DEV Community: Wesley Cheek

Deploy a Cognito Secured WebSocket API with AWS CDK

Wesley Cheek — Fri, 08 Mar 2024 07:12:09 +0000

API Gateway is great for knitting together serverless application, but have you ever wanted a little more? WebSocket APIs offer many benefits by allowing active two-way communication between your clients and backend. Consider a WebSocket API when building real-time apps.

This post will show you how to deploy a WebSocket API that is secured using AWS Cognito. Clients can connect to the WebSocket by using the idToken retrieved from Cognito after a successful login. This post is heavily inspired by this AWS sample and this dev.to article. I have simplified the code and refactored it a bit for my own purposes and understanding.

Let's start by creating our Auth backend. We create a Cognito UserPool and a Cognito UserPool Client:

import {
  aws_cognito as cognito,
  RemovalPolicy,
} from "aws-cdk-lib";
import { Construct } from "constructs";

export class Auth extends Construct {
  userPool: cognito.UserPool;
  userPoolClient: cognito.UserPoolClient;

  constructor(scope: Construct, id: string) {
    super(scope, id);
    this.userPool = this._userPool();
    this.userPoolClient = this._userPoolClient(this.userPool);

  }
  _userPool(): cognito.UserPool {
    let userPool = new cognito.UserPool(this, "userPool", {
      removalPolicy: RemovalPolicy.DESTROY,
    });
    return userPool;
  }

  _userPoolClient(userPool: cognito.UserPool): cognito.UserPoolClient {
    let userPoolClient = new cognito.UserPoolClient(this, "userPoolClient", {
      userPool: userPool,
      authFlows: { userSrp: true, userPassword: true },

    });
    return userPoolClient;
  }
}

Now let's use these to associate the WebSocket $connect route with a Custom Authorizer Lambda. Follow along with the comments

import {
  aws_cognito as cognito,
  aws_apigatewayv2 as apigatewayv2,
  aws_apigatewayv2_integrations as apigatewayv2_integrations,
  aws_apigatewayv2_authorizers as apigatewayv2_auth,
  aws_lambda_nodejs as lambdaNode,
  aws_lambda as lambda,
  aws_dynamodb as dynamo,
} from "aws-cdk-lib";
import { RemovalPolicy } from "aws-cdk-lib";
import { Construct } from "constructs";
import * as path from "path";

export class API extends Construct {
  apiv2: apigatewayv2.HttpApi;
  websocket: apigatewayv2.WebSocketApi;
  constructor(
    scope: Construct,
    id: string,
  // We get these from our `Auth` construct above
    userPool: cognito.UserPool,
    userPoolClient: cognito.UserPoolClient,
  ) {
    super(scope, id);
    this.websocket = this._webSocket(userPool, userPoolClient);

  _webSocket(
    userPool: cognito.UserPool,
    userPoolClient: cognito.UserPoolClient,
  ): apigatewayv2.WebSocketApi {
// This DynamoDB table will be used to save the `connectionId` when 
// clients connect.
    const connectionIdTable = new dynamo.Table(this, "ConnectionIdTable", {
      partitionKey: { name: "connectionId", type: dynamo.AttributeType.STRING },
      timeToLiveAttribute: "removedAt",
      billingMode: dynamo.BillingMode.PAY_PER_REQUEST,
      removalPolicy: RemovalPolicy.DESTROY,
    });

// The `userId` is used to uniquely ID the connected user associated 
// with the `Cognito UserPool`. We'll use this to clean-up the 
// database upon client `disconnect`
    connectionIdTable.addGlobalSecondaryIndex({
      partitionKey: { name: "userId", type: dynamo.AttributeType.STRING },
      indexName: "userIdIndex",
    });

// This lambda function will be used to authorize the connection. 
// Upon successful connection, it will save user information into 
// the DynamoDB table
    const authHandler = new lambdaNode.NodejsFunction(this, "AuthHandler", {
      runtime: lambda.Runtime.NODEJS_18_X,
      entry: path.join(__dirname, "../lambdas/websocket/authorizer/index.ts"),
      environment: {
        USER_POOL_ID: userPool.userPoolId,
        APP_CLIENT_ID: userPoolClient.userPoolClientId,
        CONNECTION_TABLE_NAME: connectionIdTable.tableName,
      },
    });

// This lambda function will handle all routes (in our simple example)
    const websocketHandler = new lambdaNode.NodejsFunction(
      this,
      "WebSocketHandler",
      {
        runtime: lambda.Runtime.NODEJS_18_X,
        entry: path.join(__dirname, "../lambdas/websocket/handler/index.ts"),
        environment: {
          CONNECTION_TABLE_NAME: connectionIdTable.tableName,
        },
      },
    );

    connectionIdTable.grantReadWriteData(websocketHandler);
    connectionIdTable.grantReadWriteData(authHandler);

// Create the authorizer. The `identitySource` is the information we 
// need to supply when connecting to the API. `authHandler` will 
// use the `idToken` to verify the user.
    const authorizer = new apigatewayv2_auth.WebSocketLambdaAuthorizer(
      "Authorizer",
      authHandler,
      {
        identitySource: ["route.request.querystring.idToken"],
      },
    );

// Now create our WebSocket.
    let apiv2Websocket = new apigatewayv2.WebSocketApi(
      this,
      "knowledgeBaseWebSocket",
      {
        description: "Used by your serverless app to integrate services",
// On the `$connect` route, specify our authorizer. When connecting, 
// traffic will go through the authorizer before being routed 
// to the `websocketHandler` integration.
        connectRouteOptions: {
          authorizer,
          integration: new apigatewayv2_integrations.WebSocketLambdaIntegration(
            "ConnectIntegration",
            websocketHandler,
          ),
        },
        disconnectRouteOptions: {
          integration: new apigatewayv2_integrations.WebSocketLambdaIntegration(
            "DisconnectIntegration",
            websocketHandler,
          ),
        },
// For this sample example, route all traffic through the `websocketHandler`
        defaultRouteOptions: {
          integration: new apigatewayv2_integrations.WebSocketLambdaIntegration(
            "DefaultIntegration",
            websocketHandler,
          ),
        },
      },
    );

// You need to manually add the stage.
    new apigatewayv2.WebSocketStage(this, "dev", {
      webSocketApi: apiv2Websocket,
      stageName: "dev",
      autoDeploy: true,
    });

// Be sure to grant the `websocketHandler` permission to manage 
// the WebSocket connection.
    apiv2Websocket.grantManageConnections(websocketHandler);

    return apiv2Websocket;
  }
}

OKAY! Now what about the authHandler and websocketHandler functions?

