Introduction

AWS Lambda function's code consists of scripts or compiled programs and their dependencies. We use a deployment package to deploy our function code to Lambda. Lambda supports two types of deployment packages: container images and .zip file archives. We are going to use the updateLambdaFunctionCode operation to deploy the function code. The operation can deploy the function code from the AWS ECR, S3 Bucket, and local Archive directory. We can select the option to publish a new version, by default operation will not publish the new version. Using the Environment variables file or Input Argument we can also add the function Environment variables. Operation also support encryption of the variables using AWS KMS key. Operation will use the configured AWS cloud account to perform the operation.

Objective

The goal of the tutorial is to perform the deployment in AWS Lambda using the AWS ECR and the Environment file present at the git repository and to encrypt secured variables, we will use the AWS KMS key. AWS plugin has updateLambdaFunctionCode operation, we will use this operation to perform deployment in an easy way. In this tutorial, we will use the code present at the git repository to create the docker image and then we will push it to AWS ECR. We will use that newly created image in our AWS Lambda function.

• configuration of the properties e.g. Cloud account, and CLI path.

• cloning the code and environment file from the Git repository.

• create the docker image and push it to the AWS ECR registry.

• perform the deployment using the newly created image present at AWS ECR.

• verify the deployment.

Checklist

Configure Cloud Account

To connect with AWS Lambda Function, we required to configure Cloud account, with credentials details. Configure AWS Cloud Account under Integration. FlexDeploy will connect to the Lambda Function and add the environment variables.

1. Navigate to the Integrations

2. Select Cloud from the left-hand pane

3. Create a new Cloud account with the “+” button. Create a new Cloud account of provider type “AWS”

Open

It should have a AWS Access Key and AWS Secret Key. The user must have relevant access to AWS Lambda Function.

Open

1. AWS Secret Key is a password field and hence needs to be kept hidden. To update the same click on the pencil icon as shown below

2. Update the AWS Secret Key value under Secret Text. This is to make sure no one else can retrieve the password

After configuration we would be able to use the Cloud Account as a drop down from the list.

Create AWS Lambda Function

AWS Lambda is a compute service that lets you run code without provisioning or managing servers. Lambda runs your code on a high-availability compute infrastructure and performs all of the administration of the compute resources, including server and operating system maintenance, capacity provisioning and automatic scaling, and logging. With Lambda, all you need to do is supply your code in one of the language runtimes that Lambda supports. Please refer to the link for more information What is AWS Lambda? - AWS Lambda

To create the Lambda Function go to the AWS console

1. Navigate to the Services

2. Select Compute from the left-hand pane

3. Now click on the Lambda service option

After selecting the Lambda service, new window will open and it contains detail of all the functions.

Now select the create function option, it will open window to create function and configured detail.

By default AWS creates execution role with basic Lambda permissions, we can select an existing role also. In above example we are using existing role ( basic-lambda-role ) . Please refer to the link for more information IAM roles - AWS Identity and Access Management

The role which we are selecting must have basic Lambda permissions, the role we have selected also have permission for KMS key to decrypt the secured variables. If we are using the KMS key to encrypt the secured variables then we must have to give permission to the role to use the KMS key.

In above role we can see we have one permissions policy name as kms-access, this policy allow us to use the KMS key to decrypt the variables, which we have used to encrypt the variables.

Policy detail:

Trust relationships detail: ( Entities that can assume this role under specified conditions )

Detail of the AWS Lambda function which we have created and going to use for this tutorial:

If we check the Code details of the function, then we found we have sample code. We will update the code using our AWS plugin operation.

On testing the code, using the Test option provided by AWS Lambda we will get this response:

If we check the Environment variables details under the Configuration, there is no environment variables are present. Once successful execution of the operation we should be able to see some environment variables.

Create AWS KMS Key

AWS Key Management Service (AWS KMS) is a managed service that makes it easy for us to create and control the cryptographic keys that are used to protect our data. Please refer to the link for more information Encryption Cryptography Signing - AWS Key Management Service - AWS

AWS KMS key is required to encrypt the secured variables before adding them to Lambda function. If we don’t have any secured variables in that case we don’t required to configure KMS key detail in the project. In our scenario we are adding both secured and non-secured variables to the Lambda function.

To create the Lambda Function go to the AWS console

1. Navigate to the Services

2. Select Security, Identity, & Compliance from the left-hand pane

3. Now click on the Key Management Service service option

Detail of the KMS key which we are using for this tutorial:

We can use Key ID or Key ARN value in the project to encrypt the variables, both are accepted.

Create AWS ECR

Amazon Elastic Container Registry (Amazon ECR) is a managed container image registry service. Customers can use the familiar Docker CLI, or their preferred client, to push, pull, and manage images. Amazon ECR provides a secure, scalable, and reliable registry for your Docker or Open Container Initiative (OCI) images. Amazon ECR supports private repositories with resource-based permissions using IAM so that specific users or Amazon EC2 instances can access repositories and images.

To create the AWS ECR go to the AWS console

1. Navigate to the Services

2. Select Containers from the left-hand pane

3. Now click on the Elastic Container Registry service option

After selecting the Elastic Container Registry service, new window will open and it contains detail of all the ECR details.

Now select the create repository option, it will open window to create repository and configured details.

We can see the details of ECR registry.

Configure Container Account

Configure AWS Container Account under Topology. FlexDeploy will connect to the AWS private container registry and push the image.

1. Navigate to the Integrations from the Menu.

2. Navigate to the Containers tab under the Integrations.

3. Create a new Containers account with the “+” button. Create a new Docker Registry account of provider type “DockerRegistry”

It should have a Registry Address, Registry User, and Registry Token/Password configured in it.

