| Table of Contents |
|---|
Introduction
AWS Lambda function's code consists of scripts or compiled programs and their dependencies. We use a deployment package to deploy our function code to Lambda. Lambda supports two types of deployment packages: container images and .zip file archives. We are going to use the updateLambdaFunctionCode operation of the AWS Plugin to deploy the function code. The operation can deploy the function code from the AWS ECR, S3 Bucket, and local Archive directory. We can select the option to publish a new version, but by default the operation will not publish the a new version. Using the Environment environment variables file or Input Argument input argument, we can also add the function Environment environment variables. Operation also support The operation supports encryption of the variables using AWS KMS key. Operation The operation will use the configured AWS cloud account to perform the operation.
Objective
The goal of the this tutorial is to perform the Blue/Green deployment in AWS Lambda. We will use the function code available at S3 bucket and the Environment environment file present at the git repository, and to in a Git repository. To encrypt secured variables, we will use the AWS KMS key. The AWS plugin has updateLambdaFunctionCode, getLambdaAlias, and upsertLambdaAlias operations, and these operations we can use to perform the Blue/Green deployment in an easy way. Blue/Green Deployment is just like we deploy deploying two versions of our application, where one is the stable version, and another the other is a new feature or bug fix let’s say, (e.g. forwarding a certain percentage of traffic to the second version as well in production to ensure that everything is working fine). The Blue environment represents the currently active version of the Lambda function. In contrast, the Green environment is a development version of code where new changes are deployed and tested. Once the changes in the Green environment are verified, green Green deployment will be promoted to Blue, enabling seamless and zero-downtime deployments. With Blue/Green deployment we can test our application with real-time users, without replacing the production workload completely.
...
These are the general steps we’ll follow:
Configuring required properties e.g. Cloud account , and CLI path.
cloning Cloning the environment file from a Git repository.
create Creating an Alias alias to Maintain maintain Blue/Green Deployment. (Alias map to the stable version that is Blue)
deploy Deploying the function code with the environment variables and publish publishing a new version. (Green)
update Alias Updating alias to Map map new version (Green), weighted at some X% percent. (Blue version at (100-X)% of traffic)
Verify Verifying that the new version is healthy.
Detail of Blue/Green Deployment
Blue-Green Deployment in AWS Lambda involves two services, API Gateway and AWS Lambda, we’ll use API Gateway’s Lambda integration with an alias to shape it as Blue-Green Deployment, here Lambda Function Consists of two different but identical environments called Blue and Green respectively.
...
Zero Downtime: Blue-Green Deployment eliminates downtime during the deployment process since the switch from the blue to the green environment is instantaneous. This ensures uninterrupted service availability for users.
Fast Rollback: In case any issues or failures occur during the deployment of the new version in the green environment, rolling back to the stable version in the blue environment is quick and straightforward.
Reliable Testing: Blue-Green Deployment allows comprehensive testing of the new version in an environment that mirrors the production setup. This ensures a higher level of confidence in the stability and compatibility of the new version before directing user traffic to it and many more…
Checklist
Checklist | Description |
AWS Access Key | AWS Access Key of the user. |
AWS Secret Key | Password for the Access Key |
AWS Default Region | Default region can be set. eg. ap-south-1 |
AWS CLI Installation | AWS CLI needs to be installed where the plugin operation shall run (FlexDeploy server) |
AWS CLI in class path | AWS CLI should be added to the class path on the FlexDeploy Server. Else the path can also be set under FlexDeploy environment level property |
AWS Lambda Function | AWS Lambda Function should be already present. |
AWS KMS Key | AWS KMS key to secured the environment variable. |
AWS Alias | AWS Alias should be already present. |
AWS S3 Bucket | AWS S3 bucket, to store our function code. |
Configure Cloud Account
To connect with AWS Lambda Function, we required to configure Cloud account, with credentials details. Configure AWS Cloud Account under Integration. FlexDeploy will connect to the Lambda Function and add the environment variables.
