コンテナ利用者に捧げる AWS Lambda の新しい開発方式 !

$ REGION=$(aws configure get region)
$ ACCOUNTID=$(aws sts get-caller-identity --output text --query Account)

import json

def handler(event, context):
    return {
        "statusCode": 200,
        "body": json.dumps(
            {
                "message": "hello world",
            }
        ),
    }

$ zip package.zip app.py

$ aws iam create-role --role-name lambda-ex \
--assume-role-policy-document '{"Version": "2012-10-17","Statement": [{ "Effect": "Allow", "Principal": {"Service": "lambda.amazonaws.com"}, "Action": "sts:AssumeRole"}]}'

$ ROLE_ARN=arn:aws:iam::${ACCOUNTID}:role/lambda-ex

$ aws lambda create-function --function-name func1 \
--runtime python3.8 \
--handler app.handler \
--zip-file fileb://./package.zip \
--role ${ROLE_ARN} 

$ aws lambda create-function --function-name func1 \
> --runtime python3.8 \
> --handler app.handler \
> --zip-file fileb://./package.zip \
> --role ${ROLE_ARN} 
{
    "FunctionName": "func1",
    "FunctionArn": "arn:aws:lambda:${REGION}:${ACCOUNTID}:function:func1",
    "Runtime": "python3.8",
    "Role": "arn:aws:iam::${ACCOUNTID}:role/<Role Name>",
    "Handler": "app.handler",
    "CodeSize": 290,
    "Description": "",
    "Timeout": 3,
    "MemorySize": 128,
    "LastModified": "2021-02-08T14:21:05.688+0000",
    "CodeSha256": "SuXK7YhVmzzklYlNET8KKXFzzxpkgkJmzrxWbgPEmn0=",
    "Version": "$LATEST",
    "TracingConfig": {
        "Mode": "PassThrough"
    },
    "RevisionId": "34ca3994-31a5-4d7d-91a6-0d8152c5f0c1",
    "State": "Active",
    "LastUpdateStatus": "Successful",
    "PackageType": "Zip"
}

aws lambda invoke --function-name func1 output ; cat output
{
    "StatusCode": 200,
    "ExecutedVersion": "$LATEST"
}
{"statusCode": 200, "body": "{\"message\": \"hello world\"}"}

$ touch Dockerfile

FROM public.ecr.aws/lambda/python:3.8
COPY app.py   ./
CMD ["app.handler"]  

$ docker build -t func1 .
Sending build context to Docker daemon  7.168kB
Step 1/3 : FROM public.ecr.aws/lambda/python:3.8
 ---> 96d8701bf5d1
Step 2/3 : COPY app.py   ./
 ---> a3121c365747
Step 3/3 : CMD ["app.handler"]
 ---> Running in 458d223e3f30
Removing intermediate container 458d223e3f30
 ---> 91a66a0bc1ed
Successfully built 91a66a0bc1ed
Successfully tagged func1:latest

$ aws ecr create-repository --repository-name func1 
{
    "repository": {
        "repositoryArn": "arn:aws:ecr:${REGION}:${ACCOUNTID}:repository/func1",
        "registryId": "${ACCOUNTID}",
        "repositoryName": "func1",
        "repositoryUri": "${ACCOUNTID}.dkr.ecr.${REGION}.amazonaws.com/func1",
        "createdAt": "2021-02-09T00:12:39+09:00",
        "imageTagMutability": "MUTABLE",
        "imageScanningConfiguration": {
            "scanOnPush": false
        },
        "encryptionConfiguration": {
            "encryptionType": "AES256"
        }
    }
}

$ docker tag func1:latest \
  ${ACCOUNTID}.dkr.ecr.${REGION}.amazonaws.com/func1:latest

$ aws ecr get-login-password | docker login --username AWS --password-stdin ${ACCOUNTID}.dkr.ecr.${REGION}.amazonaws.com
Login Succeeded

$ docker push ${ACCOUNTID}.dkr.ecr.${REGION}.amazonaws.com/func1:latest
The push refers to repository [${ACCOUNTID}.dkr.ecr.${REGION}.amazonaws.com/func1]
29fe8a4ae381: Pushed 
20b4eff3dd4d: Pushing  68.11MB/92.13MB
11284767d41d: Pushing  87.48MB/199.7MB
d6fa53d6caa6: Pushed 
b09e76f63d5d: Pushed 
0acabcf564c7: Pushed 
f2342b1247df: Pushing  125.9MB/294.9MB

29fe8a4ae381: Pushed 
20b4eff3dd4d: Pushed 
11284767d41d: Pushed 
d6fa53d6caa6: Pushed 
b09e76f63d5d: Pushed 
0acabcf564c7: Pushed 
f2342b1247df: Pushed 
latest: digest: sha256:ef29dcb71c314e61b390a48793c7291c44cd0712e9e3e16a88a5c851a9724223 size: 1788

DIGEST=$(aws ecr list-images --repository-name func1 --out text --query 'imageIds[?imageTag==`latest`].imageDigest')

aws lambda create-function \
     --function-name func1-container  \
     --package-type Image \
     --code ImageUri=${ACCOUNTID}.dkr.ecr.${REGION}.amazonaws.com/func1@${DIGEST} \
     --role ${ROLE_ARN}

$ aws lambda create-function \
>      --function-name func1-container  \
>      --package-type Image \
>      --code ImageUri=${ACCOUNTID}.dkr.ecr.${REGION}.amazonaws.com/func1@${DIGEST} \
>      --role ${ROLE_ARN}
{
    "FunctionName": "func1-container",
    "FunctionArn": "arn:aws:lambda:${REGION}:${ACCOUNTID}:function:func1-container",
    "Role": "arn:aws:iam::${ACCOUNTID}:role/<Role Name>",
    "CodeSize": 0,
    "Description": "",
    "Timeout": 3,
    "MemorySize": 128,
    "LastModified": "2021-02-08T15:56:11.998+0000",
    "CodeSha256": "ef29dcb71c314e61b390a48793c7291c44cd0712e9e3e16a88a5c851a9724223",
    "Version": "$LATEST",
    "TracingConfig": {
        "Mode": "PassThrough"
    },
    "RevisionId": "81fc0fd1-3011-4a67-ba08-65d143343aed",
    "State": "Pending",
    "StateReason": "The function is being created.",
    "StateReasonCode": "Creating",
    "PackageType": "Image"
}

$ aws lambda invoke --function-name func1-container output ; cat output
{
    "StatusCode": 200,
    "ExecutedVersion": "$LATEST"
}
{"statusCode": 200, "body": "{\"message\": \"hello world\"}"}