Blue/Green deployments on AWS Lambda using DeploymentGroup

Question

Pulumi · Accepted Answer

Blue/Green deployment is an approach to updates where the current version of the application (Blue) and the new version (Green) are run in parallel. AWS CodeDeploy is one service that facilitates blue/green deployments, by redirecting traffic between two environments according to deployment settings.

For AWS Lambda, Blue/Green deployments involve two aliases pointing to different versions of your Lambda function. Initially, all users will invoke the function via the Blue alias. When you're ready to deploy, you update the Green alias to point to the new version of your function. You then use AWS CodeDeploy to shift traffic from Blue to Green according to your chosen deployment configuration.

The following Pulumi program creates a Lambda function, aliases for Blue and Green environments, and a Deployment Group that manages the Blue/Green deployment using AWS CodeDeploy. For the sake of simplicity, this program focuses on setting up these resources and doesn't include CI/CD pipeline integration or detailed rollout configuration.

```typescript
import * as aws from "@pulumi/aws";

// Create a new IAM role that can be assumed by AWS CodeDeploy.
const role = new aws.iam.Role("lambdaExecutionRole", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "codedeploy.amazonaws.com" }),
});

// Attach the AWSLambdaBasicExecutionRole policy to the role.
// This policy includes permissions to write logs to CloudWatch.
const attachment = new aws.iam.RolePolicyAttachment("lambdaExecutionRoleAttachment", {
    role: role,
    policyArn: "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
});

// Create a new AWS Lambda function.
const lambda = new aws.lambda.Function("myLambdaFunction", {
    code: new pulumi.asset.AssetArchive({
        // Replace with the path to your Lambda function's deployment package.
        ".": new pulumi.asset.FileArchive("./function.zip"),
    }),
    role: role.arn,
    handler: "index.handler", // Replace with your handler name.
    runtime: aws.lambda.Runtime.NodeJS14dX, // Set the runtime to match your Lambda function.
});

// Create aliases for Blue and Green environments.
const blueAlias = new aws.lambda.Alias("blueAlias", {
    functionName: lambda.name,
    functionVersion: "$LATEST", // Points to the latest version.
});

const greenAlias = new aws.lambda.Alias("greenAlias", {
    functionName: lambda.name,
    functionVersion: lambda.version, // Replace with the specific new version number if needed.
});

// Create a new CodeDeploy Application for AWS Lambda deployments.
const application = new aws.codedeploy.Application("lambdaApplication", {
    computePlatform: "Lambda",
});

// Create a Deployment Group to manage Blue/Green deployments.
const deploymentGroup = new aws.codedeploy.DeploymentGroup("blueGreenDeploymentGroup", {
    appName: application.name,
    deploymentGroupName: "BlueGreenDeploymentGroup",
    deploymentConfigName: "CodeDeployDefault.LambdaAllAtOnce",
    serviceRoleArn: role.arn,
    blueGreenDeploymentConfig: {
        // Configurations for the deployment's readiness handling.
        deploymentReadyOption: {
            actionOnTimeout: "CONTINUE_DEPLOYMENT",
        },
        // Options to handle the Green fleet provision.
        greenFleetProvisioningOption: {
            action: "DISCOVER_EXISTING",
        },
        // Options to handle successful Blue instances termination after deploying Green instances.
        terminateBlueInstancesOnDeploymentSuccess: {
            action: "TERMINATE",
            terminationWaitTimeInMinutes: 5,
        },
    },
    // To shift traffic, CodeDeploy uses these function aliases.
    alias: blueAlias.name,
    triggerConfigurations: [{
        triggerName: "DeploymentTrigger",
        triggerEvents: ["DeploymentSuccess", "DeploymentFailure"],
        triggerTargetArn: pulumi.interpolate`${deploymentGroup.application.arn}`, // ARN of the SNS topic or Lambda function to notify on deployment events.
    }],
});
```

In this program:

- We create a role for AWS CodeDeploy that allows it to manage AWS Lambda functions.
- We use the IAM role created above for the Lambda function execution role with basic permissions to execute and write logs in CloudWatch.
- We define a simple AWS Lambda function pointing to a packaged Lambda deployment located in `./function.zip`.
- We create two aliases for "Blue" and "Green" environments, both pointing initially to the latest available version of Lambda.
- We set up a CodeDeploy Application dedicated to Lambda deployments.
- We create a Deployment Group to manage the lifecycle of the deployment and configure Blue/Green settings, such as how instances are handled during the deployment. The `blueGreenDeploymentConfig` specifies the options for Blue/Green deployment behavior.

Before applying this Pulumi program, ensure you have the required Lambda function code in the `./function.zip` file and that your Pulumi environment is appropriately configured with AWS access.

To execute this program, you would use `pulumi up` from your command line after setting up Pulumi and AWS CLI with the correct configurations. The program would create or update resources in the AWS cloud as specified.

This setup is the foundation of a Blue/Green deployment for AWS Lambda using Pulumi. You can extend it with additional features such as advanced deployment strategies, integration with other AWS services, and CI/CD pipeline automation as needed for your use case.