...
After configuration we would be able to use the Cloud Account as a drop down from the list.
...
Create AWS Lambda Function
AWS Lambda is a compute service that lets you run code without provisioning or managing servers. Lambda runs your code on a high-availability compute infrastructure and performs all of the administration of the compute resources, including server and operating system maintenance, capacity provisioning and automatic scaling, and logging. With Lambda, all you need to do is supply your code in one of the language runtimes that Lambda supports. Please refer to the link for more information https://docs.aws.amazon.com/lambda/latest/dg/welcome.html
...
If we check the Environment variables details under the Configuration, there is no environment variables are present. Once successful execution of the operation we should be able to see some environment variables.
...
Create AWS KMS Key
AWS Key Management Service (AWS KMS) is a managed service that makes it easy for us to create and control the cryptographic keys that are used to protect our data. Please refer to the link for more information https://aws.amazon.com/kms/
...
We can use Key ID or Key ARN value in the project to encrypt the variables, both are accepted.
Create AWS Alias
To create or update the Lambda Alias we can use the upsertLambdaAlias operation available in the AWS plugin, please refer to the tutorial document for more information.
Create AWS S3 Bucket
Amazon Simple Storage Service (Amazon S3) is an object storage service offering industry-leading scalability, data availability, security, and performance. Customers of all sizes and industries can store and protect any amount of data for virtually any use case, such as data lakes, cloud-native applications, and mobile apps. With cost-effective storage classes and easy-to-use management features, you can optimize costs, organize data, and configure fine-tuned access controls to meet specific business, organizational, and compliance requirements.Please refer to the link for more information https://aws.amazon.com/s3/
...
We have enabled the object versioning, we can see the details about different versions.
...
Git Repository Structure
The Git repository contains the Environment file. The Sample Git repository structure is given below.
...
...
Prerequisites
Configure IAM User
To access the Lambda Function we need to create an AWS IAM account with required permissions. To create the AWS IAM user navigate to the AWS Identity and Access Management (IAM) service page, and click on the Add users option. Next assign the required permission to access the Lambda Function. Once user is created, AWS secret key can be generated, this key we have to configure in Cloud account.
For more information about IAM user please ref. IAM users - AWS Identity and Access Management
...
CLI Installation
AWS CLI should be installed in the m/c where the plugin is to be executed. Preferably add AWS CLI path in m/c classpath.
Build and Deploy Workflows
Navigate to the Workflows tab and create a workflow using the “+”(Click to create new Workflow) 
button as highlighted below.
...
Next, create Create one Build and one Deploy workflow as shown below. The workflow Type field defines the type of workflow.
Build Workflow
Navigate to the Workflows
Select the “+” button from the left-hand pane to create a new workflow
...
Deploy Workflow
navigate to the Workflows
Select the “+” button from the left-hand pane to create a new workflow
...
The Workflow Group and Subgroup define the folder hierarchy. Once both workflows are created it should look like the below. No constraint on workflow or folder naming convention.
...
The steps of the workflow execution can be configured through the Workflow Definition section.
...
Below Below given is a sample build workflow to copy the file from Git repository.
...
Step-ii: Copy the environment file
The below step will copy the environment file to the artifact. Also check the Produces Artifact option to save the files as artifact so that can be used from Deploy workflow.
...
...
Deploy Workflow
Below given is a sample workflow to deploy lambda function code from AWS S3 bucket and update already existing Alias to point the newly published version.
...
This step will deploy Lambda function code, and also publish the function version. We are setting function version variable, which we will use in upsert lambda operation.
...
In the above configuration using following Inputsstep, the following inputs are used.
