C# and AWS Lambdas, Part 4 – Storing the Zip in S3, Setup with Pulumi IaC

Mar 3, 2021 # dotNet Core 3.1, AWS, dotNet, IaC, AWS Lambda, Pulumi, Function as a Service

Want to learn more about AWS Lambda and .NET? Check out my A Cloud Guru course on ASP.NET Web API and Lambda.

Full source code available here.

In the previous post, I showed how to use Pulumi to create a Lambda, API gateway and upload a zip of Web API application directly to the Lambda.

In the post I’m going to use S3 to store the zip of a simple .NET application (not a Web API app) and point the Lambda at it, bringing all the resources up using Pulumi. One drawback of using S3 to store the zip for a Lambda is that when you update the zip in S3, AWS doesn’t deploy the new zip to the Lambda, but I will show a way of handling that in the next blog post.

Every time I write these posts it feels like a lot of work to set up the infrastructure, learn about the AWS components, policies, etc. But then when I run pulumi destroy -y and pulumi up -y as I make changes I appreciate the speed and predictability.

What’s needed

A Lambda role.
A policy to execute the Lambda.
An S3 bucket.
Block all public access to the bucket - optional.
Put the zip in the bucket.
The Lambda function pointing to the zip in the bucket.

A few of these are the same as in the previous post, but the S3 resources are new.

Note that I included BucketPublicAccessBlock section, this makes the S3 bucket more secure than it would be under the default settings.

The code

Here is the code that sets it all up. I’ve included a helloworld.zip file in the attached source code zip. This is NOT how you would normally upload the zip to S3, but it’s easy for demonstration purposes. In a more realistic scenario, you would a CI/CD pipeline to compile the code and drop it in S3.

 1using Pulumi;
 2using S3 = Pulumi.Aws.S3;
 3using Aws = Pulumi.Aws;
 4class MyStack : Stack
 5{
 6    public MyStack()
 7    {
 8
 9        var lambdaRole = new Aws.Iam.Role("PulumiHelloWorld_LambdaRole", new Aws.Iam.RoleArgs
10        {
11            AssumeRolePolicy =
12@"{
13    ""Version"": ""2012-10-17"",
14    ""Statement"": [
15        {
16        ""Action"": ""sts:AssumeRole"",
17        ""Principal"": {
18            ""Service"": ""lambda.amazonaws.com""
19        },
20        ""Effect"": ""Allow"",
21        ""Sid"": """"
22        }
23    ]
24}",
25        });
26
27        var lambdaPolicyAttachment = new Aws.Iam.PolicyAttachment("PulumiHelloWorld_LambdaPolicyAttachment", new Aws.Iam.PolicyAttachmentArgs
28        {
29            Roles =
30            {
31                lambdaRole.Name
32            },
33            PolicyArn = Aws.Iam.ManagedPolicy.AWSLambdaBasicExecutionRole.ToString(),
34        });
35
36        var bucket = new S3.Bucket("PulumiHelloWorld_S3Bucket", new S3.BucketArgs
37        {
38            BucketName = "pulumi-hello-world-s3-bucket",
39            Acl = "private"
40        });
41
42        var bucketPublicAccessBlock = new S3.BucketPublicAccessBlock("PulumiHelloWorld_PublicAccessBlock", new S3.BucketPublicAccessBlockArgs
43        {
44            Bucket = bucket.Id,
45            BlockPublicAcls = true,
46            BlockPublicPolicy = true,
47            RestrictPublicBuckets = true,
48            IgnorePublicAcls = true
49        });
50
51        var bucketObject = new S3.BucketObject("PulumiHelloWorld_ZipFile", new S3.BucketObjectArgs
52        {
53            Bucket = bucket.BucketName.Apply(name => name),
54            Acl = "private",
55            Source = new FileArchive("helloworld.zip")
56        });
57
58        var lambdaFunction = new Aws.Lambda.Function("PulumiHelloWorld_LambdaFunction", new Aws.Lambda.FunctionArgs
59        {
60            Handler = "HelloWorldLambda::HelloWorldLambda.Function::FunctionHandler",
61            MemorySize = 128,
62            Publish = false,
63            ReservedConcurrentExecutions = -1,
64            Role = lambdaRole.Arn,
65            Runtime = Aws.Lambda.Runtime.DotnetCore3d1,
66            Timeout = 4,
67            S3Bucket = bucket.BucketName,
68            S3Key = bucketObject.Key
69        });
70
71        this.LambdaFunctionName = lambdaFunction.Name;
72    }
73
74    [Output]
75    public Output<string> LambdaFunctionName { get; set; }
76}

To test out the Lambda, open it in the AWS console, navigate to the Lambda and add a test as described in part 1 of this series of posts.

Full source code available here.

dotNet Core 3.1 AWS dotNet IaC AWS Lambda Pulumi Function as a Service

C# and AWS Lambdas, Part 4 – Storing the Zip in S3, Setup with Pulumi IaC

What’s needed

The code

Related