// `authHandler`
import { APIGatewayRequestAuthorizerHandler } from "aws-lambda";
import { CognitoJwtVerifier } from "aws-jwt-verify";
import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
import { DynamoDBDocumentClient, PutCommand } from "@aws-sdk/lib-dynamodb";
import { CognitoIdTokenPayload } from "aws-jwt-verify/jwt-model";

const UserPoolId = process.env.USER_POOL_ID!;
const AppClientId = process.env.APP_CLIENT_ID!;

const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
const ConnectionTableName = process.env.CONNECTION_TABLE_NAME!;

export const handler: APIGatewayRequestAuthorizerHandler = async (
  event,
  _context,
) => {
  try {
// We will use the CognitoJwtVerifier to verify that the `idToken` 
// supplied by the client is indeed associated with our `UserPool`
    const verifier = CognitoJwtVerifier.create({
      userPoolId: UserPoolId,
      tokenUse: "id",
      clientId: AppClientId,
    });

    const connectionId = event.requestContext.connectionId!;
    const encodedToken = event.queryStringParameters!.idToken!;
    const payload = await verifier.verify(encodedToken);

// Successfully Authenticated!
    console.log("Token is valid. Payload:", payload);
// Save the session information to the DynamoDB table
    await saveSession(payload, connectionId);
    console.log("User information saved to database!");
// Now return a policy which allows the client to connect!
    return allowPolicy(event.methodArn, payload);
  } catch (error: any) {
    console.log(error.message);
    return denyAllPolicy();
  }
};

async function saveSession(
  payload: CognitoIdTokenPayload,
  connectionId: string,
) {
  try {
    await client.send(
      new PutCommand({
        TableName: ConnectionTableName,
        Item: {
          userName: payload["cognito:username"] ?? "",
          userGroups: payload["cognito:groups"] ?? "",
          userEmail: payload["email"] ?? "",
          userId: payload.sub,
          connectionId: connectionId,
          removedAt: Math.ceil(Date.now() / 1000) + 3600 * 3,
        },
      }),
    );
  } catch (err) {
    console.error(err);
  }
}

function allowPolicy(methodArn: string, idToken: any) {
  return {
    principalId: idToken.sub,
    policyDocument: {
      Version: "2012-10-17",
      Statement: [
        {
          Action: "execute-api:Invoke",
          Effect: "Allow",
          Resource: methodArn,
        },
      ],
    },
    context: {
      // set userId in the context
      userId: idToken.sub,
    },
  };
}

function denyAllPolicy() {
  return {
    principalId: "*",
    policyDocument: {
      Version: "2012-10-17",
      Statement: [
        {
          Action: "*",
          Effect: "Deny",
          Resource: "*",
        },
      ],
    },
  };
}

Once the client is authenticated, the connection request is routed to the websocketHandler function:

// `websocketHandler`
import { APIGatewayProxyHandler } from "aws-lambda";
import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
import { DeleteCommand, DynamoDBDocumentClient } from "@aws-sdk/lib-dynamodb";
import {
  ApiGatewayManagementApiClient,
  PostToConnectionCommand,
} from "@aws-sdk/client-apigatewaymanagementapi";

const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
const ConnectionTableName = process.env.CONNECTION_TABLE_NAME!;

export const handler: APIGatewayProxyHandler = async (event, _context) => {
  console.log(event);
  const routeKey = event.requestContext.routeKey!;
  const connectionId = event.requestContext.connectionId!;

// If the route is `$connect` go ahead and connect
  if (routeKey == "$connect") {
    return { statusCode: 200, body: "Connected." };
  }
// If `$disconnect`
  if (routeKey == "$disconnect") {
    try {
// This function will delete the connection information from the 
// DynamoDB table when you disconnect.
      await removeConnectionId(connectionId);
      return { statusCode: 200, body: "Disconnected." };
    } catch (err) {
      console.error(err);
      return { statusCode: 500, body: "Disconnection failed." };
    }
// Default route for any other requests
  } else {
// Just echo back messages in other route than connect, disconnect 
// (for testing purpose)
    const domainName = event.requestContext.domainName!;
// When we use a custom domain, we don't need to append a stage name
    const endpoint = domainName.endsWith("amazonaws.com")
      ? `https://${event.requestContext.domainName}/${event.requestContext.stage}`
      : `https://${event.requestContext.domainName}`;

// Now let's send a message from the WebSocket back to the client!
    const managementApi = new ApiGatewayManagementApiClient({
      endpoint,
    });

    try {
// This is where the message gets sent back to client. This example 
// just echos the event body. So if we connect and just send RAW text, 
// the WebSocket will send back the same RAW text.
      await managementApi.send(
        new PostToConnectionCommand({
          ConnectionId: connectionId,
          Data: Buffer.from(
            JSON.stringify({
              message: event.body,
            }),
            "utf-8",
          ),
        }),
      );
    } catch (e: any) {
      if (e.statusCode == 410) {
        await removeConnectionId(connectionId);
      } else {
        console.log(e);
        throw e;
      }
    }

    return { statusCode: 200, body: "Received." };
  }
};

const removeConnectionId = async (connectionId: string) => {
  return await client.send(
    new DeleteCommand({
      TableName: ConnectionTableName,
      Key: {
        connectionId,
      },
    }),
  );
};

Hope somebody found this useful! In the end probably using the already established IAM authorizer is more simple, but if you are looking to use your Cognito login credentials, then this example should help!

Cheap & Easy AWS FTP Server with EC2 and S3

Wesley Cheek — Wed, 20 Dec 2023 00:18:10 +0000

The github repository for this project is here!.

Introduction

Using AWS CDK we can quickly deploy a small EC2 Instance to act as an FTP Server with an unlimited S3 storage backend.

With an hourly rate of only $0.0058 (us-east-1), t2-nano is sufficient for running a small FTP server with the S3 integration!

The server is configured on deploy using EC2 UserData. mount-s3 is used for mounting an S3 bucket to your instance. We start up VSFTPD, set up a virtual user in the same directory as our mounted S3 bucket, and we have our end-to-end FTP solution!

Architecture

A user connects to the instance with the instance's Public IP or DNS.
The user agrees to use the server's TLS certificate.
A secure FTPS connection is made and the user can freely work with the files on the S3 bucket.

