amazon-archives/serverless-app-examples

AWS Serverless Application Repository Examples

This project provides source code of example applications for people to get started using AWS Serverless Application Repository.

License

This project is licensed under the Apache-2.0 License.

serverless-app-examples's Issues

Example for using AWS Cognito User Pool for the Authorizer

readme error

Hello!
seems the readme's for a few of the examples are the same and also don't match the actual example.

Example: https://github.com/aws-samples/serverless-app-examples/tree/master/python/kinesis-firehose-process-record-python

readme is talking about a Slack slash command. Happy to update the readme once I've implemented the solution?

Missing example for how to configure/enhance the implicitly generated CodeDeployServiceRole

While evaluating aws sam as a CD solution for lambda functions I had struggles finding appropriate guides or documentation, and had to combine random examples and guides to get my "safe deployment" pipeline working.

I managed to setup everything after consulting different github repos and guides, but the CodeDeploy Deployment fails with this message:

The IAM role arn:aws:iam::${awsacc}:role/${lambda-app-name}-CodeDeployServiceRole-${generated-version} does not give you permission to perform operations in the following AWS service: AWSLambda. Contact your AWS administrator if you need help. If you are an AWS administrator, you can grant permissions to your users or groups by creating IAM policies.

The implicitly generated IAM Role looks like this:

{
    "Role": {
        "Path": "/",
        "RoleName": "${lambda-app-name}-CodeDeployServiceRole-${generated-version}",
        "RoleId": "${SOME_ROLE_ID}",
        "Arn": "arn:aws:iam::${awsacc}:role/${lambda-app-name}-CodeDeployServiceRole-${generated-version}",
        "CreateDate": "2020-09-15T16:29:41+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "codedeploy.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        },
        "Description": "",
        "MaxSessionDuration": 3600,
        "RoleLastUsed": {
            "LastUsedDate": "2020-09-15T16:44:09+00:00",
            "Region": "eu-west-1"
        }
    }
}

this is my template.yaml:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: sam-poc

Globals:
  Function:
    Timeout: 20

Resources:
  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: sam-poc-helloworld
      AutoPublishAlias: live
      DeploymentPreference:
        Type: AllAtOnce
        Hooks:
          PreTraffic: !Ref PreLiveHook
        Alarms:
          - !Ref AliasErrorMetricGreaterThanZeroAlarm
          - !Ref LatestVersionErrorMetricGreaterThanZeroAlarm
      CodeUri: HelloWorldFunction
      Handler: helloworld.App::handleRequest
      Runtime: java11
      MemorySize: 512

  DeploymentBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: sam-poc-deployment-artifacts

  PreLiveHook:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: sam-poc-prelivehook
      CodeUri: PreLiveHook
      Handler: prelive.Validator::handleRequest
      Runtime: java11
      MemorySize: 512
      Environment:
        Variables:
          NEW_VERSION: !Ref HelloWorldFunction.Version
      Policies:
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - codedeploy:PutLifecycleEventHookExecutionStatus
              Resource: !Sub 'arn:aws:codedeploy:${AWS::Region}:${AWS::AccountId}:deploymentgroup:${ServerlessDeploymentApplication}/*'
        - Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
              Resource: !Sub
                - ${FunctionArn}:*
                - FunctionArn: !GetAtt HelloWorldFunction.Arn

  AliasErrorMetricGreaterThanZeroAlarm:
    Type: "AWS::CloudWatch::Alarm"
    Properties:
      AlarmDescription: Lambda Function Error > 0
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
        - Name: Resource
          Value: !Sub "${HelloWorldFunction}:live"
        - Name: FunctionName
          Value: !Ref HelloWorldFunction
      EvaluationPeriods: 2
      MetricName: Errors
      Namespace: AWS/Lambda
      Period: 60
      Statistic: Sum
      Threshold: 0

  LatestVersionErrorMetricGreaterThanZeroAlarm:
    Type: "AWS::CloudWatch::Alarm"
    Properties:
      AlarmDescription: Lambda Function Error > 0
      ComparisonOperator: GreaterThanThreshold
      Dimensions:
        - Name: Resource
          Value: !Sub "${HelloWorldFunction}:live"
        - Name: FunctionName
          Value: !Ref HelloWorldFunction
        - Name: ExecutedVersion
          Value: !GetAtt HelloWorldFunction.Version
      EvaluationPeriods: 2
      MetricName: Errors
      Namespace: AWS/Lambda
      Period: 60
      Statistic: Sum
      Threshold: 0

Outputs:
  HelloWorldFunctionArn:
    Description: "Hello World Lambda Function ARN"
    Value: !GetAtt HelloWorldFunction.Arn
  HelloWorldFunctionIamRole:
    Description: "Implicit IAM Role created for Hello World function"
    Value: !GetAtt HelloWorldFunctionRole.Arn

Nested stacks are missing outputs

I've been trying to use kinesis-firehose-cloudwatch-logs-processor as part of my kinesis firehose stack, but because all Serverless applications get deployed as nested stacks there is no easy way to reference the resources in the parent stack if there are no outputs. For instance, "serverlessrepo-auto-subscribe-log-group-to-arn" application has outputs and can be easily integrated.
I strongly believe that before being published the applications need to have the resource outputs specified in the template.

Overall, I'm loving the Serverless Repo!

Example for handling different stages, i.e., dev, uat, staging, production

kinesis-firehose-apachelog-to-json-python SAR listing has incorrect source URL

The source code URL in the SAR listing for kinesis-firehose-apachelog-to-json-python points at https://github.com/aws-samples/serverless-app-examples/tree/master/python/kinesis-process-record-python - it should instead point at https://github.com/aws-samples/serverless-app-examples/tree/master/python/kinesis-firehose-apachelog-to-json-python

The listing does however deploy the correct Lambda, it's just the source link that is incorrect.