aws-cdk VS aws-lambda-rust-runtime

environment: Specifies the environment variable that will be available to our Lambda function. In this case I wrote an environment for RDS Database. Anyway, later I will write about AWS CDK using Python for creating database clusters, etc.

Today, I will show you how to build Amazon Location Service, which allows you to build location-based applications within your AWS environment using AWS Cloud Development Kit (AWS CDK) and AWS CloudFormation. I will also show examples of the recently popular CDK Migrate and AWS CloudFormation IaC generator.

AWS Cloud Development Kit (CDK): is an open-source software development framework to define your cloud application resources using familiar programming languages.

I am not one to build programming languages on a whim. In fact, I've spent the last five years building the AWS CDK, which is a multi-language library that addresses some of the challenges I am talking about by allowing developers to define cloud infrastructure using their favorite programming language.

I recently started exploring SST as an alternative to my favorite full-stack set consisting of Projen, AWS CDK, and React. I have been thoroughly impressed with the experience so far. In this article, I will demonstrate how to create a Next.js App Router S3 Picture Uploader using SST.

AWS CDK

For KMS 🔑, Each key is ~$1/mo, and with CDK, keys are generated on a massive scale, if not centralized.

Here is a github repository containing the code and instructions on how to automate this whole setup using AWS CDK.

Now that you have a working smart contract event listener, we'll deploy the resources to AWS using AWS CDK, which is an Infrastructure as Code (IaC) tool. AWS CDK allows you to configure, deploy, and manage AWS cloud resources using popular programming languages such as TypeScript.

✨ Synthesis time: 14.44s CdkScheduledReportingStack: start: Building f3a91fb0ff1605e49b4b00aa223098d7a9a5307e98027f77aecc36bc05a4c3e7:current_account-current_region CdkScheduledReportingStack: success: Built f3a91fb0ff1605e49b4b00aa223098d7a9a5307e98027f77aecc36bc05a4c3e7:current_account-current_region CdkScheduledReportingStack: start: Publishing f3a91fb0ff1605e49b4b00aa223098d7a9a5307e98027f77aecc36bc05a4c3e7:current_account-current_region CdkScheduledReportingStack: start: Building 517f907ce2318aa1a929b43bc1a0247ed509c92576c23a0a8aadfe1677f2ebd7:current_account-current_region CdkScheduledReportingStack: success: Built 517f907ce2318aa1a929b43bc1a0247ed509c92576c23a0a8aadfe1677f2ebd7:current_account-current_region CdkScheduledReportingStack: start: Publishing 517f907ce2318aa1a929b43bc1a0247ed509c92576c23a0a8aadfe1677f2ebd7:current_account-current_region CdkScheduledReportingStack: success: Published 517f907ce2318aa1a929b43bc1a0247ed509c92576c23a0a8aadfe1677f2ebd7:current_account-current_region CdkScheduledReportingStack: success: Published f3a91fb0ff1605e49b4b00aa223098d7a9a5307e98027f77aecc36bc05a4c3e7:current_account-current_region This deployment will make potentially sensitive changes according to your current security approval level (--require-approval broadening). Please confirm you intend to make the following modifications: IAM Statement Changes ┌───┬────────────────────────────────────────┬────────┬───────────────────────┬────────────────────────────────────────┬───────────────────────────────────────────────┐ │ │ Resource │ Effect │ Action │ Principal │ Condition │ ├───┼────────────────────────────────────────┼────────┼───────────────────────┼────────────────────────────────────────┼───────────────────────────────────────────────┤ │ + │ ${SalesReportFunction.Arn} │ Allow │ lambda:InvokeFunction │ Service:events.amazonaws.com │ "ArnLike": { │ │ │ │ │ │ │ "AWS:SourceArn": "${Rule.Arn}" │ │ │ │ │ │ │ } │ ├───┼────────────────────────────────────────┼────────┼───────────────────────┼────────────────────────────────────────┼───────────────────────────────────────────────┤ │ + │ ${SalesReportFunction/ServiceRole.Arn} │ Allow │ sts:AssumeRole │ Service:lambda.amazonaws.com │ │ ├───┼────────────────────────────────────────┼────────┼───────────────────────┼────────────────────────────────────────┼───────────────────────────────────────────────┤ │ + │ ${SalesReportTopic} │ Allow │ sns:Publish │ AWS:${SalesReportFunction/ServiceRole} │ │ └───┴────────────────────────────────────────┴────────┴───────────────────────┴────────────────────────────────────────┴───────────────────────────────────────────────┘ IAM Policy Changes ┌───┬────────────────────────────────────┬────────────────────────────────────────────────────────────────────────────────┐ │ │ Resource │ Managed Policy ARN │ ├───┼────────────────────────────────────┼────────────────────────────────────────────────────────────────────────────────┤ │ + │ ${SalesReportFunction/ServiceRole} │ arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole │ └───┴────────────────────────────────────┴────────────────────────────────────────────────────────────────────────────────┘ (NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299) Do you wish to deploy these changes (y/n)?