CDK Structure

You'll find the code for the stack in lib/ftp-server-stack.ts. It uses four
custom Constructs:

VPCStuff creates a simple VPC with no NAT Gateways since they aren't necessary and we want to save on cost (NAT Gateways are expensive!)
StorageStuff creates a bucket to persist data from the FTP server. It's set to automatically delete data and remove itself on cdk destroy.
SecurityStuff creates an IAM Role with permissions to read and write to the FTP bucket and access the Secret that stores the password for the ftpUser account we will create on the EC2 instance. SecurityStuff also creates an EC2 Security Group inside our VPC which allows SSH and FTP access into the EC2 instance. Additionally, we open ports which will be used for the data connection with VSFTPD
Finally, ec2InstanceStuff creates and configures the EC2 instance. The instance is based on Amazon Linux 2

The EC2 instance Public IP and the FTP Bucket name gets output upon successful deploy.

Method

AWS CDK is used to synthesize the CloudFormation template that will deploy our architecture and also configure the server.

We configure the EC2 instance using EC2 UserData stored as a bash script in lib/ec2-setup.sh. We also use CloudFormationInit to store a slightly customized vsftpd.conf file.

Things you need to do yourself

Make a secret on AWS Secrets Manager for your ftp user password. You'll use this when connecting to the server.
Fix references to your secret. I named by secret "ftpUser_Password". You'll find references to this in the ec2InstanceStuff and securityStuff constructs in lib/ftp-server-stack.ts
Create a Key Pair using the AWS EC2 Console. You'll need this to access the instance by SSH.
Fix references to the Key Pair. I've named mine "RiceCooker_FTP_Server" - this needs to match the Key Pair that you just made.
Copy the repo and cdk deploy!

Conclusion

In researching this solution I ran into many different ways people were trying to make an affordable FTP server. Some used ECS, others were deploying docker containers onto an EC2 instance (main inspiration). I always prefer a repeatable approach using CDK, so I combined a number of these posts into something that is easy for anyone to deploy.

I hope you found this useful - let me know!

Python AWS CDK Pipelines with NodeJS Dependencies

Wesley Cheek — Wed, 27 Sep 2023 04:17:04 +0000

AWS CDK Pipelines are a fantastic way to deploy your infrastructure using CI/CD practices.

The pipeline, using AWS CodeBuild and CodePipeline, can reproducibly build and deploy both your front-end and back-end applications. But how can we use Python to build the pipeline, but then deploy Lambda Functions written in JavaScript or TypeScript?

This has been a bit of a tricky problem for me, because most examples found online are for AWS CDK projects written in TypeScript. We need to add an additional step to our pipelines if we want our NodeJS Lambda Functions to get built with dependencies.

TLDR: Simply run npm i in your shell step and your dependencies detailed in your root package.json file will be available when CodeBuild is building your NodeJS functions.

With AWS CDK Pipelines, there is no need to specify dependencies in each individual function folder. Instead, specify all of them at the root of your project in a package.json file. When npm i is run in the pipeline's shell step, these dependencies become available for all of your NodeJS functions to build with.

I provide a full example below.

Let's build our stack, stage, and pipeline in Python flavored AWS CDK!

STACK WITH NODEJS LAMBDA FUNCTION

# stacks/backend_stack.py
from constructs import Construct
from aws_cdk import aws_lambda_nodejs as _lambda_nodejs
from aws_cdk import Stack

class BackendStack(Stack):
    def __init__(
        self, scope: Construct, construct_id: str, **kwargs
    ) -> None:
        super().__init__(scope, construct_id, **kwargs)

        self.backend_lambda = self.build_backend_lambda()

    def build_backend_lambda():
            """
            Example NodeJS lambda
            """
            # Here I instantiate a lambda function which is written in Javascript or Typescript. The file app.js exports a function called handler.
            backend_lambda = _lambda_nodejs.NodejsFunction(
                scope=self,
                id="backendLambda",
                runtime=_lambda.Runtime.NODEJS_16_X,  # type: ignore
                entry="lambda_funcs/backend/app.js",
                handler="handler",
            )

STAGE

# app.py
from constructs import Construct
from stacks.backend_stack import BackendStack

class BackendStage(Stage):
    def __init__(self, scope: Construct, id: str, **kwargs):
        super().__init__(scope, id, **kwargs)
        )
        self.backend = BackendStack(
            scope=self, construct_id="Backend"
        )

PIPELINE

# app.py
from aws_cdk import aws_secretsmanager as secretsmanager
from aws_cdk.aws_codebuild import (
    BuildEnvironment,
    ComputeType,
    LinuxBuildImage,
)
from aws_cdk.aws_codepipeline_actions import GitHubTrigger
from constructs import Construct

class PipelineStack(cdk.Stack):
    def __init__(
        self,
        scope: Construct,
        construct_id: str,
        **kwargs,
    ) -> None:
        super().__init__(scope, construct_id, **kwargs)
        github_secret = secretsmanager.Secret.from_secret_name_v2(
            scope=self,
            id="github_secret",
            secret_name="Github_Personal_Access_Token",
        )
        code_build = pipelines.CodeBuildOptions(
            build_environment=BuildEnvironment(
                build_image=LinuxBuildImage.STANDARD_5_0,
                compute_type=ComputeType.SMALL,
            )
        )
        # This pipeline deploys a cdk stack
        pipeline = pipelines.CodePipeline(
            scope=self,
            id="Pipeline",
            code_build_defaults=code_build,
            synth=pipelines.ShellStep(
                id="Synth",
                input=pipelines.CodePipelineSource.git_hub(
                    repo_string="USERNAME/REPOSITORY",
                    branch="dev",
                    authentication=github_secret.secret_value_from_json(
                        key="github_access_token"
                    ),
                    trigger=GitHubTrigger.WEBHOOK,
                ),
                commands=[
                    "pip install -r requirements.txt",
                    "npm i",  # This is the essential step for this article
                    "npm install -g aws-cdk",
                    "cdk synth",
                ],
            ),
            docker_enabled_for_synth=True,
        )

        pipeline.add_stage(
            BackendStage(scope=self, id="backend"),
        )

Good luck!

Lapce Typescript Support

Wesley Cheek — Thu, 21 Sep 2023 07:55:56 +0000

I've been looking for a decent alternative to VS Code for a long time. I love VS Code but let's face it: it's slow and bloated if you're not on some good hardware.

I just discovered Lapce and was immediately impressed by its potential. It's an open-source text editor fully written in Rust, it's lightning-fast, and already has some nice features out of the box like native modal-editing (vim), language features through LSP providers, decent Git support, and an integrated terminal.

