Lambda extension Overview

Introduction

This is a TAM AWS Lambda extension version of Appliance. It enables the authorization capabilities of the TAM appliance to be seamlessly integrated within serverless architectures, specifically Lambda functions. By leveraging AWS Lambda’s event-driven execution model, this integration enhances resource efficiency and scalability. Developers can now build more secure, scalable, and maintainable applications with greater ease.

Getting started

The lambda extension .zip file can be found in Trimble E-Tools Artifactory as part of the [trimblecloud-tam-appliance-extension-generic-local]({{ sdks.appliance_aws_lambda_extension.prod[0].artifactory }}){:target=“_blank”} artifact.

Working

The appliance extension gets initialized before the Lambda function starts, and a local server is started at the API_PORT configured in the environment. It begins listening for decision requests. During function invocation, the decision request will be sent to the local server, and the decision will be returned to the Lambda function.

Usage

Upload this extension as layer to your lambda function.

aws lambda publish-layer-version --layer-name tam-lambda-extension --zip-file fileb://tam-lambda-extension.zip

Make sure that:

The AWS CLI is installed and configured with the necessary permissions.
The tam-lambda-extension.zip file is in the correct location.

Once the layer is created, add it to your lambda function. Add the below line in your template.yaml file.

    Layers:
        - arn:aws:lambda:us-east-1:123456789012:layer:tam-lambda-extension:1

Defined the environment variables as below in your function template.yaml file.

  Environment:
          Variables:
            CLIENT_ID: __id__
            CLIENT_SECRET: __secret__
            TOKEN_URL: __tokenUrl__
            ENVIRONMENT: stage
            API_PORT: 9000
            MONITORING_ENABLED: true
            SECRET_MANAGER: ssm //optional
      PARTITION: <<partition Value>> //optional
      LOG_LEVEL: <<DEBUG | INFO | WARN | ERROR>> //(Optional)
            OFFLINE_MODE: <<TRUE|FALSE>> (Optional)  # When true, load policies from a local bundle instead of from the server.
            BUNDLE_PATH: <</path/to/bundle.tar.gz>> (Optional)  # Full path to the .tar.gz bundle (used when OFFLINE_MODE=true).

The extension is initialized with the above values during the startup of the lambda function.

Use the below sample python code to trigger the decision using extension.

if we need to invoke AWS lambda function, we can use following environment variables

Optional AWS lambda invoke

- Ex: `ENABLE_LAMBDA_CLIENT=true`
- Ex: `AUTH_DATA_LAMBDA={lambda_name_to_invoke}`

import logging
import requests
import json
import time

# Create a logger
logger = logging.getLogger(__name__)

# Set the log level to INFO
logger.setLevel(logging.DEBUG)

def lambda_handler(event, context):
    #gather policy and input data
    logger.info(f"Input event payload : {event}")
    if 'namespace' in event:
        data = event
    else:
        request_payload  = event.get('body', '{}')
        data = json.loads(request_payload)
        logger.info(f"Input json payload : {data}")
    namespace = data['namespace']
    rule = data['rule']
    auth_token = data['auth_token']
    input_json = {"input": data['input'] }

    # Create the headers dictionary
    headers = {
        'Authorization': f'Bearer {auth_token}'
    }

    # Make a POST request to the decision endpoint
    response = requests.post(f'http://localhost:9000/v1/decision/{namespace}/{rule}', headers=headers, json=input_json)
    data = response.json()

    return {
        'statusCode': 200,
        'body': json.dumps(data)
    }