AWS CloudFront Lambda at Edge cloudwatch logs

Where are the AWS CloudFront Lambda@Edge logs and metrics?

Feb 2022 - this post is permanently moved to https://architectfwd.com, my new site, and can be found here  - https://architectfwd.com/architecture/cloud/amazon-web-services-aws/dns-domains-route-53/2022/01/23/aws-cloudfront-lambda-at-edge-cloudwatch-logs/ please go and bookmark that site for all of my future content.

You've created a lambda@Edge function to view or influence the http request/response using a Lambda function, but you cannot see any hits when looking at the monitoring tab in the function definition within AWS Lambda. Is it being hit? Here's how to find out.

Lambda@Edge

I'd created a lambda@edge function bound to a CloudFront distribution and to a specific origin event. In my instance it was to modify the default root object in a request URI for a static site hosted in AWS S3 which is fronted by CloudFront.

You've looked at the metrics in Lambda after CloudFront status for the distribution is Deployed

It looks like the function is not being triggered, why is that. Well, go over to CloudFront, look at the metrics tab and select the Lambda@Edge function, and you will see the region where the function is being triggered from, which you wouldn't be able to see by changing regions on the console.

Here's an example:

Take a look at which regions through hovering over

It looks I'm hitting Sydney, so the best place to go is the CloudWatch logs in Sydney. Take a look in the console by changing regions to Sydney, look at the Log Groups and there are my logs. The same metrics as seen in the CloudFront metrics is available in the CloudWatch metrics.

Cheers

Quintes

Quintes van Aswegen Togaf 9 Certified Architect, Professional Scrum Master I (PSM I) Certified

Connect with me on LinkedIn or Twitter

AWS DNS Route 53 delegating responsibility of subdomain without migrating parent domain

AWS DNS Route 53 delegating responsibility of subdomain without migrating parent domain

Feb 2022 - this post is permanently moved to https://architectfwd.com, my new site, and can be found here  - https://architectfwd.com/architecture/cloud/amazon-web-services-aws/dns-domains-route-53/2022/01/23/aws-dns-route-53-delegating-responsibility-of-subdomain/ please go and bookmark that site for all of my future content.

When you have a domain hosted at a register or other DNS service and want to create a subdomain hosted in Route 53 but do not want to move the parent domain then do the following.

AWS Route 53

In this example, I assume you have a domain, e.g. lovescatsnotarealdomain.com and you do not want to transfer it to Route 53. All you want to do is create a subdomain e.g. mysubdomain.lovescatsnotarealdomain.com hosted and registered within Route 53.

In Route 53, create a new hosted zone mysubdomain.lovescatsnotarealdomain.com. You will be provided a SOA record and NS records in this hosted zone. Create a further subdomain record set in this domain if you so choose at a later time.

Do not create a hosted zone for lovescatsnotarealdomain.com in Route 53 for this scenario.

Update DNS Service

Copy the 4 nameservers from the record created above. At your domain register / DNS Service proceed to create 4 NS records for the subdomain - do not create a CNAME at the DNS Service, only NS records.

Wait. For DNS that is.

In the meanwhile create either an A record or an Alias in the Route 53 hosted zone for the domain. That is,
a) create an EC2 and assign the A to the IP address or
b) map an ELB via an Alias.

Wait. For DNS.

DNS...

At some point running a DIG NS mysubdomain.lovescatsnotarealdomain.com will result in NXDOMAIN error, but eventually you will get a full result showing the resulting NS changes.

Open mysubdomain.lovescatsnotarealdomain.com in a browser and you should be greeted with the service you configured against the subdomain in an earlier step.

This makes it really easy and no need to migrate the entire domain zone to Route 53. A really flexible option.

Cheers

Quintes

Quintes van Aswegen Togaf 9 Certified Architect, Professional Scrum Master I (PSM I) Certified

Connect with me on LinkedIn or Twitter

AWS Lambda function created via cloudformation doesn't log

AWS Lambda function created via cloudformation doesn't log

Feb 2022 - this post is permanently moved to https://architectfwd.com, my new site, and can be found here  - https://architectfwd.com/architecture/cloud/amazon-web-services-aws/lambda/2022/01/23/aws-lambda-function-created-via-cloudformation-doesnt-log/ please go and bookmark that site for all of my future content.

I provisioned new lambda functions via AWS CloudFormation but used an existing service role for lambda execution, however found that no logs were being created. Here's how to fix.

IAM 

Go to the role in IAM, edit the policy and add the resource (the new lambda) 

"Resource": [

"Existing...",

"arn:aws:logs:REGION:XXXX:log-group:/aws/lambda/function-name-here:*"

]

Review and apply.

Log group created and contains logs

Immediately after updating the service role policy to add the resource, execute the function and the CloudWatch log group should be created and populated

Cheers

Quintes

Connect with me on LinkedIn or Twitter

AWS Cognito User Pools, Lambda and Box integration

AWS Cognito User Pools, Lambda and Box integration

Feb 2022 - this post is permanently moved to https://architectfwd.com, my new site, and can be found here  - https://architectfwd.com/architecture/cloud/amazon-web-services-aws/cognito/user-pools/2022/01/23/aws-cognito-user-pools-lambda-and-box/ please go and bookmark that site for all of my future content.

In my previous posts I have been using Azure functions and B2C. I had a use case I wanted to try out and stood up an AWS Cognito user pool with 2 Lambda functions connecting to a box app using box sample code[1]. The process was simple and I managed to stand up the site really quickly, thus very impressed - I'd been keen on using Cognito for a while as an identity pool, and only created my AWS account the day before so all in all a great experience.

Here's what the solution would look like:

Cognito

I created a sign in / sign up policy similar to the B2C and the pool config was really easy. I created and linked up a box.com app.

I was then tasked with the box-specific lambda functions for post authentication and for creating the user in box.

Lambda 

2 Lambda and a couple of roles later and I was connected up. I used a sample angular app, wired up the AWS and box config and was A for away, except I had to increase the one of the function's timeout to 5 seconds once I stood up the angular app in Azure, it kept timing out. Cognito User Pool Lambda functions must respond within 5 seconds, not configurable.

I also needed to create roles for the Cognito and Lambda integration, specifically the first needed to be a service role, specifically a AWS lambda basic execution role. It probably needs Log policies. The second role needed a little more:

An API gateway was needed for lambda proxying to the token exchange function with box

I also needed an authorizer for the Cognito pools

CORS

CORS was a nuisance, I ended up writing headers back in all responses, just couldn't get it to work otherwise. the origin should not be a *, I know. I'll fix that, any anyway the box.com app config provides one more CORS setting which is tied to the correct domain.

Working app

It helped that I had some sample code from box. With all this configured I have a custom user pool of users who each get their own folder in a box.com instance where they can upload documents to.

I stood this up in an evening, really impressed by the AWS Cognito User Pool service and the simplicity of the interfaces. The lambda interface is awesome to use. Box.com app config is simple, and I am a long time box.com user so I think their user experience is great in general. 

Closing

I want to spend more time with AWS. I may continue with the Azure B2C as exploratory and rather throw my efforts in this direction.

References

[1] box samples on github

Cheers

Quintes

Connect with me on LinkedIn or Twitter