I need a way to log API gateway deployments (date/time, user, swagger diff etc.). Is there an event thats fired that i can attach a lambda to, or alternatively is this information already available on the dashboard somewhere?
As Krishna mentioned, CloudTrail can capture API events (both from the AWS console as well as the AWS APIs) for API Gateway, including the deployment of APIs. Since CloudTrail stores the events in S3, you can take advantage of S3 bucket notifications as a means to trigger your Lambda function.
Related
Is there any way to capture AWS Lambda's own CRUD events like lambda create, lambda update, lambda delete
I am trying to create an alert system to slack channel on every lambda update
CloudTrail:
Lambda is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in Lambda. CloudTrail captures API calls for Lambda as events. The calls captured include calls from the Lambda console and code calls to the Lambda API operations.
Additionally, many services (but not Lambda) send change events directly to EventBridge. EventBridge is notified when an RDS Instance is deleted, for instance. For finer-grained monitoring, consider the AWS Config service.
I have an AWS Lambda function that takes in and processes logs from CloudWatch Logs that are sent to specific log groups. The thing is, I may need to add more triggers as more log groups are created. The only way I have found to create a trigger for a specific log group is to use the AWS Lambda console and the AWS CloudFront console. Is it possible to create a trigger for an AWS Lambda function programmatically? For instance, in some Java code?
Yes, one of the common ways of triggering server-less functions is using endpoints. I believe you can expose an API endpoint from the Function's console using a an API Gateway, and call this endpoint URL from your java code or whatever programmatic entity you wish.
Suppose multiple aws services are running (like EC2,S3) and If someone changes the configuration of these services , I want to know immediately and want to pull the updated configuration. So how can i listen to these services to pull configuration immediately . I went through couple of options like aws SNS and all. But i don't want to implement this using any aws services for this.
I am using spring boot application. Any help is appreciated , Thanks in advance.
The two services you should be interested in are:
AWS CloudTrail:
AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs.
AWS Config:
AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time.
You can also configure Amazon CloudWatch Events rules that trigger when a particular API call is made (eg when a user changes some configuration). This could trigger a notification, a Lambda function, etc.
See:
Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail - Amazon CloudWatch Events
How to monitor AWS account activity with Cloudtrail, Cloudwatch Events and Serverless
I'm trying to trigger a Lambda function when I click on deploy in the API-Gateway console to deploy API on a stage.
I already tried with cloudwatch rule, but there is no event patterns for API-Gateway deployment.
My questions are:
Is it possible to trigger a lambda function when I click on the deploy button on API-Gateway console?
If yes, how can I do that?
Thank you
Unfortunately, there is no straight forward way for achieving this.
CloudWatch rule will not help as there is no logging generated on API deployment.
The only thing left behind a deploy action is a CloudTrail event.
The best solution I could think for this involves Amazon EventBridge which is an event bus managed service provided by AWS.
In EventBridge you can create rules that collect specific events from various AWS services within (and beyond) your AWS account.
API Gateway is not one of these services, but CloudTrail is! (For reference here is a list of the EventBridge supported services)
An API deployment in API Gateway emits an event to CloudTrail which has CreateDeployment as event name and apigateway.amazonaws.com as event source. The event payload also includes data such as the restApiId, the stage, the IAM identity details of the deploying agent and more.
Note, that there is not much documentation around CloudTrail event schemas, but the event would look something like the one listed here
Now, we need to create an EventBridge rule that captures such CloudTrail events.
This is a very good, step by step, guide on how to do this.
For your use case, you need to choose API Gateway as the service name and add CreateDeployment as a Specific Operation as shown in the screenshot below:
Once the EventBridge rule is set up then you can directly attach it as a trigger in any Lambda function. See relevant tutorial.
Downsides
The above solution cannot be applied on the individual API level. The EventBridge rule will capture the deployments of all APIs of any stage in a specific region. Additional filtering has to be implemented within the lambda logic.
This will lead to unnecessary lambda executions if the solution is scoped for anything less than all the APIs of a region. However as we're talking about API deployments, the extra lambda execution cost will be negligible.
I want to trigger an AWS lambda function upon the creation/modification of an API in AWS API gateway. Any idea what are the right events to catch?
As noted, API Gateway does not generate events directly. Additionally, it does not appear that you can configure an event rule based on CloudTrail logs for API Gateway either. I'll make sure to forward your request to the CloudWatch Events team as a feature request.
Since there is no event rule of AWS APIGateway in AWS CloudWatch and it does not appear log in AWS CloudTrail, so we can not achieve it now.