I'm posting this, because for whatever reason, getting Typescript support working was a pain in the ass.

1.
Install typescript-language-server and typescript (Requires NodeJS) via npm or your system package manager:

npm i --global typescript-language-server@2 typescript
The plugin page did not specify the @2 version, may have been my problem.

Server needs to be in one of the paths included in PATH environment variable.
This turned out to not work for me, may have also been my problem.

2.
Add the TS / JS plugin to Lapce.

3.
Edit the Lapce settings file by pressing Ctrl + Alt + P and typing settings file. Add these settings to the end:

[lapce-typescript.volt]
serverPath = "C:/Users/username/AppData/Roaming/npm/typescript-language-server.cmd"
serverArgs = ["--stdio"]

Where the serverPath is going to be specific to where npm puts global installs.

Lapce is still missing a few things and it's modal support is adequate at best, but it's okay since it's still in Pre-Alpha. For the speed, I'm going to consider the lack of features a decent trade-off. I look forward to see where it goes from here!

If you try Lapce, let me know!

Python Script to Quickly Delete S3 Buckets

Wesley Cheek — Tue, 15 Nov 2022 05:50:59 +0000

I got frustrated having to empty and delete S3 buckets using the AWS Console, so I created a Python script to do it for me!

WARNING: This method bypasses all of the usual safety associated with deleting buckets with the AWS Console, so make absolutely sure you want to delete your bucket before running this script.

# Use the boto3 library to communicate with AWS
import boto3

# Buckets you want to delete, specified by their names
BUCKETS = [
    "bucket-one",
    "bucket-two",
]

s3 = boto3.resource("s3")
for bucket_name in BUCKETS:
    # For each bucket, create a resource object with boto3
    bucket = s3.Bucket(bucket_name)
    # Delete all of the objects in the bucket
    bucket.object_versions.delete()

    # Delete the bucket itself!
    bucket.delete()

Storing your data in a Plotly Dash data dashboard

Wesley Cheek — Mon, 12 Sep 2022 00:59:25 +0000

Plotly Dash is a great framework for developing interactive data dashboards using Python, R, and Javascript. It works alongside Plotly to bring your beautiful visualizations to the masses.

One problem that is oftentimes encountered when developing Dash apps is being able to pass data around your app. Luckily, this is easy to do for small datasets using the dcc.Store component. dcc.Store stores your data as a JSON object inside a user's browser.

The most common library for working with data in a data scientist's tool kit is pandas, so how can we store a pandas DataFrame in our dash app? It's easy, but there are some things to keep in mind.

1) 'special' data types aren't going to be JSON serializable. You need to convert your TimeDeltas and DateTime data types to a str or float.
2) You will lose your index information in the data conversation, so be sure to pd.DataFrame.reset_index() before you store your DataFrame

Create the data store in your app

dcc.Store can be placed anywhere in your app's layout.

from dash import dcc
def layout():
   return html.Div(
      [
      dcc.Store(id="current-data"),
      dcc.Graph(id="graph")
      ]
   )

Store a `Pandas DataFrame` using `dcc.Store`

Now to store the dataframe, you can use the pd.DataFrame.to_json() method, after resetting its index.

@callback(
    output=[Output("current-data", "data")],
)
def store_current_data():
    # Some loading from file/remote and data processing
    return [data.reset_index().to_json(orient="split")]

Access a `Pandas DataFrame` stored in `dcc.Store`

Now we can pd.read_json() to retrieve the DataFrame from the store in a different callback! Return a Plotly Figure to a dcc.Graph output to plot your data.

@callback(
    inputs=[Input("current-data", "data")],
    output=[Output("graph", "figure")]
)
def retrieve_current_data_and_plot(data):
    df = pd.read_json(orient="split")
    # You can `set_index` here to get your original index back.
    # Create plotly figure here to display our data!
    fig = ...
    return [fig]

dcc.Store is a great way to centralize data processing and allow data to be accessed across your app.

Make VS Code Faster for Python Auto-Completion

Wesley Cheek — Mon, 25 Jul 2022 03:01:00 +0000

I've always struggled with how slow Pylance IntelliSense becomes when a project gets large. It turns out that with a minor tweak, my system is super speedy again!

Try adding a pyrightconfig.json file to the root of your project. By excluding folders that you don't need to be indexing (node_modules, cdk.out, etc.) you may see a significant boost.

Here is a simple example:

{
    "include": [
        "."
    ],
    "exclude": [
        "**/node_modules",
        "**/cdk.out",
        "**/.pytest_cache",
        "**/build",
        "**/dist",
        "**/.vscode",
        "**/__pycache__",
    ],
    "reportMissingImports": true,
}

Share any other tips you have in the comments!

Securely Use Secrets In Your AWS CDK Deployed Lambda Function

Wesley Cheek — Fri, 13 May 2022 07:35:51 +0000

Have you ever needed secure access to things like login details in your Lambda functions? You might need to connect to a database or other service, but you don’t want to need to hard-code your credentials. Well, let’s use best security practices by getting our login details using AWS Secrets Manager!

I will be using Python flavored AWS CDK to deploy a Lambda function which has permissions to access a secret stored in Secrets Manager. I will also show you how to retrieve this secret securely inside your lambda function.

See the GitHub repository here.

Before getting into the CDK components, let’s create an example secret using AWS CLI:



aws secretsmanager create-secret --name secretsExample --secret-string "TestPass123"

Stack Design

cdk_lambda_secrets/cdk_lambda_secrets_stack.py

Here we build the CDK stack by creating a lambda function and giving it permission to read our secret. We can pass the name of the secret into the lambda function as an environment variable to save ourselves some repetition.



import os

from aws_cdk import Stack
from aws_cdk import aws_lambda as _lambda
from aws_cdk import aws_secretsmanager as secrets
from constructs import Construct


class CdkLambdaSecretsStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        self.build_lambda_func()

    def build_lambda_func(self):
        secret_name = "secretsExample"
        self.secrets_lambda = _lambda.Function(
            scope=self,
            id="LambdaWithSecrets",
            runtime=_lambda.Runtime.PYTHON_3_9,
            function_name="LambdaWithSecretsExample",
            code=_lambda.Code.from_asset(
                path="lambda_funcs/lambda_with_secrets"
            ),
            handler="lambda_with_secrets.handler",
            # We need these env vars to access the secret inside the lambda
            environment={
                "secret_name": secret_name,
                "secret_region": os.environ["CDK_DEFAULT_REGION"],
            },
        )
        # Grant permission to the Lambda func to access the secret
        example_secret = secrets.Secret.from_secret_name_v2(
            scope=self, id="secretExample", secret_name=secret_name
        )
        example_secret.grant_read(grantee=self.secrets_lambda)

