Subscribing Lambda to SQS for processing messages

Question

Pulumi · Accepted Answer

To create an AWS Lambda function and subscribe it to an Amazon Simple Queue Service (SQS) for processing messages, you'll need to use several Pulumi resources:

**Resources you'll be using:**
1. [`aws.sqs.Queue`](https://www.pulumi.com/registry/packages/aws/api-docs/sqs/queue/): To create an SQS queue that will hold the messages to be processed.
2. [`aws.lambda.Function`](https://www.pulumi.com/registry/packages/aws/api-docs/lambda/function/): To create a Lambda function that will be triggered to process messages.
3. [`aws.iam.Role`](https://www.pulumi.com/registry/packages/aws/api-docs/iam/role/): To create an IAM role that the Lambda function will assume when it's executed. This role specifies the permissions that the function has.
4. [`aws.iam.RolePolicyAttachment`](https://www.pulumi.com/registry/packages/aws/api-docs/iam/rolepolicyattachment/): To attach the necessary AWS managed policies to the role for the Lambda function. For example, policies that allow reading from SQS queues.
5. [`aws.lambda.EventSourceMapping`](https://www.pulumi.com/registry/packages/aws/api-docs/lambda/eventsourcemapping/): To make a connection between the SQS queue and the Lambda function so that the function is triggered when messages are available in the queue.

**Procedure:**
1. Define the IAM role and attach the necessary AWS managed policies to allow the Lambda function to access the SQS queue.
2. Create the SQS queue where messages will be published.
3. Create the Lambda function with the IAM role. The code of the Lambda function will handle the messages received from the SQS queue.
4. Set up the event source mapping between the SQS queue and the Lambda function. When a message is sent to the SQS queue, the Lambda function will be triggered and the message will be passed to the function for processing.

Here is the TypeScript program that accomplishes these tasks:

```typescript
import * as pulumi from '@pulumi/pulumi';
import * as aws from '@pulumi/aws';

// Create an AWS IAM Role for the Lambda function
const lambdaRole = new aws.iam.Role('my-lambda-role', {
    assumeRolePolicy: { // Define the policy that grants an entity permission to assume the role
        Version: '2012-10-17',
        Statement: [{
            Action: 'sts:AssumeRole',
            Principal: {
                Service: 'lambda.amazonaws.com',
            },
            Effect: 'Allow',
            Sid: '',
        }],
    },
});

// Attach the AWS managed policy for Lambda execution to the role
const lambdaPolicyAttachment = new aws.iam.RolePolicyAttachment('my-lambda-policy-attachment', {
    role: lambdaRole.name,
    policyArn: 'arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole',
});

// Create an SQS queue
const queue = new aws.sqs.Queue('my-queue', {
    delaySeconds: 10,
    maxMessageSize: 1024,
});

// Create a Lambda function
const lambda = new aws.lambda.Function('my-lambda', {
    code: new pulumi.asset.AssetArchive({
        // Assuming you have a file named 'lambda.zip' with your code package
        '.': new pulumi.asset.FileArchive('./lambda.zip'),
    }),
    role: lambdaRole.arn, // Role that the function will assume
    handler: 'index.handler', // Filename.handler method
    runtime: aws.lambda.NodeJS12dXRuntime,
});

// Create an event source mapping to connect the SQS queue to the Lambda function
const eventSourceMapping = new aws.lambda.EventSourceMapping('my-event-source-mapping', {
    eventSourceArn: queue.arn, // The ARN of the SQS queue
    functionName: lambda.name, // Name of the Lambda function
    batchSize: 10, // Number of items to process from SQS at once
    enabled: true,
});

// Export the name of the queue and the ARN of the Lambda function
export const queueName = queue.name;
export const lambdaArn = lambda.arn;
```

This program creates a message processing pipeline with AWS Lambda and SQS using Pulumi and AWS SDK for JavaScript (Node.js).

**How it works:**
It starts by creating an IAM role and attaching the AWSLambdaBasicExecutionRole policy to it, which grants the minimum permissions needed to execute the Lambda function. Then, it creates an SQS queue called `my-queue`. Next, it defines a Lambda function entitled `my-lambda`, whose code is assumed to be in a zip file located at `./lambda.zip`. Finally, it sets up an `EventSourceMapping` resource, which is the glue that connects the SQS queue to trigger the Lambda function whenever new messages are present.

The `queueName` and `lambdaArn` are exported at the end of the code, which lets you easily identify and refer to these resources outside of Pulumi.

Remember to replace the `./lambda.zip` with the actual path to your Lambda function's deployment package and adjust the `index.handler` to match your handler settings.

Save this code in a file, for example `index.ts`, and then deploy it using the Pulumi CLI. It will set up your serverless message processing application on AWS.