To push image to AWS private container registry, the IAM user at least have permission of AmazonEC2ContainerRegistryPowerUser.

1. Docker Registry Token/password needs to be kept hidden. To update the same click on the pencil icon as shown below

2. next update the AWS IAM user key under Secret Text. This is to make sure no one else can retrieve the password

Git Repository Structure

The Git repository should be a docker based application. Dockerfile should be present in application to build the image and environment variables file to add the variables.

The Sample Git repository structure is given below:

Pre-requisite

Configure IAM User

To access the Lambda Function we need to create an AWS IAM account with required permissions. To create the AWS IAM user navigate to the AWS Identity and Access Management (IAM) service page, and click on the Add users option. Next assign the required permission to access the Lambda Function. Once user is created, AWS secret key can be generated, this key we have to configure in Cloud account.

For more information about IAM user please ref. IAM users - AWS Identity and Access Management

CLI Installation

• AWS CLI should be installed in the m/c where the plugin is to be executed. Preferably add AWS CLI path in m/c classpath.

Build and Deploy Workflows

Navigate to Workflows and create a workflow using the button as highlighted below.

Create one Build and one Deploy workflow.

Build Workflow

Below given is a sample build workflow to copy the file from Git repository.

Step-i: Clone Git Repository
This step will clone the Git repository codebase into the project execution working directory. The Git URL will be retrieved from Source Control configured under Project Configuration.

Step-ii: Copy the environment file
The below step will copy the environment file to the artifact. Also check the Produces Artifact option to save the files as artifact so that can be used from Deploy workflow.

Deploy Workflow

Below given is a sample workflow to build and push image to AWS ECR and then use this Image to update Lambda function code.

Step-i: Clone Git Repository

This step will clone the Git repository codebase into the project execution working directory. The Git URL will be retrieved from Source Control configured under Project Configuration.

Step-ii: Build and Push the docker image to AWS private container registry

Below given is the Docker plugin(buildImage operation) configurations. The below step will build and push docker image to AWS private container registry.

The plugin operation by default would look for the Dockerfile under TEMP directory. In case the same exist in some other folder, relative path has to be specified from TEMP directory.

Step-iii: updateLambdaFunctionCode

This step will deploy Lambda function code, and also publish the function version. We are setting function version variable, which we will use in upsert lambda operation.

The above step uses the following Inputs.

Project Configuration

Navigate to the Project tab and create a Project with a logical name(AWS Deploy Lambda Function Using AWS ECR)

Configure the Build and Deploy workflow that has been created in previous steps as shown below.

Source Control

Configure the Source SCM repository under Source Control as shown below.

1. To configure Project specific Source Control one first need to navigate to the Project Configuration tab.

2. Next, expand the SOURCE CONTROL option from the left-hand pane.

3. Select the appropriate Source Control Type

4. Configure Source Repository. For detailed steps of Source Control configuration please refer to Configure Source Control in FlexDeployProject Properties

Project Properties

Lambda Function name: Name of the lambda function to deploy the code, if lambda function name is not given S3 key name will be use as function name.

Environment Variable File Path: Path of the file which contains list of the environment variables.

Please refer to the document for more details about Lambda function name and Environment Variable File path . AWS Lambda - Environment Variable File and zip File location options

KMS detail: Key Id or Key ARN details, both are accepted. Please refer to the document for more details. AWS Key Management Service - AWS Key Management Service

URI of a container Image: URI of a container image in the Amazon ECR registry.

Docker Image Name: The name of the docker image, including the repository if desired. i.e. foo/bar or bar.

Docker Image Tag: The tag of the docker image. For example: 1.2.3.

Target Properties

Select Topology from the menu and then select Targets. Select the target group and environment, provide the properties detail, according to the description.

Below given are the environment-specific values which need to be updated.

Cloud Account

The AWS Cloud account needs to be set here from the drop-down. It will show all Cloud Accounts configured under Topology, which we have already mentioned earlier.

CLI Path

AWS CLI path can be set as environment property, if it’s not set then by default plugin will check for CLI in system classpath.

Override Properties at Project Level

Let assume a scenario, where we want to change Cloud account for any specific project. Apart from setting at environment level, it can also be set at project properties by using Override Property. Please check below mentioned steps.

1. Navigate to the Project Configuration tab as shown above.

2. Next, select the PROPERTIES option from the left-hand pane.

3. Click on the OVERRIDE option.

4. Select the Cloud Account option from Property.

5. Select the Environment from the drop down list.

6. Select the Target Group from the drop down list.

Build and Deploy Execution

For detailed steps on how to perform build and deploy, please refer to document. Deploy through FlexDeploy for AWS plugin

After Deploy Execution

Once the build and push image operation is done, we can see the details in the ECR registry.

Using the above image the deploy operation is executed, we can see the details of the image in the AWS console.

We can verify the deploy version from the plugin output and AWS console.

Container Image Settings

The following are common container image settings.

• ENTRYPOINT – Specifies the absolute path to the entry point of the application.

• CMD – Specifies parameters that we want to pass in with ENTRYPOINT.

• WORKDIR – Specifies the absolute path to the working directory.

• ENV – Specifies an environment variable for the Lambda function.

For more information about how Docker uses the container image settings, see ENTRYPOINT in the Dockerfile reference on the Docker Docs website. For more information about using ENTRYPOINT and CMD, see Demystifying ENTRYPOINT and CMD in Docker on the AWS Open Source Blog. We can override these configurations using the addLambdaEnvironmentVariables operation.

Example to override Image configuration using the addLambdaEnvironmentVariables operation.

Check Image Configuration information from the AWS console.

Please refer to the link for more information about docker cmd and entrypoint Docker CMD VS Entrypoint commands: What's the difference?