the function should be able to read the joke from the database and return it.

export AWSUSER=<your AWS username>

export ACCOUNT_ID=<your account ID>

pushd ./level-3/function
npm install
zip -r function.zip ./*
popd

aws lambda update-function-code --function-name my-function-cli-"$AWSUSER" --zip-file fileb://level-3/function/function.zip

aws lambda update-function-configuration --function-name my-function-cli-"$AWSUSER" --timeout 1

aws lambda invoke --function-name my-function-cli-"$AWSUSER" out --cli-binary-format raw-in-base64-out --payload '{ "jokeID": "1" }' --log-type Tail --query 'LogResult' --output text |  base64 -d

aws lambda update-function-configuration --function-name my-function-cli-"$AWSUSER" --timeout 2

aws lambda invoke --function-name my-function-cli-"$AWSUSER" out --cli-binary-format raw-in-base64-out --payload '{ "jokeID": "1" }' --log-type Tail --query 'LogResult' --output text |  base64 -d

export WORKDIR=<your work directory>
export TF_VAR_aws_user=<your AWS user name>

cp -r level-3/advanced/terraform $WORKDIR
cp -r level-3/function $WORKDIR

terraform apply

aws lambda invoke --function-name my-function-terraform-"$TF_VAR_aws_user" out --payload '{ "jokeID": "1" }' --log-type Tail --query 'LogResult' --output text |  base64 -d

terraform apply

aws lambda invoke --function-name my-function-terraform-"$TF_VAR_aws_user" out --payload '{ "jokeID": "1" }' --log-type Tail --query 'LogResult' --output text |  base64 -d

To reach level 4, you will need to reduce the cold start time of your function. Warmers are usually not recommended but you can try moving initialization code outside of your handler.

1. Go to the AWS Lambda UI
2. Click on Functions in the left navigation
3. Choose the function my-function-AWSUSER, which you updated in level 3
4. Run npm install in the folder ./level-4/function
5. Create a zip file from the folder ./level-4/function and upload it to the function
6. Press the Deploy button
7. Press the Test button and create a test event called joke
8. Paste the following JSON object to the editor field

{
  "jokeID": "1"
}

11. Press the Test button again to run the test
12. Observe the test output

export AWSUSER=<your AWS username>

export ACCOUNT_ID=<your account ID>

pushd ./level-4/function
npm install
zip -r function.zip ./*
popd

aws lambda update-function-code --function-name my-function-cli-"$AWSUSER" --zip-file fileb://level-4/function/function.zip

aws lambda invoke --function-name my-function-cli-"$AWSUSER" --cli-binary-format raw-in-base64-out --payload '{ "jokeID": "1" }' out --log-type Tail

export WORKDIR=<your work directory>
export TF_VAR_aws_user=<your AWS user name>

cp -r level-4/function $WORKDIR

pushd $WORKDIR/function
npm install
popd

pushd $WORKDIR

terraform apply

aws lambda invoke --function-name my-function-cli-"$AWSUSER" --cli-binary-format raw-in-base64-out --payload '{ "jokeID": "1" }' out --log-type Tail

popd