Lambda Function

lambda_funcs/lambda_with_secrets/lambda_with_secrets.py

Here we define a lambda function with a helper function get_secrets(). This is a very slightly modified version of the ‘Sample code’ function suggested by AWS when you look at the secret in the AWS Console. Rather than use the ARN to access the secret, we can simply use the name of the secret. I found that I was unable to get the full ARN of the secret using CDK, but luckily get_secret_value() accepts the secret name for its SecretId parameter.



import base64
import json
import os

import boto3
from botocore.exceptions import ClientError


def get_secret():
    """
    Gets the secret
    """
    # Get env vars we passed in the stack.
    secret_name = os.getenv("secret_name")
    region_name = os.getenv("secret_region")

    # Create a Secrets Manager client
    session = boto3.session.Session()
    client = session.client(
        service_name="secretsmanager", region_name=region_name
    )

    # In this sample we only handle the specific exceptions for the 'GetSecretValue' API.
    # See https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
    # We rethrow the exception by default.

    try:
        # We need only the name of the secret
        get_secret_value_response = client.get_secret_value(
            SecretId=secret_name
        )
    except ClientError as e:
        if e.response["Error"]["Code"] == "DecryptionFailureException":
            # Secrets Manager can't decrypt the protected secret text using the provided KMS key.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response["Error"]["Code"] == "InternalServiceErrorException":
            # An error occurred on the server side.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response["Error"]["Code"] == "InvalidParameterException":
            # You provided an invalid value for a parameter.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response["Error"]["Code"] == "InvalidRequestException":
            # You provided a parameter value that is not valid for the current state of the resource.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        elif e.response["Error"]["Code"] == "ResourceNotFoundException":
            # We can't find the resource that you asked for.
            # Deal with the exception here, and/or rethrow at your discretion.
            raise e
        else:
            raise e
    else:
        # Decrypts secret using the associated KMS key.
        # Depending on whether the secret is a string or binary, one of these fields will be populated.
        if "SecretString" in get_secret_value_response:
            secret = get_secret_value_response["SecretString"]
            # If you have multiple secret values, you will need to json.loads(secret) here and then access the values using dict keys
            return secret
        else:
            decoded_binary_secret = base64.b64decode(
                get_secret_value_response["SecretBinary"]
            )
            return decoded_binary_secret


def handler(event, context):
    secret = get_secret()
    # Don't do this in production!!!
    return secret

cdk deploy this stack and you should have a working example.

Test the Lambda Function

The Lambda function successfully retrieved the secret value from AWS Secrets Manager!

Tear Down

To delete the secret we created:



aws secretsmanager delete-secret --secret-id secretsExample

Destroy your stack:



cdk destroy

Enjoy!

Put a Tensorflow model into production with AWS Lambda, Docker, and AWS CDK

Wesley Cheek — Fri, 22 Apr 2022 01:39:26 +0000

To allow us to deploy a Tensorflow model on Lambda, I will pull concepts together from my previous articles. This article is about deploying a model on Lambda, so I will not be talking about training the model or using it.

To build a Lambda function large enough to hold the Tensorflow library, we will need to deploy our Lambda function using a Docker container stored on ECR.
To improve prediction times, we can store our models in a filesystem attached to our Lambda function. This mostly avoids having to load the models from S3.
To get prediction results, we will use Lambda function URLs to expose an HTTPS endpoint we can query using HTTP GET (another option is to use an API Gateway).
To save and load our models, we will use Joblib.

The Github repository can be found here.

Let’s get started building our stack and function!

Stack Design

I’ve tried to make this design as minimal as possible while keeping the features we are looking for: a docker deployed Lambda function with Tensorflow installed, including an attached file system, and with an HTTPS endpoint which can be queried with an HTTP GET message.

from aws_cdk import CfnOutput as Output
from aws_cdk import CfnResource, Duration, RemovalPolicy, Stack
from aws_cdk import aws_ec2 as ec2
from aws_cdk import aws_efs as efs
from aws_cdk import aws_lambda as _lambda
from aws_cdk import aws_s3 as s3
from aws_cdk import aws_s3_deployment as s3_deployment
from constructs import Construct


class CdkTensorflowStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # Let's list all of our physical resources getting deployed
        self.vpc = None
        self.access_point = None
        self.prediction_lambda = None
        self.models_bucket = None

        # convenient deployment
        self.build_infrastructure()

    def build_infrastructure(self):
        self.build_vpc()
        self.build_filesystem()
        self.build_lambda()
        self.build_bucket()
        self.build_function_url()

    def build_vpc(self):
        # Need the VPC for the lambda filesystem
        self.vpc = ec2.Vpc(scope=self, id="VPC", vpc_name="ExampleVPC")

    def build_filesystem(self):
        file_system = efs.FileSystem(
            scope=self,
            id="ExampleEFS",
            vpc=self.vpc,
            file_system_name="ExampleEFS",
            removal_policy=RemovalPolicy.DESTROY,
        )
        # create a new access point from the filesystem
        self.access_point = file_system.add_access_point(
            "AccessPoint",
            # set /export/lambda as the root of the access point
            path="/export/lambda",
            # as /export/lambda does not exist in a new efs filesystem, the efs will create the directory with the following createAcl
            create_acl=efs.Acl(
                owner_uid="1001", owner_gid="1001", permissions="750"
            ),
            # enforce the POSIX identity so lambda function will access with this identity
            posix_user=efs.PosixUser(uid="1001", gid="1001"),
        )

    def build_lambda(self):
        self.prediction_lambda = _lambda.DockerImageFunction(
            scope=self,
            id="TensorflowLambda",
            function_name="TensorflowLambda",
            code=_lambda.DockerImageCode.from_image_asset(
                directory="lambda_funcs/TensorflowLambda"
            ),
            # I've found inferences can be made with my simple model in < 20 sec
            timeout=Duration.seconds(60 * 0.5),
            memory_size=128 * 6 * 1,  # mb
            # Attach the EFS file system
            filesystem=_lambda.FileSystem.from_efs_access_point(
                ap=self.access_point, mount_path="/mnt/models"
            )
            if self.access_point
            else None,
            # Needs to be placed in the same VPC as the EFS file system
            vpc=self.vpc,
        )

    def build_bucket(self):
        self.models_bucket = s3.Bucket(
            scope=self,
            id="ExampleModelsBucket",
            bucket_name="models-bucket",
            # These settings will make sure things get deleted when we take down the stack
            removal_policy=RemovalPolicy.DESTROY,
            auto_delete_objects=True,
        )
        # We can add files to our new bucket from a local source
        s3_deployment.BucketDeployment(
            self,
            "save_model_to_s3",
            sources=[s3_deployment.Source.asset("model_files")],
            destination_bucket=self.models_bucket,
        )
        # Make sure to give the lambda permission to retrieve the model file
        self.models_bucket.grant_read(identity=self.prediction_lambda)

    def build_function_url(self):
        # Set up the Lambda Function URL
        cfnFuncUrl = CfnResource(
            scope=self,
            id="lambdaFuncUrl",
            type="AWS::Lambda::Url",
            properties={
                "TargetFunctionArn": self.prediction_lambda.function_arn,
                "AuthType": "NONE",
                "Cors": {"AllowOrigins": ["*"]},
            },
        )

