This is a simple SNS API proxy solution.
It has two SNS Topics which are for request and response, and a single AWS Lambda function. The Lambda function subscribes to events from the request topic, and sends the response from the API on the response topic.
Somebody wishing to use this system would have to create a subscriber to the response topic, and send the correct data for the API to the request topic. That way the Lambda function would receive the data, process it, and send it on as soon as it was ready.
This means that a user does not have to know the complex nature of how the API works, or keep up with any changes. They only have to put the right data into the request topic.
The addition of a subscription filter policy will stop requesters receiving every message on the response topic.
All requests:
- sent to the topic will generate a response on the response topic
- with the
help
attribute set totrue
will return a message with information on how to use the interface - without a
clientId
attribute will generate the same response as with thehelp
attribute but without theclientId
specified - with a
clientId
will have the sameclientId
returned as an attribute- specifying the
clientId
in the subscription filter policy on the response subscription is the expected method for users of the interface to avoid recieving all the other responses on the topic
- specifying the
- will expect to have the data as specified in the
help
information - without the data specified in the
help
will receive an error message and any relevant details about the error
There is currently no management of PII or sensitive data. However, SNS has some features and controls that can help here which can be found in the Data Protection section of the AWS documentation.
Currently there is no encryption specified, but this could easily be added so that other subscribers to the "response" topic cannot decrypt the topic. All that would be needed is to make sure that the "request" topic cannot be subscribed to and (so that messages sent to it cannot be viewed) and that data sent to it contains an encryption key (suggest this would be a KMS encryption key) and then any response sent back is encrypted with this key.
This would require access to KMS and so additional permissions would be needed on the Lambda function.
This project contains source code and supporting files for a serverless application that you can deploy with the AWS Serverless Application Model (AWS SAM) command line interface (CLI). It includes the following files and folders:
src
- Code for the application's Lambda function.events
- Invocation events that you can use to invoke the function.__tests__
- Unit tests for the application code.template.yaml
- A template that defines the application's AWS resources.
Resources for this project are defined in the template.yaml
file in this project. You can update the template to add AWS resources through the same deployment process that updates your application code.
If you prefer to use an integrated development environment (IDE) to build and test your application, you can use the AWS Toolkit.
The AWS Toolkit is an open-source plugin for popular IDEs that uses the AWS SAM CLI to build and deploy serverless applications on AWS. The AWS Toolkit also adds step-through debugging for Lambda function code.
To get started, see the following:
The AWS SAM CLI is an extension of the AWS CLI that adds functionality for building and testing Lambda applications. It uses Docker to run your functions in an Amazon Linux environment that matches Lambda. It can also emulate your application's build environment and API.
To use the AWS SAM CLI, you need the following tools:
- AWS SAM CLI - Install the AWS SAM CLI.
- Node.js - Install Node.js 14, including the npm package management tool.
- Docker - Install Docker community edition.
To build and deploy your application for the first time, run the following in your shell:
sam build
sam deploy --guided
The first command will build the source of your application. The second command will package and deploy your application to AWS, with a series of prompts:
- Stack Name: The name of the stack to deploy to CloudFormation. This should be unique to your account and region, and a good starting point would be something matching your project name.
- AWS Region: The AWS region you want to deploy your app to.
- Confirm changes before deploy: If set to yes, any change sets will be shown to you before execution for manual review. If set to no, the AWS SAM CLI will automatically deploy application changes.
- Allow SAM CLI IAM role creation: Many AWS SAM templates, including this example, create AWS IAM roles required for the AWS Lambda function(s) included to access AWS services. By default, these are scoped down to minimum required permissions. To deploy an AWS CloudFormation stack which creates or modifies IAM roles, the
CAPABILITY_IAM
value forcapabilities
must be provided. If permission isn't provided through this prompt, to deploy this example you must explicitly pass--capabilities CAPABILITY_IAM
to thesam deploy
command. - Save arguments to samconfig.toml: If set to yes, your choices will be saved to a configuration file inside the project, so that in the future you can just re-run
sam deploy
without parameters to deploy changes to your application.
Build your application by using the sam build
command.
my-application$ sam build
The AWS SAM CLI installs dependencies that are defined in package.json
, creates a deployment package, and saves it in the .aws-sam/build
folder.
Test a single function by invoking it directly with a test event. An event is a JSON document that represents the input that the function receives from the event source. Test events are included in the events
folder in this project.
Run functions locally and invoke them with the sam local invoke
command.
my-application$ sam local invoke SNSPayloadLogger --event events/event-sns.json
The application template uses AWS SAM to define application resources. AWS SAM is an extension of AWS CloudFormation with a simpler syntax for configuring common serverless application resources, such as functions, triggers, and APIs. For resources that aren't included in the AWS SAM specification, you can use the standard AWS CloudFormation resource types.
Update template.yaml
to add a dead-letter queue to your application. In the Resources section, add a resource named MyQueue with the type AWS::SQS::Queue. Then add a property to the AWS::Serverless::Function resource named DeadLetterQueue that targets the queue's Amazon Resource Name (ARN), and a policy that grants the function permission to access the queue.
Resources:
MyQueue:
Type: AWS::SQS::Queue
SNSPayloadLogger:
Type: AWS::Serverless::Function
Properties:
Handler: src/handlers/sns-payload-logger.snsPayloadLoggerHandler
Runtime: nodejs14.x
DeadLetterQueue:
Type: SQS
TargetArn: !GetAtt MyQueue.Arn
Policies:
- SQSSendMessagePolicy:
QueueName: !GetAtt MyQueue.QueueName
The dead-letter queue is a location for Lambda to send events that could not be processed. It's only used if you invoke your function asynchronously, but it's useful here to show how you can modify your application's resources and function configuration.
Deploy the updated application.
my-application$ sam package \
--output-template-file packaged.yaml \
--s3-bucket BUCKET_NAME
my-application$ sam deploy \
--template-file packaged.yaml \
--stack-name sam-app \
--capabilities CAPABILITY_IAM
Open the Applications page of the Lambda console, and choose your application. When the deployment completes, view the application resources on the Overview tab to see the new resource. Then, choose the function to see the updated configuration that specifies the dead-letter queue.
To simplify troubleshooting, the AWS SAM CLI has a command called sam logs
. sam logs
lets you fetch logs that are generated by your Lambda function from the command line. In addition to printing the logs on the terminal, this command has several nifty features to help you quickly find the bug.
NOTE: This command works for all Lambda functions, not just the ones you deploy using AWS SAM.
my-application$ sam logs -n SNSPayloadLogger --stack-name sam-app --tail
NOTE: This uses the logical name of the function within the stack. This is the correct name to use when searching logs inside an AWS Lambda function within a CloudFormation stack, even if the deployed function name varies due to CloudFormation's unique resource name generation.
You can find more information and examples about filtering Lambda function logs in the AWS SAM CLI documentation.
Tests are defined in the __tests__
folder in this project. Use npm
to install the Jest test framework and run unit tests.
my-application$ npm install
my-application$ npm run test
To delete the sample application that you created, use the AWS CLI. Assuming you used your project name for the stack name, you can run the following:
aws cloudformation delete-stack --stack-name sns-proxy
For an introduction to the AWS SAM specification, the AWS SAM CLI, and serverless application concepts, see the AWS SAM Developer Guide.
Next, you can use the AWS Serverless Application Repository to deploy ready-to-use apps that go beyond Hello World samples and learn how authors developed their applications. For more information, see the AWS Serverless Application Repository main page and the AWS Serverless Application Repository Developer Guide.