AWS Lambda関数をlambrollとGitHub Actionsでデプロイしてみた ~ fujiwara-ware OSS ~

$ brew install fujiwara/tap/lambroll

$ mkdir hello
$ cd hello
$ lambroll init --function-name hello --download
2024/08/17 03:30:23 [info] lambroll v1.0.6
2024/08/17 03:30:23 [info] function hello found
2024/08/17 03:30:23 [info] downloading function.zip
2024/08/17 03:30:23 [info] creating .lambdaignore
2024/08/17 03:30:23 [info] creating function.json

$ unzip function.zip
Archive:  function.zip
replace function.json? [y]es, [n]o, [A]ll, [N]one, [r]ename: A
  inflating: function.json           
  inflating: function.zip            
  inflating: lambda_function.py     

$ ls -1
function.json
function.zip
lambda_function.py

$ cat function.json
{
  "Architectures": [
    "x86_64"
  ],
  "EphemeralStorage": {
    "Size": 512
  },
  "FunctionName": "hello",
  "Handler": "lambda_function.lambda_handler",
  "LoggingConfig": {
    "LogFormat": "Text",
    "LogGroup": "/aws/lambda/hello"
  },
  "MemorySize": 128,
  "Role": "arn:aws:iam::123456789012:role/test_lambda_basic_execution_role",
  "Runtime": "python3.12",
  "SnapStart": {
    "ApplyOn": "None"
  },
  "Timeout": 3,
  "TracingConfig": {
    "Mode": "PassThrough"
  }
}

{
  ...
  "MemorySize": 128,
  "Role": "{{ tfstate `aws_iam_role.lambda_role.arn` }}",
  ...
}

$ lambroll render --tfstate=s3://YOUR-BUCKET/path/to/terraform.tfstate
{
  ...
  "MemorySize": 128,
  "Role": "Role": "arn:aws:iam::123456789012:role/test_lambda_basic_execution_role",
  ...
}

$ lambroll diff --tfstate=s3://YOUR-BUCCKET/path/to/terraform.tfstate
2024/08/17 03:48:41 [info] lambroll v1.0.6
--- arn:aws:lambda:ap-northeast-1:123456789012:function:hello:$LATEST
+++
@@ -17,7 +17,7 @@
   "SnapStart": {
     "ApplyOn": "None"
   },
-  "Timeout": 3,
+  "Timeout": 30,
   "TracingConfig": {
     "Mode": "PassThrough"
   }

$ cat lambda_function.py
def lambda_handler(event, context):
    return("hello world from lambroll!")

$ lambroll deploy --tfstate=s3://YOUR-BUCCKET/path/to/terraform.tfstate
2024/08/17 03:49:05 [info] lambroll v1.0.6
2024/08/17 03:49:05 [info] starting deploy function hello
2024/08/17 03:49:05 [info] creating zip archive from .
...
2024/08/17 03:49:14 [info] deployed version 2
2024/08/17 03:49:14 [info] updating alias set current to version 2
2024/08/17 03:49:14 [info] alias updated

$ lambroll versions --tfstate=s3://YOUR-BUCCKET/path/to/terraform.tfstate
2024/08/17 03:50:17 [info] lambroll v1.0.6
+---------+----------------------+---------+------------+
| VERSION |    LAST MODIFIED     | ALIASES |  RUNTIME   |
+---------+----------------------+---------+------------+
|       1 | 2024-08-14T03:43:01Z |         | python3.12 |
|       2 | 2024-08-17T03:49:07Z | current | python3.12 |
| $LATEST | 2024-08-17T03:49:07Z |         | python3.12 |
+---------+----------------------+---------+------------+

$ lambroll invoke --payload='{}' --tfstate=s3://YOUR-BUCCKET/path/to/terraform.tfstate
2024/08/17 03:52:46 [info] lambroll v1.0.6
"hello world from lambroll!"
2024/08/17 03:52:46 [info] StatusCode:200
2024/08/17 03:52:46 [info] ExecutionVersion:$LATEST

.github
└── workflows
    └── deploy.yaml
└── lambda
    └── hello
        ├── function.json
        └── lambda_function.py

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:Your-Account/Your-Repository:*"
                }
            }
        }
    ]
}

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  GitHubRepoName:
    Description: "GitHub repository (format: owner/repo)"
    Type: String
    Default: "owner/repo"
Resources:
  LambdaDeployRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Federated: !Sub 'arn:aws:iam::${AWS::AccountId}:oidc-provider/token.actions.githubusercontent.com'
            Action: "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringLike:
                token.actions.githubusercontent.com:sub: !Sub 'repo:${GitHubRepoName}:*'
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
Outputs:
  RoleArn:
    Description: "The ARN of the IAM role"
    Value: !GetAtt LambdaDeployRole.Arn

name: deploy lambda

on:
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: fujiwara/lambroll@v1
        with:
          version: v1.0.6
      - name: Git clone the repository
        uses: actions/checkout@v4
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v3
        with:
          aws-region: ap-northeast-1
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
      - run: lambroll deploy
        working-directory: lambda/hello/