powertools-lambda-typescript VS powertools-lambda-python

Logger class is now more extensible You can now overwrite the Logger methods createAndPopulateLogItem, printLog, and processLogItem, which were previously private. This allows you to extend the Logger and add new functionality, e.g., implement your own message buffer. Release v2.12.0

The Powertools GitHub repository offers nice examples to integrate and learn from. For example here are nice example written in AWS CDK. Following I will list the features I gained some experience with.

Lambda Powertools TypeScript can't be used directly as an ES Modules dependency, but there is an issue open, so please consider adding your +1. For now, it's possible to get by with a require shim or via cjs tricks but it would be great to see native support for ES Modules in Lambda Powertools TypeScript.

for secrets, I would recommend using AWS PowerTools if you can (depending on your language) - https://github.com/awslabs/aws-lambda-powertools-python - https://github.com/awslabs/aws-lambda-powertools-typescript

The documentation for Lambda Powertools TypeScript is pretty good and provides several examples with even more on GitHub.

Last week, AWS announced the beta release of AWS Lambda Powertools Typescript. This is a suite of TypeScript utilities for AWS Lambda functions to enable the adoption of best practices in areas such as structured logging, tracing and custom metrics.

Additional Resources: AWS Lambda Powertools Documentation: https://docs.powertools.aws.dev/lambda/python/latest/

Today we will build our first real piece of CRM functionality: a POST /contacts endpoint that stores a contact record in Amazon DynamoDB, now powered by AWS Lambda Powertools for structured logging, tracing, and metrics.

When you are using a solution like this you do want to make sure that your processing is idempotent. This means that if you process the same message multiple times, it will not have any side effects. In our case, we have used AWS Lambda Powertools for TypeScript (also available, with more features for other languages; Python, .NET and Java) to implement idempotency in our DynamoDB Stream handler in the critical points where we do not want to reprocess the same step unless it failed there. I can highly recommend using this library as it provides a lot of useful utilities for working with AWS Lambda, including idempotency, logging, and tracing.

AWS Lambda Powertools Data Masking AWS Lambda Powertools is “a developer toolkit to implement Serverless best practices and increase developer velocity” originally developed in Python but made available for Java, Typescript and .NET. As of now only the Python version offers a utility for data masking. Two approaches are proposed. One approach which uses a KMS key to encrypt/decrypt the sensitive information inside the log. A second approach which simply erases the sensitive information before writing the logs. To implement the first approach but also comply with regulations like the right to be forgotten, you would need to have one encryption key per customer, find some way to encrypt each customer’s information with their own key. Should they exercise their right to be forgotten, simply delete the encryption key, making their data forever unrecoverable. Although those approaches can address both problems, you must know exactly what to encrypt/erase. For example, to erase the phone number in a list of customers you would need to do something like this:

Just give you an idea of how to implement a template for serverless in your organization; you can create multiple cases and embed the practice of your organization to the template like pre-commit, cicd, lambda-layer-secret, lambda-layer-powertools and more

The Lambda code is using the AWS Powertools for Lambda library which I highly recommend everyone uses for the code. The AWS Transfer Family integration with AWS Lambda passes in key information like the username, password, server id, IP address, etc and the code above tries to find a secret in AWS Secrets Manager matching the server id and username. If it does find this then it compares the entered password with the expected value from the secret. If they match it returns the IAM Role containing the permissions the user has for interacting with AWS resources and the home directory they have (which maps to the root of the S3 bucket associated with the server.

The main AWS Lambda code is below. It is coded in Python using the AWS SDK for Python along with the very useful AWS Powertools for Lambda library. The full source along with all the SAM Infrastructure as Code (IaC) files can be found in the Github repo associated with this blog which is here.

Open-source libraries like Powertools for AWS Lambda have changed the industry. They recently crossed 100 billion API integrations per week. Powertools is making customers’ lives a lot easier worldwide.