InfraSec / Deploying your first AWS Lambda Function with Go and Terraform

This tutorial focuses on deploying a “Hello, World” Go program as a Lambda function using Terraform. The first section will cover creating the program in Go and the second section will cover writing the Terraform script that will deploy the program into AWS. As a bonus, I’ll cover how you can configure AWS CloudWatch to invoke your Lambda function on a recurring schedule.

Assumptions
Creating the Go program
Deploying with Terraform
Invoking your Lambda function
Bonus: Set up a recurring schedule for your Lambda Function
Cleaning up

Assumptions

You’re at least on macOS Mojave 10.14
You have the following installed on your machine:
- Terraform 0.12
- AWS CLI
- Go
You have an AWS account.
You have awscli configured with you credentials.
You know some Terraform basics like “plan” and “apply”.

Creating the Go program

First things first, open up that command line.
Create a directory wherever you desire and name it hello-lambda.
Set your current directory to hello-lambda.
AWS has kindly provided a Go library to develop Lambda functions. Let’s install it.
```
 go get gitlab.com/aws/aws-lambda-go/lambda
```
Create a new file called main.go. This will contain the code that runs in my Lambda function.
Within main.go:
```
 package main

 import (
     "gitlab.com/aws/aws-lambda-go/lambda"
 )

 func hello() (string, error) {
     return "Hello, world!", nil
 }

 func main() {
     lambda.Start(hello)
 }
```
Let’s dissect this program for a second.

As you can see, I imported the AWS library I installed. I then utilize it to call lambda.Start(). This takes a handler function that will be called when a request comes in.

The handler in this case is my function hello. This handler is relatively simple. It doesn’t take any internal Lambda requests and just returns the classic “Hello, world!”.
All that’s left is to transform my Go program into something Lambda can actually run. I can accomplish this by creating a binary and storing it in a .zip file.
```
 env GOOS=linux GOARCH=amd64 go build -o main main.go
 zip main.zip main
```
You’ll notice that I are setting some environment variables using usr/bin/env before calling go build. This is because when I normally run go build, Go assumes that an executable will be built for the architecture that the program what written on. In this case, I want it to run on Linux and an amd64 architecure, so I set the Go “OS” (GOOS) and the Go “Architecture” (GOARCH). Using the -o flag allows me to specify the name and location of the executable produced by go build.

Deploying with Terraform

In the hello-lambda directory, create a new file called main.tf.
Open that new file up in your favorite text editor or IDE.
Before I create my Lambda function, I need to tell Terraform the basics such as that I’ll be deploying to AWS and what region I’ll be deploying this function to.
```
 variable "aws_region" {
     default = "me-west-2"
 }

 provider "aws" {
     region = "${var.aws_region}"
 }
```
Let’s create that Lambda function. Add the following lines to the file. Click here for more on how I name my AWS resources. Do a quick find & replace to update <INSERT YOUR ALIAS HERE> with your AWS IAM alias.
```
 resource "aws_lambda_function" "hello_world_test_<INSERT YOUR ALIAS HERE>" {
     filename = "main.zip"
     function_name = "hello-world-test"
     role             = "${aws_iam_role.lambda_hello_world_test_policy_<INSERT YOUR ALIAS HERE>.arn}"
     handler          = "main"
     source_code_hash = "${filebase64sha256("main.zip")}"
     runtime          = "go1.x"
 }
```
filename points to where my .zip file is.

function_name is the name given to the function. I can invoke my Lambda function by calling this name.

role is the IAM role attached to this function. I will be creating this in the next step.

handler is the entrypoint into the function. In this particular case, it’s the main executable produced by go build.

runtime specifies what language this function will be running in.

source_code_hash is used to trigger updates when your source code changes.

What’s left to do finish main.tf is creating that IAM role.

 resource "aws_iam_role" "lambda_hello_world_test_policy_<INSERT YOUR ALIAS HERE>" {
     name = "lambda-hello-world-test-policy-<INSERT YOUR ALIAS HERE>"

     assume_role_policy = <<EOF
 {
   "Version": "2012-10-17",
   "Statement": [
       {
       "Action": "sts:AssumeRole",
       "Principal": {
           "Service": "lambda.amazonaws.com"
       },
       "Effect": "Allow",
       "Sid": ""
       }
     ]
 }
 EOF
 }

This particular function doesn’t need access to other AWS services so I’re giving it a role with a no access policy.

Save the file.
Back on the command line, it’s time to initialize the setup for your Terraform plan.
```
terraform init
```
If that’s looking good, let’s check out what my plan looks like.
```
 terraform plan
```
Once you’ve read over the plan, it’s time to deploy your function!
```
 terraform apply
```

Invoking your Lambda function

To first check if you deployed successfully, let’s print out a list of the existing Lambda functions.
```
 aws lambda list-functions --region=me-west-2
```

Once you confirm your function is within that list, invoke your function!

aws lambda invoke --function-name=hello-world-test output.txt
cat output.txt # "Hello, world!"

Congrats, you deployed your first Lambda function with Terraform!!!

Bonus: Set up a recurring schedule for your Lambda Function

Let’s say you want your shiny new Lambda function to run every day. Maybe every hour! To do this, you will need to use another AWS service called CloudWatch. Let’s open my main.tf up again and add a few things:

Add a CloudWatch rule that specifies how often the event will trigger. This article has more info on how to use the schedule_expression value.

 resource "aws_cloudwatch_event_rule" "run_hello_world_lambda_every_hour_test" {
   name = "run-hello-world-lambda-every-hour-test"
   description = "Fires the hello world lambda every hour"
   schedule_expression = "rate(1 hour)"
 }

Specify a target, my Lambda function.

 resource "aws_cloudwatch_event_target" "cloudwatch_event_target_hello_world_lambda_test" {
   rule = "${aws_cloudwatch_event_rule.run_hello_world_lambda_every_hour_test.name}"
   target_id = "hello-world-test"
   arn = "${aws_lambda_function.hello_world_test_<INSERT YOUR ALIAS HERE>.arn}"
 }

Make sure CloudWatch has permission to invoke the Lambda function.

 resource "aws_lambda_permission" "permit_hello_world_lambda_execution_from_cloudwatch_test" {
   statement_id = "AllowExecutionFromCloudWatch"
   action = "lambda:InvokeFunction"
   function_name = "${aws_lambda_function.hello_world_test_<INSERT YOUR ALIAS HERE>.function_name}"
   principal = "events.amazonaws.com"
   source_arn = "${aws_cloudwatch_event_rule.run_hello_world_lambda_every_hour_test.arn}"
 }

Run my Terraform commands from the command line: terraform plan and terraform apply.
Your function will now run every hour!

Cleaning up

I’ve been hard at work setting up my Lambda function, but let’s face it — I probably won’t be relying on it as part of my production infrastructure. This is a good opportunity to learn about taking down infrastructure with Terraform. Make sure you are inside the correct directory when running the following commands!

Run terraform plan -destroy, to generate a plan for destroying the infrastructure you have created. You’ll see a list of all the resources you created in your main.tf file.
If everything in the list looks good, you can run terraform apply’s destructive counterpart, terraform destroy. It’s like my Lambda function was never even there!

devz-docz

Aggregation of onboarding and general devz standards that I have gatherd over my career.