{"id":557,"date":"2018-04-11T00:28:43","date_gmt":"2018-04-10T16:28:43","guid":{"rendered":"https:\/\/vinta.ws\/code\/?p=557"},"modified":"2026-03-17T00:17:24","modified_gmt":"2026-03-16T16:17:24","slug":"apex-and-terraform-the-easiest-way-to-manage-aws-lambda-functions","status":"publish","type":"post","link":"https:\/\/vinta.ws\/code\/apex-and-terraform-the-easiest-way-to-manage-aws-lambda-functions.html","title":{"rendered":"Apex and Terraform: The easiest way to manage AWS Lambda functions"},"content":{"rendered":"

AWS Lambda lets you run code without provisioning or managing servers, which is so-called Serverless or Function as a Service (FaaS).<\/p>\n

Apex is a Go command-line tool to manage and deploy your serverless functions on AWS Lambda. Apex is also integrated with Terraform to provide cloud infrastructure management, for instance, configuring your AWS Lambda functions with Amazon API Gateway.<\/p>\n

ref:
\nhttps:\/\/aws.amazon.com\/lambda\/<\/a>
\nhttps:\/\/aws.amazon.com\/api-gateway\/<\/a>
\nhttps:\/\/github.com\/apex\/apex<\/a><\/p>\n

You could browse projects created in this post on GitHub:
\nhttps:\/\/github.com\/vinta\/pangu.space<\/a>
\nhttps:\/\/github.com\/CodeTengu\/LambdaBaku<\/a><\/p>\n

