lambroll

repository·v1·Indexed 19 days ago

https://github.com/fujiwara/lambroll

A lightweight deployment tool for AWS Lambda focused on managing function code, configuration, versions, and aliases. It complements infrastructure-as-code tools by handling the Lambda function lifecycle, including creating functions, deploying zip archives or container images, rolling back to previous versions, invoking functions with payloads, and comparing local and remote configurations via diffs.

Tokens
19.5K
Snippets
82
Records
93
Agent score
66%

What's inside lambroll

  1. Overview of lambroll

    v1

    lambroll is a deployment tool specifically designed for AWS Lambda functions. It focuses on the lifecycle of the function itself rather than the surrounding infrastructure.

    What lambroll can do:

    • Create a Lambda function.
    • Create Zip archives from local directories.
    • Deploy function code, configuration, tags, aliases, and function URLs.
    • Rollback functions to previous versions.
    • Invoke functions with payloads.
    • Manage function versions.
    • Show function status and logs.
    • Show diffs of function code and configuration.
    • Delete functions.

    What lambroll does NOT do:

    • Manage related AWS resources like IAM Roles, function triggers, or API Gateway (though Function URLs can be managed).
    • Build native binaries or extensions for the Linux Lambda runtime environment.

    If you need to manage the entire serverless stack (infrastructure + code), tools like AWS SAM or Serverless Framework are recommended.

  2. Configure lambroll using environment variables

    v1

    You can provide flag values using environment variables prefixed with LAMBROLL_. This is useful for CI/CD pipelines or automation.

    For example, setting LAMBROLL_TFSTATE is equivalent to passing the --tfstate flag.

    # Using a flag
    lambroll deploy --tfstate=s3://example/terraform.tfstate
    
    # Using an environment variable (equivalent)
    LAMBROLL_TFSTATE=s3://example/terraform.tfstate lambroll deploy
  3. Use SSM template functions in configuration

    v1

    You can now use SSM (Systems Manager) parameter values directly in your configuration using the following syntax:

    {{ ssm "/path/to/parameter" }}

    During rendering, this placeholder will be replaced with the actual value of the specified SSM parameter.

    # Example usage in a configuration file
    key: "{{ ssm "/my/app/config_value" }}"
  4. Configure lambroll using global flags, environment variables, or an option file

    v1

    lambroll uses global flags for all commands. These can be configured via command-line flags, environment variables, or a JSON/Jsonnet option file.

    Priority of configuration values:

    1. Command-line flags (highest priority)
    2. Values defined in the option file
    3. Environment variables (lowest priority)

    Option File Format: An option file (specified via --option=filename) can contain global flags at the top level and subcommand-specific flags nested under the subcommand name using snake_case keys.

    Supported Template Functions in Jsonnet: When parsing an option file, lambroll only evaluates {{env}} and {{must_env}} template functions and the env and must_env native functions.

    // option.jsonnet
    {
      region: 'ap-northeast-1',  // global flag
      diff: {
        external: 'dyff between',  // --external flag of `lambroll diff`
      },
      deploy: {
        keep_versions: 5,  // --keep-versions flag of `lambroll deploy`
      },
    }
  5. Deploy or create a Lambda function with lambroll deploy

    v1

    The deploy command creates a new Lambda function or updates an existing one. It handles zipping source code, updating configuration, and managing aliases.

    Deployment Workflows:

    1. Standard Deployment: Creates a zip archive from --src (respecting .lambdaignore), updates/creates the function, and publishes a version/alias.

    2. Deploy via S3: If the zip archive is large, set Code.S3Bucket and Code.S3Key in function.json. Use --skip-archive if you upload the zip manually.

    {
      "Code": {
        "S3Bucket": "my-bucket",
        "S3Key": "function.zip"
      }
    }

    To use self-managed code storage, set Code.S3ObjectStorageMode to "REFERENCE".

    3. Deploy Container Image: Set PackageType=Image and Code.ImageUri in function.json.

    {
      "FunctionName": "container",
      "PackageType": "Image",
      "Code": {
        "ImageUri": "123456789012.dkr.ecr.region.amazonaws.com/repo:tag"
      }
    }

    Key Flags:

    • --src=".": Source directory or zip archive.
    • --publish: Publish function (default).
    • --alias="current": Alias name for publish.
    • --keep-versions=0: Number of latest versions to keep; older versions are deleted.
    • --ignore="": Ignore specific fields in function.json using jq queries.
    • --skip-configuration: Skip updating function configuration; deploy code and aliases only.
    $ lambroll deploy --ignore='.Tags, .Environment'
  6. Quick start: Migrate an existing Lambda function

    v1

    To start managing an existing Lambda function with lambroll, use the init command with the --download flag. This pulls the current configuration and code into your local directory.

