DOCSEARCHbyAlgolia
Submit Docs

Middy Middleware Engine for Node.js AWS Lambda

repository·main·Indexed 26 days ago

https://github.com/middyjs/middy

A middleware engine for Node.js AWS Lambda functions designed to separate business logic from cross-cutting concerns such as validation, authentication, and error handling. It provides a wide array of specialized middleware packages including @middy/core, @middy/http-cors, @middy/dynamodb, @middy/http-jwt, and @middy/event-normalizer.

Tokens
122.4K
Snippets
247
Records
687
Agent score
84%

What's inside Middy

  1. Introduction to Middy middleware engine

    main
    Middy is a middleware engine for AWS Lambda using Node.js. It allows you to separate common technical concerns—such as authentication, authorization, validation, serialization, and input parsing—from your core business logic. By using the middleware pattern (similar to Express), you can decorate your Lambda handler with modular, reusable pieces of logic, keeping your main handler clean and focused on business requirements.

  3. Overview of Middy features

    main

    Middy is a middleware engine for Node.js AWS Lambda functions. It helps separate non-functional concerns (like validation, auth, and logging) from your core business logic.

    Key Features:

    • Extensive Ecosystem: 52 official packages for services like API Gateway, SQS, S3, DynamoDB, SNS, EventBridge, Kinesis, Kafka, and WebSockets.
    • Modern Runtime Support: Built with TypeScript types, supports Node.js >= 22, and uses ESM.
    • Lightweight Core: The @middy/core package is tiny and does not include the AWS SDK.
    • Advanced Routing: Includes routers for HTTP, WebSocket, and CloudFormation custom resources.
    • Lambda Optimizations: First-class support for AWS Lambda response streaming and durable functions.

  4. Overview of official Middy middlewares

    main
    Middy provides a suite of official, opt-in plugins maintained by the core team. These middlewares are designed to be performant, single-task focused, and kept in sync with the core package. They address common use cases when using AWS Lambda with other AWS services, categorized into Observability, Lifecycle, Request Transformation, Response Transformation, Fetch Data, and Lambda Extensions.

  5. Review Middy's pipeline hardening and security conventions

    main

    Middy employs several hardening techniques across all CI/CD workflows:

    • Pinned Actions: All third-party GitHub Actions are pinned to specific commit SHAs.
    • Scoped Permissions: Workflows use minimal required permissions (e.g., contents: read by default).
    • Runner Hardening: Every job utilizes step-security/harden-runner in audit mode to monitor egress.
    • Credential Management: No long-lived credentials are used; npm publish utilizes OIDC, and the GITHUB_TOKEN auto-rotates per job.
    • Ephemeral Runners: All jobs run on GitHub-hosted ubuntu-latest runners.
    • Workflow Security: Workflows are linted using zizmor and actionlint to prevent misconfigurations.

  6. Integrate Powertools for AWS Lambda with Middy

    main

    Powertools for AWS is a developer toolkit for implementing serverless best practices. It is compatible with @middy/core versions 4.x through 7.x.

    Compatible utilities include:

    • Logger: Structured JSON logging with Lambda context and cold start capture.
    • Tracer: AWS X-Ray wrapper for tracing invocations, HTTP requests, and AWS SDK calls.
    • Metrics: Asynchronous CloudWatch custom metrics using EMF format.
    • Idempotency: Prevents duplicate execution based on payload content.
    • Parser: Data validation and parsing using Zod.

  7. Use @middy/event-batch-response to shape batch responses

    main
    The @middy/event-batch-response middleware is used to automatically shape the Lambda response for batch-based event sources. This ensures that the response format is compatible with the requirements of services like SQS, Kinesis, or DynamoDB Streams, allowing for partial batch failures or successful processing acknowledgments.

  10. Use @middy/cloudformation-response for CloudFormation Custom Responses

    main
    The @middy/cloudformation-response middleware handles event response formatting for AWS CloudFormation Custom Resources. It ensures that the Lambda response follows the required structure for CloudFormation to correctly process the resource lifecycle (e.g., SUCCESS or FAILED statuses).

  11. Middy CI/CD Security and Compliance Overview

    main

    Middy follows the OWASP SPVS 1.5 standard for its CI/CD pipeline. The security posture is divided into five main phases:

    1. Integrate (CI): Focuses on pipeline environment hardening (using step-security/harden-runner), credential hygiene (GitHub Secrets and OIDC), and continuous security checks (SAST, SCA, and DAST).
    2. Release (CD): Ensures final security assessments via full PR gating, automated deployment via release.yml, and artifact integrity through Sigstore provenance.
    3. Operate: Includes access audits, continuous enforcement of security standards (OSSF Scorecard), and timely patching via Dependabot.
    4. Detection and Monitoring: Utilizes GitHub Actions logs and egress audits to detect anomalies.
    5. Incident Response: Maintains documented plans for triage, containment, and recovery (e.g., secret rotation and patched-version republishing).

  12. Review OWASP SPVS 1.5 Compliance for Middy

    main
    Middy maintains compliance with OWASP SPVS 1.5 standards across several development domains, including secure coding, software quality, code review, security checks, credential hygiene, and third-party library auditing. This document serves as a record of the requirements met and the evidence provided (e.g., GitHub Actions workflows, linting rules, and security scanning tools).