11

One thing I did was to create a CloudWatch alarm on ApproximateNumberOfMessagesVisible (>= 1 for 5 minutes) for the SQS queue. The alarm publishes to an SNS topic that triggers the lambda function. The lambda function loops until it clears the queue. It can take up to 5 minutes to trigger from the alarm, but it works fantastically for batch-scheduled ...


10

This is expected. Lambda functions in a VPC can't communicate with the Internet (including the standard service APIs) using an Internet Gateway, because an Internet Gateway requires the internal devices to have associated public IP addresses. Being on a public subnet (where the default route is the Internet Gateway) isn't sufficient. Important If ...


7

You can't go SQS -> SNS, only SNS -> SQS. Lambda now supports scheduling so one option is to implement an SQS poller in a Lambda function and run it frequently. Another option to consider is whether you actually need a queue. Lambda supports asynchronous processing (via the Event invocation mode) and should transparently scale horizontally to handle ...


6

You can pass ES cluster endpoint to Lambda function as an environment variable. Here is a snippet of CloudFormation template for such function: "mylambda": { "Type": "AWS::Lambda::Function", "Properties": { "Handler": "index.handler", "Role": { "Fn::GetAtt" : ["LambdaExecutionRole", "Arn"] }, "Code": { "S3Bucket": "my-lambda-functions-...


6

Elastic Beanstalk is your traditional hosting - you can upload a PHP or Java or whatever application, say Wordpress, configure a database, etc, and go. There are some smarts for scaling, recovery, etc, but it’s still very much a traditional hosting platform. ECS Containers can still run your traditional app but there are some more specifics - most notably ...


5

If your function has nothing to do with S3 then don't use this managed policy. As far as I can see this policy is used in the documentation in combination with a tutorial on how to use Lambda with Amazon S3. Source: https://docs.aws.amazon.com/lambda/latest/dg/with-s3-example-create-iam-role.html If you want to use a managed policy I recommend using ...


5

SQS message can only be read once from the queue and while it's being processed by one consumer it will be invisible to other consumers. If you've got multiple lambdas each will get their share of the messages but one message won't be delivered to more than one lambda at a time. SQS Messages may be re-inserted into the queue if the processing Lambda fails (...


5

This page says how many ENIs are required when using Lambda inside a VPC - this is per subnet If your Lambda function accesses a VPC, you must make sure that your VPC has sufficient ENI capacity to support the scale requirements of your Lambda function. You can use the following formula to approximately determine the ENI requirements. Projected ...


4

The 200 number is a hard limit. You will not be able to deploy this application, as is, through serverless. However, if you're willing to break things up, you can get around it. CloudFormation has that 200-resource limit for a reason, and straight up CloudFormation users have been wrestling with it for a while. There are three ways we have been handling ...


4

It turns out my original premise (needing to know the task container's own internal IP address for service discovery) is very flawed - that IP address is only usable within a single EC2 Container Instance. If you have multiple container instances (which you probably should have) then those task container IP's are basically useless. The alternative solution ...


4

While not clear, TracingConfig is the setting to enable AWS X-Ray. TracingConfig is a property of the AWS::Lambda::Function resource that configures tracing settings for your AWS Lambda (Lambda) function. For more information about tracing Lambda functions, see Tracing Lambda-Based Applications with AWS X-Ray in the AWS Lambda Developer Guide. - AWS ...


3

He is correct that the SystemAdministrator policy lacks the rights to create IAM roles, which are going to be needed for Lambda. You should never give root access or your login credentials to anyone. You could assign his user the AdministratorAccess policy which allows any action to be taken. Without knowing the full details of exactly what needs done it's ...


3

The answer to your question is you must undo step 4 and use a different subnet for lambda to access the Internet. However you should never, ever, make MySQL publically accessible. This is a massive security risk. Use an SSH tunnel or VPN to access it instead


3

Yes, you have to launch an instance in the cluster. An Aurora cluster has an Aurora Storage Volume with your data, and 0 or more instances that can access it. You can't actually access a cluster's data unless you have at least 1 instance in the cluster. The reason for this abstraction is that unlike in a conventional database server, where the data is "...


3

That's correct - technically API gateway handles all of the load balancing for you against any newly provisoned or warm lambda functions. But many people (ourselves included) wanted to use ALB's for lambda as we could perform the following routing: if request.url ~ /node-app: use nodejs-application target group else if request.url ~ /lambda-app: use ...