    1. Initialize the project:

      mkdir hello
      cd hello
      lambroll init --function-name hello --download

      This creates a function.json (configuration) and downloads the current code (e.g., function.zip).

    2. Modify your code or config: Unzip the downloaded code, edit your index.js or function.json, and then remove the temporary zip file.

    3. Deploy changes:

      lambroll deploy

      This command creates a new zip archive from your local directory and updates the Lambda function's code and configuration in AWS.

    $ mkdir hello
    $ cd hello
    $ lambroll init --function-name hello --download
    # ... edit function.json or index.js ...
    $ lambroll deploy
  7. Deploy Lambda function URLs

    v1

    You can deploy Lambda function URLs using the --function-url flag. This flag points to a JSON or Jsonnet file that defines the URL configuration.

    Note: lambroll deploy only touches function URL resources if the --function-url option is explicitly provided. If the function already has a URL, omitting this flag will not modify it.

    lambroll deploy --function-url=function_url.json
  8. Enable and use Tenant Isolation

    v1

    lambroll supports Tenant isolation for multi-tenant Lambda invocation.

    1. Enable in Config: Add TenancyConfig to your function configuration.
    2. Invoke with ID: When calling the function, you must provide the --tenant-id flag. If this flag is missing, the invocation will fail.

    Configuration

    {
      "TenancyConfig": {
        "TenantIsolationMode": "PER_TENANT"
      }
    }

    Invocation

    $ lambroll invoke --tenant-id=my-tenant --payload='{"foo":1}'
    lambroll invoke --tenant-id=my-tenant --payload='{"foo":1}'
  9. Restrict Lambda function URL access with CloudFront OAC

    v1

    To restrict access to a Lambda function URL origin using CloudFront Origin Access Control (OAC), configure the Permissions in your function URL JSON file. Set the Principal to cloudfront.amazonaws.com and provide the SourceArn of your CloudFront distribution.

    To allow access from any CloudFront distribution within your specific AWS account, use the pattern arn:aws:cloudfront::<ACCOUNT_ID>:distribution/*. Avoid using * for SourceArn as it allows access from any account.

    {
      "Config": {
        "AuthType": "AWS_IAM"
      },
      "Permissions": [
        {
          "Principal": "cloudfront.amazonaws.com",
          "SourceArn": "arn:aws:cloudfront::123456789012:distribution/EXXXXXXXX"
        }
      ]
    }
  10. Use Jsonnet for advanced function configuration

    v1

    Instead of plain JSON, you can use .jsonnet files for more powerful configuration. Lambroll supports Jsonnet native functions to access the same dynamic data available in JSON templates.

    To pass external values to a Jsonnet configuration, use the following CLI flags:

    • --ext-str <KEY>=<VALUE>: Sets external string values.
    • --ext-code <KEY>=<EXPRESSION>: Sets external code values (e.g., for calculations).

    Native functions available in Jsonnet:

    • std.native('env') / std.native('must_env')
    • std.native('ssm')
    • std.native('caller_identity')()
    • std.native('layer_arn')
    • std.native('tfstate')
    $ lambroll \
        --function function.jsonnet \
        --ext-str accountID=0123456789012 \
        --ext-code memorySize="128 * 4" \
        deploy
  11. Deploy Lambda@Edge functions

    v1

    lambroll supports deploying Lambda@Edge functions. To ensure successful deployment, you must meet these two preconditions:

    1. Set the --region flag to us-east-1.
    2. Ensure the IAM Role assigned to the function allows both lambda.amazonaws.com and edgelambda.amazonaws.com to assume it.
    # Example command for Lambda@Edge
    # lambroll deploy --region us-east-1
  12. Deploy and initialize Lambda Function URLs

    v1

    Lambroll v1 supports AWS Lambda Function URLs.

    • To create the necessary configuration files for deploying Function URL resources, use lambroll init --function-url.
    • To deploy the function along with its Function URL resources, use lambroll deploy --function-url.

    Note: If your Lambda function already has a Function URL, lambroll deploy will not modify or touch the Function URL resources unless you explicitly include the --function-url option.

    # Initialize with Function URL support
    lambroll init --function-url
    
    # Deploy with Function URL support
    lambroll deploy --function-url