        # Give everyone permission to invoke the Function URL
        CfnResource(
            scope=self,
            id="funcURLPermission",
            type="AWS::Lambda::Permission",
            properties={
                "FunctionName": self.prediction_lambda.function_name,
                "Principal": "*",
                "Action": "lambda:InvokeFunctionUrl",
                "FunctionUrlAuthType": "NONE",
            },
        )

        # Get the Function URL as output
        Output(
            scope=self,
            id="funcURLOutput",
            value=cfnFuncUrl.get_att(attribute_name="FunctionUrl").to_string(),
        )

Lambda Function Design

cdk_tensorflow/lambda_funcs/TensorflowLambda/tensorflow_lambda.py

Again, trying to show a minimum working example. This Lambda function will try to load the model from the EFS. If it can’t be found (like on first run), it copies the model from the S3 bucket we created, saves it to EFS, and loads it again. Once we have the model loaded we can use it to make inferences. The handler will send the inference back to the client which queried it.

# import tempfile
from pathlib import Path
from typing import Tuple

import boto3
import joblib


def get_model() -> Tuple:
    """
    Gets model from EFS if exists. Otherwise load model from S3, save to EFS
    """
    local_path = Path(f"/mnt/models/model.tensorflow")
    try:
        with open(local_path, "rb") as f:
            f.seek(0)
            model = joblib.load(f)
    except FileNotFoundError:
        client = boto3.client("s3")
        # Save model to EFS
        client.download_file(
            "models-bucket",
            "model.tensorflow",
            str(local_path),
        )

        with open(local_path, "rb") as f:
            f.seek(0)
            model = joblib.load(f)

    return model


model = get_model()


def get_prediction(model, input_data):
    # Do what you need to do to feed input data to your model
    return 1
    # return output_data


def handler(event, context):
    # This is the data we get from the client query
    data = event["queryStringParameters"]["q"]
    # I pass the data as a list to the API, but it gets converted into a string.
    # This is some fancy way to get back the list from the str(list)
    split_str = data.split(",")
    formatted_data = (
        [float(split_str[0].split("[")[-1])]
        + [float(y) for y in split_str[1:-1]]
        + [float(split_str[-1].split("]")[0])]
    )
    assert isinstance(formatted_data, list)

    # Get a prediction by feeding your formatted input data into model
    prediction = get_prediction(model=model, input_data=formatted_data)
    response = {
        "isBase64Encoded": False,
        "statusCode": 200,
        "headers": {
            "Access-Control-Allow-Origin": "*",
        },
        "body": f"The predicted value is {prediction}",
    }

    return response

cdk_tensorflow/lambda_funcs/TensorflowLambda/Dockerfile

Provides build instructions to build the Lambda function.

FROM amazon/aws-lambda-python:latest

LABEL maintainer="Wesley Cheek"
RUN yum update -y && \
    yum install -y python3 python3-dev python3-pip gcc && \
    rm -Rf /var/cache/yum
COPY requirements.txt ./
RUN pip install -r requirements.txt
COPY tensorflow_lambda.py ./

CMD ["tensorflow_lambda.handler"]

cdk_tensorflow/lambda_funcs/TensorflowLambda/requirements.txt

joblib
# I use tensorflow-cpu because it's half the size of the gpu version and Lambda doesn't have a GPU anyway.
tensorflow-cpu
boto3

Deployment

We can run cdk deploy and our infrastructure will get autmatically deployed. Any files in the folder model_files will get uploaded to the s3 bucket we created. The Lambda function will be bundled using Docker and saved to ECR.

Testing & Querying the Lambda function

Testing will depend on your model. I hope I have given you enough of an outline to get started. To send data to your newly deployed lambda function, you can find the Function URL either in the outputs after CDK has finished deploying or on the AWS Lambda console.

The data shown below is "hello!" - for you it could be anything. My models would receive a list of values, for instance.

Once you’re finished make sure to cdk destroy to avoid any charges!

I hope this article has given you a good start to deploying your neural network or other machine learning algorithm with Lambda.

Lambda function with persistent file store using AWS CDK and AWS EFS

Wesley Cheek — Thu, 21 Apr 2022 04:09:01 +0000

Have you ever wanted Lambda functions to be able to save and load files locally without needing to transfer data between an S3 bucket? This article is for you.

By using AWS EFS we can attach a persistent filesystem to your Lambda function!

GitHub Repository

CDK init & deploy

I won’t cover setting up CDK and bootstrapping the environment. You can find that information here.

Once you have set up CDK, we need to set up the project:

mkdir cdk_docker_lambda && cd cdk_docker_lambda
cdk init --language python
source .venv/bin/activate
pip install -r requirements.txt && pip install -r requirements-dev.txt

Now deploy empty stack to AWS:
cdk deploy

Stack design

Our CDK stack is going to deploy an EFS filesystem, a Lambda function, and an access point which will allow us to attach the filesystem to the function.