3

I believe the solution should be as simple as changing your LambdaExecutionRole to this: LambdaExecutionRole: Description: Creating service role in IAM for AWS Lambda Type: AWS::IAM::Role Properties: RoleName: !Sub 'CodeStar-${ProjectId}-Execution${Stage}' AssumeRolePolicyDocument: Statement: - Effect: Allow Principal: ...


3

I'm not sure why the Lambda stops working. I suspect Lambda service notices that it keeps failing so it temporarily suspends it. Not sure. You can try a number of workarounds: Use DynamoDB on demand capacity - AWS says it scales instantly. Alternatively if you use provisioned capacity and get the Provisioned Throughput Exception don't actually abort the ...


3

S3 event can't trigger a lambda in a different region. What you can do is for example: Send the S3 event to SNS topic or SQS queue and trigger lambda in your target region from that message. Trigger Lambda in the same region from the S3 event and trigger your target region Lambda from the first Lambda. Or a blend of the above two - Lambda in the S3 region ...


3

Rather then having them public for anyone to download I would make them private and only distribute pre-signed URLs to your colleagues and clients. You can create a simple portal where your clients login and get a pre-signed link to the S3 object that expires e.g. in an hour. If they need to download it again they can get a fresh link any time. This will ...


3

Lambda runs using a service linked role that gives it permission to write to CloudWatch logs. You will have created this role, or used the GUI to give lambda permission to create the role on your behalf. Given that lambda has permission, it's part of the service that logs are written to CloudWatch logs. Someone who does more Lambda might give you a better ...


2

The last thing you want is to have a valid use case (eg. large video) hit the Lambda limitations (time and/or disk storage). You should reduce your steps into small, single-task chunks, for example: Convert video into frames Convert frames into thumbnails etc. Evaluate each small task individually. Determine your min/max/average file size and calculate ...


2

In basic way yes, it is the same. You're using some another resources in way they owners described. RPC is one of protocols how you can access remote resources, defined in RFC 1831. Another protocol is ie. SOAP. In general RPC is quite old technology, that RFC was published in 1995. FaaS is "business word" used to "rebranding" that old stuff like RPC and ...


2

You register targets, such as EC2 instances, with a target group. http://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html You've made an astute observation. That's an interesting choice of words... but, for the moment at least, EC2 instances are the only kind of target. An EC2 instance either invoking your ...


2

No. Although you could use Lambda to take action on a Minecraft server running on EC2 like start/stop.


2

The issue was that I needed to have a NAT on the subnet the Lambda function is running in - an Internet Gateway is not enough! I'm assuming that this is because the Lambda runs only privately, and the Internet Gateway, allowing 2-way traffic, would not allow routes to/from the Lambda. Adding the Lambda to a private subnet with a NAT attached fixed this ...


2

# This is for AWS Sam CF MyScheduledRule: Type: "AWS::Events::Rule" Properties: Description: "ScheduledRule" ScheduleExpression: "rate(6 minutes)" State: "ENABLED" Targets: - Arn: !GetAtt MyLambdaFunction.Arn Id: "IdForAlert" Input: "{\"name\": \"value\"}"


2

It works in quite unexpected way: despite you create tags using resource, you have to delete them using client: id = 'vol-5e0e9c3333' tagRes = boto3.client('ec2', region_name=region) ret = tagRes.delete_tags( Resources=[id], Tags=[{'Key': 'tag_name_to_del' }] );


2

Based on Michael's answer, I was able to figure this out finally. (Many-many thanks to him! :)) Since I have struggled with this so much, I am capturing the final solution, just in case someone hits the same issue. I ended up using three Subnets, an Internet Gateway, a NAT Gateway and two distinct Routing tables (in addition to the main routing table of ...


2

Period in metrics displayed as Number simply describe how far in the past you are collecting the stats. For other display modes, e.g. Line or Stack the period is the time between each displayed data point. So on one graph you can have 3 hours of data with 5 min period which will give you 36 points on the graph. In Number display you'll simply see the last ...


2

AWS support says the trigger can be disabled because of the insufficient permissions for the Lambda execution role. My question: Where the conditions when the Lambda trigger can be automatically disabled are documented? Or where to find why the trigger was disabled (some kind of Lambda service logs)? AWS support answer: Currently, there is no such ...


Only top voted, non community-wiki answers of a minimum length are eligible