Triggering Lambda functions on Neptune configuration changes

Question

Pulumi · Accepted Answer

To trigger AWS Lambda functions based on configuration changes in Amazon Neptune, you can utilize Amazon EventBridge, which allows you to react to state changes in your AWS resources. In this scenario, you would set up an EventBridge rule that watches for Neptune configuration change events and then triggers a Lambda function in response. Here's a high-level overview followed by the TypeScript program that sets up the necessary AWS resources using Pulumi.

### Overview
1. **AWS Lambda Function**: This is the compute resource that contains your custom code. It executes when triggered by specified AWS service events, such as configuration changes in Amazon Neptune in this case.

2. **Amazon EventBridge**: It is the event bus service that listens for events from AWS services, like Amazon Neptune in this instance. When the specified event matches a rule, EventBridge relays the event to the target, which is our Lambda function.

3. **IAM Role and Policy**: Lambda functions require permissions to be executed and to interact with other AWS services. An IAM role with an attached policy providing such permissions is required.

4. **EventBridge Rule**: This rule defines the specific configuration change events for Neptune that you want to monitor, and it triggers the Lambda function when such events occur.

Here is the Pulumi program that creates these resources:

```typescript
import * as aws from "@pulumi/aws";

// Step 1: Create the IAM role and policy needed for the Lambda function to execute
const lambdaRole = new aws.iam.Role("lambdaRole", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: {
                Service: "lambda.amazonaws.com",
            },
        }],
    }),
});

const lambdaRolePolicyAttachment = new aws.iam.RolePolicyAttachment("lambdaRolePolicyAttachment", {
    role: lambdaRole.name,
    policyArn: aws.iam.ManagedPolicy.AWSLambdaBasicExecutionRole,
});

// Step 2: Create a Lambda function that you want to trigger on Neptune configuration changes
const lambdaFunction = new aws.lambda.Function("neptuneChangeHandler", {
    code: new pulumi.asset.AssetArchive({
        // Specify the path to the Lambda function's code
        ".": new pulumi.asset.FileArchive("./lambda"),
    }),
    runtime: aws.lambda.Runtime.NodeJS12dX,
    role: lambdaRole.arn,
    handler: "index.handler", // Replace with your actual handler location
});

// Step 3: Create an EventBridge rule that matches the desired Neptune change event pattern
const neptuneChangeRule = new aws.cloudwatch.EventRule("neptuneChangeRule", {
    eventPattern: JSON.stringify({
        "source": ["aws.neptune"],
        "detail-type": ["AWS API Call via CloudTrail"],
        "detail": {
            "eventSource": ["rds.amazonaws.com"],
            "eventName": [
                "ModifyDBInstance",
                "ModifyDBCluster",
                // Here you would specify any other configuration change events you're interested in
            ],
            // You can also specify additional details to filter specific resources or tags
        },
    }),
});

// Step 4: Set the Lambda function as the target for the EventBridge rule
const lambdaTarget = new aws.cloudwatch.EventTarget("lambdaTarget", {
    rule: neptuneChangeRule.name,
    arn: lambdaFunction.arn,
});

// Step 5: Grant EventBridge permission to invoke the Lambda function
const permission = new aws.lambda.Permission("lambdaPermission", {
    action: "lambda:InvokeFunction",
    function: lambdaFunction.name,
    principal: "events.amazonaws.com",
    sourceArn: neptuneChangeRule.arn,
});

// Export the Lambda function's name and ARN so you can easily locate it in the AWS console
export const lambdaFunctionName = lambdaFunction.name;
export const lambdaFunctionArn = lambdaFunction.arn;
```

This Pulumi program will do the following:

- Create an IAM role `lambdaRole` that our Lambda function can assume, with a basic execution policy attached so it can create logs in CloudWatch.
- It will then declare a `lambdaFunction` which represents your Lambda function code using Node.js 12.x runtime. You should replace `./lambda` with the path to your own zipped Lambda code and `index.handler` with the handler in your function's code.
- The `neptuneChangeRule` defines the criteria for triggering the Lambda function. It listens for Amazon CloudTrail events that are related to Amazon Neptune configuration changes.
- Once the rule is triggered, `lambdaTarget` ensures that our `lambdaFunction` receives the event.
- Lastly, `lambdaPermission` grants the necessary permissions for EventBridge to invoke our `lambdaFunction`.

With this Pulumi program, any configuration changes to Amazon Neptune that match the specified event pattern will trigger the Lambda function you've set up, allowing you to automate reactions to changes in your database configuration.