cdk_lambda_efs/cdk_lambda_efs_stack.py

from aws_cdk import Stack
from aws_cdk import aws_ec2 as ec2
from aws_cdk import aws_efs as efs
from aws_cdk import aws_lambda as _lambda
from constructs import Construct
from aws_cdk import RemovalPolicy


class CdkLambdaEfsStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # I like to define all my pieces in __init__
        self.vpc = None
        self.access_point = None
        self.lambda_func = None

        self.build_infrastructure()

    def build_infrastructure(self):
        self.build_vpc()
        self.build_filesystem()
        self.build_lambda_func()

    def build_vpc(self):
        # Build the VPC where both EFS and Lambda will sit
        self.vpc = ec2.Vpc(self, "VPC")

    def build_filesystem(self):
        file_system = efs.FileSystem(
            scope=self,
            id="Efs",
            vpc=self.vpc,
            file_system_name="ExampleLambdaAttachedEFS",
            # Makes sure to delete EFS when stack goes down
            removal_policy=RemovalPolicy.DESTROY,
        )
        # create a new access point from the filesystem
        self.access_point = file_system.add_access_point(
            "AccessPoint",
            # set /export/lambda as the root of the access point
            path="/export/lambda",
            # as /export/lambda does not exist in a new efs filesystem, the efs will create the directory with the following createAcl
            create_acl=efs.Acl(
                owner_uid="1001", owner_gid="1001", permissions="750"
            ),
            # enforce the POSIX identity so lambda function will access with this identity
            posix_user=efs.PosixUser(uid="1001", gid="1001"),
        )

    def build_lambda_func(self):
        # I'm just using the normal CDK lambda function here. See my other articles for additional building methods.
        _lambda.Function(
            self,
            "LambdaWithEFS",
            runtime=_lambda.Runtime.PYTHON_3_9,
            # lambda function file name.handler function
            handler="lambda_EFS.handler",
            # Points to directory of lambda function
            code=_lambda.Code.from_asset("cdk_lambda_efs/lambda_EFS"),
            # Lambda needs to be in same VPC as EFS
            vpc=self.vpc,
            filesystem=_lambda.FileSystem.from_efs_access_point(
                ap=self.access_point, mount_path="/mnt/filesystem"
            ) if self.access_point else None,
        )

Lambda function

I will deploy a lambda function without any additional dependencies. If you need dependencies, you will need to use different CDK constructs to do it. Here is an example of using aws_lambda_python_alpha and here is an example of building using Docker.

This lambda function opens a file on the EFS filesystem, writes a string to it, then opens it again and returns the result.

cdk_lambda_efs/lambda_EFS/lambda_EFS.py

from pathlib import Path


def handler(event, context):
    # Writing to a file on the EFS filesystem
    path = Path("/mnt/filesystem/test.txt")
    with path.open("w") as f:
        f.write("Test123")
    # Now open the file, read the text, return
    with path.open("r") as f:
        text = f.read()
    return f"Hello Lambda! {text}"

Test the lambda function with attached filesystem

Navigate to the Lambda console on AWS. First notice the filesystem has been successfully attached to your lambda function

Now go ahead and test it using any kind of event.

I hope this article has helped you to solve your problem of lambda not persisting data. EFS is an easy to use and versatile solution to memory problems.

Make sure to cdk destroy when you're done to avoid any charges.

Deploy a Docker built Lambda function with AWS CDK

Wesley Cheek — Thu, 21 Apr 2022 02:04:54 +0000

This project is a minimum working example of deploying an AWS Lambda function using Docker and AWS CDK.

Deploying Lambda functions using Docker has a number of benefits

Package all necessary libraries into a single Docker image
Bypass AWS Lambda's size constraint of 512 mb. Docker images stored on AWS ECR have a maximum size of 10 gb. I will show you how to deploy Tensorflow models in another post!
It’s easy!

GitHub Repository

CDK init & deploy

I won’t cover setting up CDK and bootstrapping the environment. You can find that information here.

Once you have set up CDK, we need to set up the project:

mkdir cdk_docker_lambda && cd cdk_docker_lambda
cdk init --language python
source .venv/bin/activate
pip install -r requirements.txt && pip install -r requirements-dev.txt

Now deploy empty stack to AWS:
cdk deploy

Stack design

Our stack will deploy only a lambda function. The lambda function will be built using Docker, so be sure to have Docker installed and the Docker daemon running.



# cdk_docker_lambda/cdk_docker_lambda_stack.py

from aws_cdk import Stack
from aws_cdk import aws_lambda as _lambda
from constructs import Construct


class CdkDockerLambdaStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        self.build_lambda_func()

    def build_lambda_func(self):
        self.prediction_lambda = _lambda.DockerImageFunction(
            scope=self,
            id="ExampleDockerLambda",
            # Function name on AWS
            function_name="ExampleDockerLambda",
            # Use aws_cdk.aws_lambda.DockerImageCode.from_image_asset to build
            # a docker image on deployment
            code=_lambda.DockerImageCode.from_image_asset(
                # Directory relative to where you execute cdk deploy
                # contains a Dockerfile with build instructions
                directory="cdk_docker_lambda/ExampleDockerLambda"
            ),
        )

Lambda function

Create a new directory in cdk_docker_lambda called ExampleDockerLambda. Here we are going to put a Dockerfile, requirements.txt which holds our function’s dependencies, and the lambda function itself, example_docker_lambda.py

cdk_docker_lambda/ExampleDockerLambda/Dockerfile



FROM amazon/aws-lambda-python:latest

LABEL maintainer="Wesley Cheek"
# Installs python, removes cache file to make things smaller
RUN yum update -y && \
    yum install -y python3 python3-dev python3-pip gcc && \
    rm -Rf /var/cache/yum

# Copies requirements.txt file into the container
COPY requirements.txt ./
# Installs dependencies found in your requirements.txt file
RUN pip install -r requirements.txt

# Be sure to copy over the function itself!
# Goes last to take advantage of Docker caching.
COPY example_docker_lambda.py ./

# Points to the handler function of your lambda function
CMD ["example_docker_lambda.handler"]

cdk_docker_lambda/ExampleDockerLambda/requirements.txt



requests

cdk_docker_lambda/ExampleDockerLambda/example_docker_lambda.py



# Very simple

import requests

def handler(event, context):
    return "Hello Lambda!"

Now cdk deploy. AWS CDK will build your new Lambda function using Docker and then push it for you to the ECR repository that was originally created for you by running cdk bootstrap during the CDK setup. How convenient.

After the image is built and pushed, CDK will deploy the necessary infrastructure. You can navigate to the AWS CloudFormation console to view the deployment. It should only take a couple minutes.

Once finished, you will find your beautiful Docker deployed Lambda function on the Lambda console

Test your Lambda function

We can use any kind of event since the function always just returns a string.

Have fun easily deploying any sized Lambda you’d like using AWS CDK and Docker! Make sure to cdk destroy when you're done to avoid any charges.

AWS Lambda Function URLs with AWS CDK

Wesley Cheek — Tue, 19 Apr 2022 07:52:33 +0000

NOTE
Since I wrote this post, the CDK has released an API to do this, so it's no longer necessary to use custom resources like I detail below.

