Using aws lambda with appmesh

Question

Pulumi · Accepted Answer

In order to integrate AWS Lambda with AWS App Mesh, you'll want to understand how these services interact. AWS App Mesh is a service mesh that provides network traffic control and observability for microservices. AWS Lambda, on the other hand, is a compute service that lets you run code without provisioning or managing servers.

To use AWS Lambda with AWS App Mesh, we will set up an App Mesh virtual node that represents a Lambda function and enables the function to receive inbound traffic from other services in the mesh. We'll also define the necessary App Mesh resources such as a mesh, a virtual router, and routes that direct traffic to our Lambda-backed virtual node.

Below you will find a program written in TypeScript using Pulumi which does the following:

AWS App Mesh Virtual Node (aws.appmesh.VirtualNode): This resource represents the AWS Lambda function in the App Mesh. It's where we connect the Lambda function with the mesh by specifying the AWS Lambda function as a backend.
AWS Lambda Function (aws.lambda.Function): This resource represents your application code that you want to execute. For demonstration purposes, we will use a basic example to represent the Lambda function code.
AWS App Mesh Mesh (aws.appmesh.Mesh): This resource represents the service mesh that manages your microservice infrastructure.
AWS App Mesh Virtual Router (aws.appmesh.VirtualRouter): This resource is responsible for routing traffic to different virtual nodes, in this case, the Lambda function.
AWS App Mesh Route (aws.appmesh.Route): Within the virtual router, this defines the routing rules to direct traffic to our Lambda-backed virtual node.
AWS Lambda Permission (aws.lambda.Permission): Grants the App Mesh service permission to invoke the Lambda function.

Let's take a look at the TypeScript code:

import * as aws from "@pulumi/aws";

// Create an AWS App Mesh
const mesh = new aws.appmesh.Mesh("myMesh", {
    // Optional configuration parameters
});

// Create an AWS Lambda function
const lambdaFunction = new aws.lambda.Function("myFunction", {
    // Assuming you have a ZIP archive for your Lambda's code
    code: new pulumi.asset.FileArchive("./path/to/your/lambda.zip"),
    handler: "index.handler",
    role: lambdaRole.arn,
    runtime: aws.lambda.Runtime.NodeJS12dX,
    // Other configuration such as environment variables, VPC configuration, etc.
});

// Create an IAM role for the Lambda function
const lambdaRole = new aws.iam.Role("lambdaRole", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: {
                Service: "lambda.amazonaws.com",
            },
        }],
    }),
});

// Create a Virtual Node for the Lambda function
const virtualNode = new aws.appmesh.VirtualNode("myLambdaNode", {
    meshName: mesh.name,
    spec: {
        backendDefaults: {
            clientPolicy: {
                tls: {
                    enforce: false,
                },
            },
        },
        backends: [
            {
                virtualService: {
                    virtualServiceName: lambdaFunction.name.apply(name => `${name}.svc.cluster.local`),
                },
            },
        ],
        serviceDiscovery: {
            awsCloudMap: {
                namespaceName: "<cloud-map-namespace>",
                serviceName: "<cloud-map-service-name>",
            },
        },
    },
});

// Create a Virtual Router
const virtualRouter = new aws.appmesh.VirtualRouter("myVirtualRouter", {
    meshName: mesh.name,
    spec: {
        listeners: [{
            portMapping: {
                port: 8080,
                protocol: "http",
            },
        }],
    },
});

// Create a Route that routes traffic to the Lambda function
const route = new aws.appmesh.Route("myRoute", {
    meshName: mesh.name,
    virtualRouterName: virtualRouter.name,
    spec: {
        httpRoute: {
            match: {
                prefix: "/", // Specify the traffic path to match
            },
            action: {
                weightedTargets: [{
                    virtualNode: virtualNode.name,
                    weight: 1,
                }],
            },
        },
    },
});

// Grant the App Mesh service permission to invoke the Lambda function
const lambdaPermission = new aws.lambda.Permission("myLambdaPermission", {
    action: "lambda:InvokeFunction",
    function: lambdaFunction.name,
    principal: "appmesh.amazonaws.com",
    // Source ARN of the App Mesh virtual node 
    sourceArn: virtualNode.arn,
});

export const appMeshName = mesh.name;
export const lambdaFunctionName = lambdaFunction.name;
export const virtualNodeName = virtualNode.name;
export const virtualRouterName = virtualRouter.name;

To break down the program:

We start by creating a service mesh called myMesh.
Then, we define a Lambda role and create our AWS Lambda function myFunction. The zip file in FileArchive should contain your Lambda function's code.
A Virtual Node myLambdaNode is created to virtually represent our Lambda function within the service mesh, which uses AWS Cloud Map service discovery. You'll need to replace <cloud-map-namespace> and <cloud-map-service-name> with your actual namespace and service name.
We then create a Virtual Router myVirtualRouter that listens to HTTP traffic on port 8080.
Inside this virtual router, we create a route myRoute that matches all traffic on the specified prefix and routes it to our Lambda-backed virtual node.
Lastly, myLambdaPermission grants the App Mesh service the necessary permissions to call our Lambda function.

The output of the code includes the names of the created App Mesh and Lambda function so they can be referenced later or monitored for status.

Remember to replace placeholder values like the ZIP file path and Cloud Map details with your actual values before running the Pulumi program.

This is just the foundational infrastructure setup. Depending on your actual application logic, you might have different requirements for routing, services you incorporate, and the complexity of the interaction between services. Always refer to the AWS documentation for more complex scenarios or additional configurations.