Input Name | Input Code | Type | Required | Description |
Additional Arguments | FDAWS_LAMBDA_INP_ADD_ENV_VAR_ADDITIONAL_ARG | String | No | Literal key and value pairs. e.g. --region=us-east-1 And for boolean type arguments give the option without any value. e.g --publish --debug |
Environment Variables | FDAWS_LAMBDA_INP_ENV_VAR | String | No | Environment Variables in acceptable format. |
Publish new version | FDAWS_LAMBDA_INP_PUBLISH_VERSION | Boolean | No | Select to publish a new version. Default value is false. |
Step-ii: getLambdaAlias
This step will get Lambda Alias detail and set Lambda Alias current version in output, which we will use in upsert lambda operation.
...
In above configuration using following Inputs.
Input Name | Input Code | Type | Required | Value | Description | Alias Name | FDAWS_LAMBDA_INP_ALIAS_NAME|||
Alias Name | String | Yes | Prod | AWS Lambda Alias name | |||||
Alias DescriptionFDAWS_LAMBDA_INP_ALIAS_DESCR | String | No | Description of the Alias | ||||||
Alias Additional Argument | String | No |
| _INP_ALIAS_ADDITIONAL_ARGString | No
| Literal key and value pairs. e.g. --region=us-east-1 And for For boolean type arguments, give the option without any value. e.g. --publish --debug | |||
Alias Function Version | String | Yes |
| INP
| FUNCTION_VERSIONString | Yes
| Function version associated with Alias |
Project Configuration
Navigate to the Project tab and create a Project with a logical name(AWS-Deploy-Lambda-Function-Using-S3)
...
Configure the Build and Deploy workflow that has been created in previous steps as shown below.
...
Source Control
Configure the Source SCM repository under Source Control as shown below.
...
To configure Project specific Source Control one first need to navigate to the Project Configuration tab.
Next, expand the SOURCE CONTROL option from the left-hand pane.
Select the appropriate Source Control Type
Configure Source Repository. For detailed steps of Source Control configuration please refer to Configure Source Control in FlexDeploy
Project Properties
...
Lambda Function name: Name of the lambda function to deploy the code, if lambda function name is not given S3 key name will be use as function name.
...
S3 Object Version: Value of the object version, we can have multiple variants of an object. It’s optional property.
Target Properties
Select Topology from the menu and then select Targets. Select the target group and environment, provide the properties detail, according to the description.
...
Below given are the environment-specific values which need to be updated.
...
Cloud Account
The AWS Cloud account needs to be set here from the drop-down. It will show all Cloud Accounts configured under Topology, which we have already mentioned earlier.
...
CLI Path
AWS CLI path can be set as environment property, if it’s not set then by default plugin will check for CLI in system classpath.
...
Override Properties at Project Level
Let assume a scenario, where we want to change Cloud account for any specific project. Apart from setting at environment level, it can also be set at project properties by using Override Property. Please check below mentioned steps.
Navigate to the Project Configuration tab as shown above.
Next, select the PROPERTIES option from the left-hand pane.
Click on the OVERRIDE option.
Select the Cloud Account option from Property.
Select the Environment from the drop down list.
Select the Target Group from the drop down list.
...
Build and Deploy Execution
For detailed steps on how to perform build and deploy, please refer to document. Deploy through FlexDeploy for AWS plugin
After Deploy Execution
We have one Alias name as Prod and which is currently pointing to the function version 20 ( Blue deployment ), and 100% traffic is shift to this function version.
...
Once the deploy execution completed we can see that new function version is published and 20% of traffic will shift to this newly published version 21 ( Green deployment ) and remaining 80% will shift to old, stable version 20 . ( Blue deployment ).
...
API Gateway to Create API and Verify Blue/Green Deployment
Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale. APIs act as the "front door" for applications to access data, business logic, or functionality from our backend services. Using API Gateway, we can create RESTful APIs and WebSocket. We can create a web API with an HTTP endpoint for our Lambda function by using Amazon API Gateway. API Gateway provides tools for creating and documenting web APIs that route HTTP requests to Lambda functions. Resources in our API define one or more methods, such as GET or POST. Methods have an integration that routes requests to a Lambda function or another integration type. We are going to use Prod Alias to configure with API Gateway.
...