For the lazy:



# Can be a Function or an Alias
# fn: lambda.Function
# my_role: iam.Role


fn_url = fn.add_function_url()
fn_url.grant_invoke_url(my_role)

CfnOutput(self, "TheUrl",
    # The .url attributes will return the unique Function URL
    value=fn_url.url
)

AWS recently released a great new feature for Lambda: AWS Lambda Function URLs

Function URLs promise to replace the API Gateway Lambda Proxy pattern as they allow a simpler way to do HTTP GET operations on your Lambda functions. They also don't suffer from the API gateway timeout problem of 30 sec.

The Github repository can be found here.

CDK init & deploy

I won’t cover setting up CDK and bootstrapping the environment. You can find that information here.

Once you have set up CDK, we need to set up the project:

mkdir CDK_Lambda_URL && cd CDK_Lambda_URL
cdk init --language python
source .venv/bin/activate
Optional: If you need additional libraries in your Lambda function, add aws-cdk.aws-lambda-python-alpha to requirements.txt to allow custom builds during stack deployment using Docker.
pip install -r requirements.txt && pip install -r requirements-dev.txt

Now deploy empty stack to AWS:
cdk deploy

Stack design

This stack will deploy a lambda function using aws-lambda-python-alpha to build the function with all its additional libraries using a docker container. Make sure to have Docker installed and the daemon running before running cdk deploy.



from aws_cdk import CfnResource, Stack
from aws_cdk import aws_lambda as _lambda
from aws_cdk import aws_lambda_python_alpha as _lambda_python
from constructs import Construct


class LambdaStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # in __init__ I like to initialize the infrastructure I will be creating
        self.example_lambda = None

        self.build_infrastructure()

    def build_infrastructure(self):
        # For convenience, consolidate infrastructure construction
        self.build_lambda()

    def build_lambda(self):
        self.example_lambda = _lambda_python.PythonFunction(
            scope=self,
            id="ExampleLambda",
            # entry points to the directory
            entry="lambda_funcs/LambdaURL",
            # index is the file name
            index="URL_lambda.py",
            # handler is the function entry point name in the lambda.py file
            handler="handler",
            runtime=_lambda.Runtime.PYTHON_3_9,
            # name of function on AWS
            function_name="ExampleLambdaFunctionURL",
        )

        # Set up the Lambda Function URL
        cfnFuncUrl = CfnResource(
            scope=self,
            id="lambdaFuncUrl",
            type="AWS::Lambda::Url",
            properties={
                "TargetFunctionArn": self.example_lambda.function_arn,
                "AuthType": "NONE",
                "Cors": {"AllowOrigins": ["*"]},
            },
        )

        # Give everyone permission to invoke the Function URL
        CfnResource(
            scope=self,
            id="funcURLPermission",
            type="AWS::Lambda::Permission",
            properties={
                "FunctionName": self.example_lambda.function_name,
                "Principal": "*",
                "Action": "lambda:InvokeFunctionUrl",
                "FunctionUrlAuthType": "NONE",
            },
        )

        # Get the Function URL as output
        Output(
            scope=self,
            id="funcURLOutput",
            value=cfnFuncUrl.get_att(attribute_name="FunctionUrl").to_string(),
        )

Minimum Working Lambda Function

You can see here an example of the response format the API gateway is expecting.



from logging import getLogger

logger = getLogger()
logger.setLevel(level="DEBUG")


def handler(event, context):
    logger.debug(msg=f"Initial event: {event}")
    response = {
        "isBase64Encoded": False,
        "statusCode": 200,
        "headers": {
            "Access-Control-Allow-Origin": "*",
        },
        "body": f"Nice! You said {event['queryStringParameters']['q']}",
    }
    return response

Now you can do cdk deploy. The lambda function will be built using docker and uploaded to the bootstrapped ECR repository. Once the project is built, it will synth a CloudFormation template and begin deploying the infrastructure. You can watch your stack deploy on AWS CloudFormation - it should be quick since the infrastructure is relatively simple.

You can use the URL output by the stack or else navigate to your Lambda function on the AWS Console to find your Lambda Function URL

Query the Function URL

To query the Function URL and get a response back from your lambda function, just send a GET request using requests or Postman

That's all! Make sure to cdk destroy when you're done to avoid any charges.

DEV Community: Wesley Cheek

Deploy a Cognito Secured WebSocket API with AWS CDK

Cheap & Easy AWS FTP Server with EC2 and S3

Introduction

Architecture

CDK Structure

Method

Things you need to do yourself

Conclusion

Python AWS CDK Pipelines with NodeJS Dependencies

STACK WITH NODEJS LAMBDA FUNCTION

STAGE

PIPELINE

Lapce Typescript Support

Python Script to Quickly Delete S3 Buckets

Storing your data in a Plotly Dash data dashboard

Create the data store in your app

Store a Pandas DataFrame using dcc.Store

Access a Pandas DataFrame stored in dcc.Store

Make VS Code Faster for Python Auto-Completion

Securely Use Secrets In Your AWS CDK Deployed Lambda Function

Stack Design

Lambda Function

Test the Lambda Function

Tear Down

Put a Tensorflow model into production with AWS Lambda, Docker, and AWS CDK

Stack Design

Lambda Function Design

cdk_tensorflow/lambda_funcs/TensorflowLambda/tensorflow_lambda.py

cdk_tensorflow/lambda_funcs/TensorflowLambda/Dockerfile

cdk_tensorflow/lambda_funcs/TensorflowLambda/requirements.txt

Deployment

Testing & Querying the Lambda function

Lambda function with persistent file store using AWS CDK and AWS EFS

CDK init & deploy

Stack design

cdk_lambda_efs/cdk_lambda_efs_stack.py

Lambda function

cdk_lambda_efs/lambda_EFS/lambda_EFS.py

Test the lambda function with attached filesystem

Deploy a Docker built Lambda function with AWS CDK

CDK init & deploy

Stack design

Lambda function

cdk_docker_lambda/ExampleDockerLambda/Dockerfile

cdk_docker_lambda/ExampleDockerLambda/requirements.txt

cdk_docker_lambda/ExampleDockerLambda/example_docker_lambda.py

Test your Lambda function

AWS Lambda Function URLs with AWS CDK

CDK init & deploy

Stack design

Minimum Working Lambda Function

Query the Function URL

Store a `Pandas DataFrame` using `dcc.Store`

Access a `Pandas DataFrame` stored in `dcc.Store`