Install<\/h2>\n
$ curl https:\/\/raw.githubusercontent.com\/apex\/apex\/master\/install.sh | sh<\/code><\/pre>\n
ref:
\nhttps:\/\/apex.run\/#installation<\/a><\/p>\n
Initialize<\/h2>\n
It is recommended to configure your AWS credentials with awscli<\/code>.<\/p>\n
$ pip install awscli\n$ aws configure<\/code><\/pre>\n
ref:
\nhttps:\/\/docs.aws.amazon.com\/cli\/latest\/userguide\/cli-chap-getting-started.html<\/a><\/p>\n
To use Apex to manage Lambda functions, you have to make sure your AWS credential has minimum IAM permissions:<\/p>\n
{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Action\": [\n        \"iam:CreateRole\",\n        \"iam:CreatePolicy\",\n        \"iam:AttachRolePolicy\",\n        \"iam:PassRole\",\n        \"lambda:GetFunction\",\n        \"lambda:ListFunctions\",\n        \"lambda:CreateFunction\",\n        \"lambda:DeleteFunction\",\n        \"lambda:InvokeFunction\",\n        \"lambda:GetFunctionConfiguration\",\n        \"lambda:UpdateFunctionConfiguration\",\n        \"lambda:UpdateFunctionCode\",\n        \"lambda:CreateAlias\",\n        \"lambda:UpdateAlias\",\n        \"lambda:GetAlias\",\n        \"lambda:ListAliases\",\n        \"lambda:ListVersionsByFunction\",\n        \"logs:FilterLogEvents\",\n        \"cloudwatch:GetMetricStatistics\"\n      ],\n      \"Effect\": \"Allow\",\n      \"Resource\": \"*\"\n    }\n  ]\n}<\/code><\/pre>\n
$ apex init<\/code><\/pre>\n
ref:
\nhttps:\/\/apex.run\/#getting-started<\/a><\/p>\n
After running apex init<\/code>, Apex creates a Role and a Policy. You should be able to find them on AWS IAM Management Console. If you want to access other AWS resources, for instance, S3 buckets, DynamoDB tables, SNS,  in your Lambda functions, you must create a new Policy which grants appropriate permissions and attaches itself to the Role that Apex created.<\/p>\n
Here is a Policy example of operating certain DynamoDB tables:<\/p>\n
{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"Stmt123456789\",\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"dynamodb:*\"\n            ],\n            \"Resource\": [\n                \"arn:aws:dynamodb:ap-northeast-1:123456789:table\/CodeTengu_Preference\",\n                \"arn:aws:dynamodb:ap-northeast-1:123456789:table\/CodeTengu_Preference\/*\",\n                \"arn:aws:dynamodb:ap-northeast-1:123456789:table\/CodeTengu_WeeklyIssue\",\n                \"arn:aws:dynamodb:ap-northeast-1:123456789:table\/CodeTengu_WeeklyIssue\/*\",\n                \"arn:aws:dynamodb:ap-northeast-1:123456789:table\/CodeTengu_WeeklyPost\",\n                \"arn:aws:dynamodb:ap-northeast-1:123456789:table\/CodeTengu_WeeklyPost\/*\"\n            ]\n        }\n    ]\n}<\/code><\/pre>\n
Write Lambda Functions<\/h2>\n
ref:
\nhttps:\/\/docs.aws.amazon.com\/lambda\/latest\/dg\/current-supported-versions.html<\/a>
\nhttps:\/\/docs.aws.amazon.com\/lambda\/latest\/dg\/best-practices.html<\/a><\/p>\n
Node.js<\/h3>\n
The simplest handler:<\/p>\n
const aws = require('aws-sdk');\n\nexports.handle = (event, context, callback) => {\n  doYourShit();\n  callback(null, 'DONE');\n};<\/code><\/pre>\n
ref:
\nhttps:\/\/docs.aws.amazon.com\/lambda\/latest\/dg\/programming-model.html<\/a><\/p>\n
Call another Lambda function in a Lambda function:<\/p>\n
You must make sure your Lambda role has the permission of invoking other Lambda functions.<\/p>\n
const util = require('util');\n\nconst aws = require('aws-sdk');\n\nconst params = {\n  FunctionName: 'LambdaBaku_syncIssue',\n  InvocationType: 'Event', \/\/ means asynchronous execution\n  Payload: JSON.stringify({ issue_number: curatedIssue.number }),\n};\n\nlambda.invoke(params, (err, data) => {\n  if (err) {\n    console.log('FAIL', params);\n    console.log(util.inspect(err));\n  } else {\n    console.log(data);\n  }\n});<\/code><\/pre>\n
ref:
\nhttps:\/\/docs.aws.amazon.com\/AWSJavaScriptSDK\/latest\/AWS\/Lambda.html<\/a>
\nhttps:\/\/stackoverflow.com\/questions\/31714788\/can-an-aws-lambda-function-call-another<\/a><\/p>\n
Go<\/h3>\n
Write a Lambda function triggered by Amazon API Gateway:<\/p>\n
package main\n\nimport (\n    \"encoding\/json\"\n    \"errors\"\n    \"log\"\n\n    \"github.com\/aws\/aws-lambda-go\/events\"\n    \"github.com\/aws\/aws-lambda-go\/lambda\"\n    \"github.com\/vinta\/pangu\"\n)\n\nvar (\n    \/\/ ErrTextNotProvided is thrown when text is not provided in HTTP query string\n    ErrTextNotProvided = errors.New(\"No text was provided in HTTP query string\")\n)\n\n\/\/ Handler is the AWS Lambda function handler\nfunc Handler(request events.APIGatewayProxyRequest) (events.APIGatewayProxyResponse, error) {\n    log.Printf(\"request id: %sn\", request.RequestContext.RequestID)\n\n    text, ok := request.QueryStringParameters[\"t\"]\n    if !ok {\n        errMap := map[string]string{\n            \"message\": ErrTextNotProvided.Error(),\n        }\n        errMapJSON, _ := json.MarshalIndent(errMap, \"\", \" \")\n\n        return events.APIGatewayProxyResponse{\n            Body: string(errMapJSON),\n            StatusCode: 400,\n        }, nil\n    }\n\n    log.Printf(\"text: %sn\", text)\n\n    textPlainHeaders := map[string]string{\n        \"content-type\": \"text\/plain; charset=utf-8\",\n    }\n\n    return events.APIGatewayProxyResponse{\n        Body: pangu.SpacingText(text),\n        Headers: textPlainHeaders,\n        StatusCode: 200,\n    }, nil\n}\n\nfunc main() {\n    lambda.Start(Handler)\n}<\/code><\/pre>\n
ref:
\nhttps:\/\/aws.amazon.com\/blogs\/compute\/announcing-go-support-for-aws-lambda\/<\/a>
\nhttps:\/\/docs.aws.amazon.com\/lambda\/latest\/dg\/go-programming-model-handler-types.html<\/a>
\nhttps:\/\/docs.aws.amazon.com\/lambda\/latest\/dg\/go-programming-model-errors.html<\/a><\/p>\n
Your "Integration Request" configurations in API Gateway should be like:<\/p>\n