Using aws dynamodb with connect

Question

Pulumi · Accepted Answer

To integrate AWS DynamoDB with AWS services like AWS Lambda or AWS AppSync, you can use Pulumi's AWS provider, which offers convenient access to AWS resources. Below is a guide that will walk you through creating a DynamoDB table and connecting it with other AWS services such as a Lambda function. This example is useful if you want to implement a serverless backend, where DynamoDB acts as a persistent data store, and AWS Lambda contains business logic that reacts to database changes or HTTP requests.

First, you will define an AWS DynamoDB table. DynamoDB is a managed NoSQL database service provided by AWS that is known for its low latency and scalability.

Next, we'll set up an AWS Lambda function. Lambda functions are snippets of code that run in the cloud in response to events such as HTTP requests via Amazon API Gateway, table updates in DynamoDB, or direct invocations from SDKs or the AWS CLI.

The connection between the two can be managed with triggers in DynamoDB that invoke the Lambda function upon data modifications (insert, update, delete), or by having the Lambda function interface with the DynamoDB API to read or write data.

Let's demonstrate setting up a DynamoDB table and a Lambda function using Pulumi with TypeScript.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create a DynamoDB table
const table = new aws.dynamodb.Table("my-table", {
    attributes: [
        { name: "Id", type: "S" },
    ],
    hashKey: "Id",
    billingMode: "PROVISIONED",
    readCapacity: 1,
    writeCapacity: 1,
});

// Create an IAM Role for the Lambda function
const lambdaRole = new aws.iam.Role("lambdaRole", {
    assumeRolePolicy: {
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: {
                Service: "lambda.amazonaws.com",
            },
        }],
    },
});

// Attach the AWSLambdaBasicExecutionRole policy
const lambdaExecPolicy = new aws.iam.RolePolicyAttachment("lambdaExecPolicy", {
    role: lambdaRole,
    policyArn: "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
});

// Attach a policy to allow the Lambda function to access DynamoDB
const dynamoPolicy = new aws.iam.RolePolicy("dynamoPolicy", {
    role: lambdaRole,
    policy: {
        Version: "2012-10-17",
        Statement: [{
            Action: [
                "dynamodb:GetItem",
                "dynamodb:PutItem",
                "dynamodb:UpdateItem",
                "dynamodb:DeleteItem",
            ],
            Effect: "Allow",
            Resource: [table.arn],
        }],
    },
});

// Create the Lambda function
const lambdaFunction = new aws.lambda.Function("my-lambda", {
    runtime: aws.lambda.NodeJS12dXRuntime,
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./lambda"),
    }),
    handler: "index.handler",
    role: lambdaRole.arn,
    environment: {
        variables: {
            DYNAMODB_TABLE_NAME: table.name,
        },
    },
});

// Output the table name and Lambda function ARN
export const dynamoTableName = table.name;
export const lambdaFunctionArn = lambdaFunction.arn;
```

In this program:
- We start by importing the necessary Pulumi AWS SDK components.
- We create a DynamoDB table with a single string attribute called `Id` as the primary key.
- We need to create an IAM role that the Lambda function will assume which allows it to be invoked and to log to CloudWatch Logs. This role needs to have a trust policy that enables it to be assumed by the Lambda service.
- We attach the necessary permissions to the IAM role, allowing the Lambda function to interact with DynamoDB.
- We create the Lambda function, specifying the runtime, code location, handler, role, and an environment variable with the DynamoDB table name.
- Finally, we export the names of the created resources which will be displayed as outputs when the Pulumi program is applied.

The directory `./lambda` should contain your actual Lambda function code. The `handler` parameter specifies the function entry point; in this case, it is the `handler` function in the `index` file.

You would place the business logic within the Lambda function, such as handling API requests or processing DynamoDB stream events. When you want the Lambda function to interact with the DynamoDB table, it uses the `DYNAMODB_TABLE_NAME` environment variable to know which table to target, performing actions like getting or putting items as necessary.

Lastly, remember to replace `NodeJS12dXRuntime` with the appropriate runtime for your Lambda function if you're not using Node.js 12.x. Additionally, you will want to adjust the IAM role policies depending on the exact actions your Lambda function needs to perform on the DynamoDB table.