aws-lambda

Invokes an AWS Lambda function as the upstream.

Category ServerlessAdd it to Route, Service, Consumer, Consumer group, Global rule, Plugin configEngine plugin aws-lambdaPriority -1899

What it does

aws-lambda answers the requests on a route from an AWS Lambda function instead of an upstream. The gateway calls the function at Function URI, with the key under API key or a request signed with the keys under IAM.

The client gets what the function answers, its status and its body, 200 and order 42 from the function in the example. The route in the example carries no upstream of its own.

When to use it

• An orders endpoint written as a Lambda function, published on the same host as the routes your own backend instances serve.
• A function behind AWS API Gateway that expects an API key, which the gateway adds so that no client ever holds it.
• A function URL protected by IAM, where the gateway signs each call with the keys of an IAM user.
• One path of an API moved to a function, a report export for example, while the rest stays on the backend.

Not for a backend of your own — see Upstream (Upstreams are the backends that routes and services send traffic to), a function hosted on Azure — see azure-functions (Invokes an Azure Function as the upstream) or code that runs inside the gateway itself — see serverless-pre-function (Runs Lua functions before the other plugins of a phase).

Set it up

Serve the route from a Lambda function invoked with an API key

Under Basics set Function URI to https://k3x9q2w7ab.execute-api.eu-central-1.amazonaws.com/prod/orders and fill Authorization as in the JSON below. Under Behavior set Timeout to 10000 milliseconds.

aws-lambda · as the console saves it

{
  "function_uri": "https://k3x9q2w7ab.execute-api.eu-central-1.amazonaws.com/prod/orders",
  "authorization": {
    "apikey": "<secret>"
  },
  "timeout": 10000
}

Things to know

• API key — The key reaches the function in the x-api-key header. In the example the function answers only a request that carries it, and the client receives its 200.
• Authorization — With both set, the stored API key is sent and nothing is signed, unless the request brings its own x-api-key, which IAM then signs.
• IAM — A request that carries the same header twice fails with 500 before the call, but only where these credentials sign it.
• IAM — IAM keys without the Secret access key are refused when you save.
• Function URI — An empty Function URI is refused when you save.
• AdviceGive the gateway an IAM user of its own that may invoke this function and nothing else.

Settings

The fields as the console shows them, section by section.

Basics

Function URIfunction_uristringRequired

The function's full URL, to which whatever a route wildcard matched is appended.

at least 1 character · example https://abc123.execute-api.eu-central-1.amazonaws.com/prod/orders

Authorizationauthorizationobject

API keyauthorization.apikeystring

Stored on the engine and shown only to roles that manage this object.

IAMauthorization.iamobject

Access key IDauthorization.iam.accesskeystringRequired

The access key ID the request is signed with, from the AWS IAM console. Stored on the engine and shown only to roles that manage this object.

Secret access keyauthorization.iam.secretkeystringRequired

The secret access key the request is signed with, from the AWS IAM console. Stored on the engine and shown only to roles that manage this object.

AWS regionauthorization.iam.aws_regionstringdefault us-east-1

The AWS region the function runs in, used in the request signature.

Serviceauthorization.iam.servicestringdefault execute-api

The AWS service name in the request signature: execute-api for a function behind API Gateway, lambda for a function URL.

Behavior

Timeouttimeoutintegerdefault 3000

at least 100 · in milliseconds

SSL verifyssl_verifybooleandefault true

Advanced

Request body limitmax_req_body_sizeintegerdefault 67108864

The largest request body in bytes that is forwarded, where a larger one is rejected with 400.

at least 1

Keepalivekeepalivebooleandefault true

Keepalive poolkeepalive_poolintegerdefault 5

at least 1

Keepalive timeoutkeepalive_timeoutintegerdefault 60000

at least 1000 · in milliseconds

Every plugin also has Enabled, Priority, Filter, Error response and Pre-function: see Plugin execution settings.