I've been writing more and more about the benefits of Rust and Lambda quite a bit lately and I plan to take advantage of them in this customizer. Additionally, I've leveraged the Lambda Runtime project that includes data structures for the Lambda Events that I'll encounter while working with these payloads.

The Lambda Rust Runtime project bridges that gap between SDK support and enhanced developer experience. Now this code IS flagged as experimental as it is subject to change. Didn't I just say above that I don't like experimental software in production? For something like a critical SDK into AWS, yes. But for something that is mostly data structures and working with different Lambda events, I don't have an issue. I'm comfortable with recommending builders look into this repository. I've also been fortunate to contribute to it and believe that the libraries included will make builder's lives easier. End of the day, if the experimental piece is a hold-up, a Lambda with Rust will be fine without it.

If you are building Rust applications that are deployed in Lambdas, it's well worth your time to check out this AWS project. And nestled inside that repository is a Lambda Events crate that helps with the serde/deserde of different payloads to be encountered when running Lambdas.

Feel free to take look at the GitHub repo and ask any questions you have there, we're always happy to help in what we can: https://github.com/awslabs/aws-lambda-rust-runtime

Rust on Lambda's using containers as the deployment artifact are also very good, i'd say a perfect match. Low artifact size, low cpu+memory usage, fast execution. I think AWS must be using increasingly using Rust on Lambda internally from the talks I've seen them publish and the work gone in to https://github.com/awslabs/aws-lambda-rust-runtime.

For simple REST API's there's not much extra effort in using Rust once you are familiar.

Check out the official AWS Lambda Rust project https://github.com/awslabs/aws-lambda-rust-runtime. It has a bunch of examples and we’ll designed. I got up and running knowing minimal Rust very quickly.

The official https://github.com/awslabs/aws-lambda-rust-runtime seems well architected.

Hi, maybe check out https://github.com/awslabs/aws-lambda-rust-runtime there's some examples in there.. But essentially you can build a Lambda function and deploy to your AWS account with this toolset.

use aws_lambda_events::apigw::{ ApiGatewayCustomAuthorizerRequestTypeRequest, ApiGatewayCustomAuthorizerResponse, ApiGatewayCustomAuthorizerPolicy, IamPolicyStatement, }; use lambda_runtime::{run, service_fn, Error, LambdaEvent}; use serde_json::json; #[tokio::main] async fn main() -> Result<(), Error> { tracing_subscriber::fmt() .with_ansi(false) .without_time() .with_max_level(tracing_subscriber::filter::LevelFilter::INFO) .init(); run(service_fn(function_handler)).await } pub async fn function_handler(event: LambdaEvent) -> Result { // do something with the event payload let method_arn = event.payload.method_arn.unwrap(); // for example we could use the authorization header if let Some(token) = event.payload.headers.get("authorization") { // do something with the token // my custom logic return Ok(custom_authorizer_response( "ALLOW", "some_principal", &method_arn, )); } Ok(custom_authorizer_response( &"DENY".to_string(), "", &method_arn)) } pub fn custom_authorizer_response(effect: &str, principal: &str, method_arn: &str) -> ApiGatewayCustomAuthorizerResponse { let stmt = IamPolicyStatement { action: vec!["execute-api:Invoke".to_string()], resource: vec![method_arn.to_owned()], effect: Some(effect.to_owned()), }; let policy = ApiGatewayCustomAuthorizerPolicy { version: Some("2012-10-17".to_string()), statement: vec![stmt], }; ApiGatewayCustomAuthorizerResponse { principal_id: Some(principal.to_owned()), policy_document: policy, context: json!({ "email": principal }), // https://github.com/awslabs/aws-lambda-rust-runtime/discussions/548 usage_identifier_key: None, } }

FYI, there’s an offical rust “runtime” in the works: https://github.com/awslabs/aws-lambda-rust-runtime