Создание aws role ,s3 buckets и lambda function кодом на джаве

Вот есть хороший туториал на сайте AWS(правда он без кусков кода, только команды для AWS CLI):
https://docs.aws.amazon.com/lambda/latest/dg/with-s3-example.html

Я взял их туториал и добавил немного описания и кода:

В туториале создаем 2 бакета, лямбду, в первый бакет закачиваем файлы(фото), срабатывает наш триггер(на создание или загрузку фото в бакет) и вызывает лямбду, внтури этой лямбды(можете сделать свою логику) изменяет фото(уменьшает размер) и эти измененные фото загружает во второй бакет.

Flow:

• Создаем бакеты
• Создаем policy
• Создаем role
• Прикрепляем policy к role (attachRolePolicy)
• Создаем lambda с этой role
• Наделяем lambda permissions
• Прикручиваем trigger, с помощью notificationConfiguration в 1 бакете

1.Create buckets(sourceBucket, destinationBucket) and upload a sample object.

AWS java SDK v2:
https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/javav2/example_code/s3/src/main/java/com/example/s3/S3BucketOps.java

2.Create the IAM Policy:

Create an IAM policy that defines the permissions for the Lambda function. The required permissions include:

• Get the object from the source S3 bucket.

• Put the modified object into the target S3 bucket.

To create an IAM Policy:(also you need to define policy name. For example: MyLambdaS3Policy)(json вставляется при создании policy объекта)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::sourceBucket/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::destinationBucket/*"
        }
    ]
} 

Create trust policy:(name - myTrustPolicy)(json вставляется в role объект)

The trust-policy.json file is a JSON file in the current directory that defines the trust policy for the role. This trust policy allows Lambda to use the role's permissions by giving the service principal lambda.amazonaws.com permission to call the AWS Security Token Service AssumeRole action.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

3.Create the execution role:(Attach the policy to the role)

Create the execution role that gives your function permission to access AWS resources.

Create a role with the following properties:

• Trusted entity – AWS Lambda
• Permissions – MyLambdaS3Policy
• Role name – my-lambda-s3-role

The AWSLambdaS3Policy policy has the permissions that the function needs to manage objects in Amazon S3.

https://stackoverflow.com/questions/62645596/how-to-create-aws-role-with-permission-using-java-sdk

https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/javav2/example_code/iam/src/main/java/com/example/iam/CreatePolicy.java

4.Create the function:

Для создания Lambda функции надо:

• functionName - the name of the Lambda function
• filePath - the path to the ZIP or JAR where the code is located
• role - the role ARN that has Lambda permissions(arn:aws:iam::account-id:role/role-name-with-path)Example arn:aws:iam::123456789012:role/example-role
• handler - the fully qualifed method name (for example, example.Handler::handleRequest)

The function knows the source bucket name and the key name of the object from the event data it receives as parameters. If the object is a .jpg or a .png, the code creates a thumbnail and saves it to the target bucket.

Код Handler:

https://github.com/awsdocs/aws-lambda-developer-guide/blob/master/sample-apps/s3-java/src/main/java/example/Handler.java

AWS java SDK v2:

https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/javav2/example_code/lambda/src/main/java/com/example/lambda/CreateFunction.java

4.To create a deployment package:(jar в нашем случае)

The deployment package is a .zip file containing your Lambda function code and dependencies.

https://stackoverflow.com/questions/574594/how-can-i-create-an-executable-jar-with-dependencies-using-maven

5.Configure Amazon S3 to publish events:

In this step, you add the remaining configuration so that Amazon S3 can publish object-created events to AWS Lambda and invoke your Lambda function. You do the following in this step:

• Add permissions to the Lambda function access policy to allow Amazon S3 to invoke the function.
• Add notification configuration to your source bucket. In the notification configuration, you provide the following:
• Event type for which you want Amazon S3 to publish events. For this tutorial, you specify the s3:ObjectCreated:* event type so that Amazon S3 publishes events when objects are created.
• Lambda function to invoke

AWS CLI:

aws lambda add-permission 
--function-name CreateThumbnail 
--principal s3.amazonaws.com 
--statement-id s3invoke 
--action "lambda:InvokeFunction" 
--source-arn arn:aws:s3:::sourcebucket 
--source-account account-id

AWS java SDK v2:

LmabdaClient lambdaClient = LambdaClient.builder()
                .region(region)
                .build();
lambdaClient.addPermission(AddPermissionRequest.builder()
                .functionName(functionName)
                .principal("s3.amazonaws.com")
                .statementId("s3invoke ")
                .action("lambda:InvokeFunction")
                .sourceArn()//arn:aws:s3:::sourcebucket
                .sourceAccount()//account id
                .build());

6.Add notification configuration on the source bucket to request Amazon S3 to publish object-created events to Lambda:

Enabling and configuring event notifications:

To enable and configure event notifications for an S3 bucket

• Choose the name of the bucket that you want to enable events for.
• Navigate to the Event Notifications section and choose Create event notification.
• In the General configuration section, specify descriptive event name for your event notification. Optionally, you can also specify a prefix and a suffix to limit the notifications to objects with keys ending in the specified characters.
• Enter a description for the Event name. If you don't enter a name, a Globally Unique Identifier (GUID) will be generated and used for the name.
• To optionally filter event notifications by prefix, enter a Prefix. For example, you can set up a prefix filter so that you receive notifications only when files are added to a specific folder (for example, images/).
• To optionally filter event notifications by suffix, enter a Suffix.

In the Event types section, select one or more event types for which you want to receive notifications. For a listing of the event types, see Event notification types.

In the Destination section, choose the event notification destination:

• Select the destination type: Lambda Function, SNS Topic, or SQS Queue.
• After you choose your destination type, choose a function, topic, or queue from the dropdown list.

AWS java SDK v2:

S3Client s3Client = S3Client.builder()
                .region(AWS_REGION)
                .credentialsProvider(ProfileCredentialsProvider.create())
                .build();
s3Client.putBucketNotificationConfiguration(PutBucketNotificationConfigurationRequest.builder()
                .bucket(bucketName)
                .notificationConfiguration(NotificationConfiguration.builder()
                        .lambdaFunctionConfigurations(LambdaFunctionConfiguration.builder()
                                .lambdaFunctionArn()//arn:aws:lambda:us-east-1:111111111111:function:myFunction
                                .events(Event.S3_OBJECT_CREATED)
                                .build())
                        .build())
                .build());

Замечания:

• Внимательно смотрите какую версию aws java sdk v1 или v2 вы используете
• При создании лямбды, вы ей передаете параметры, один из которых, является Role, и если вы создаете Role с помощью IAMClient c Region(Region.AWS_GLOBAL), и при этом у вас в коде последовательно сразу создаются роль и потом лямбда, и вы эту передаете в лямбду, то роль еще не успела полностью проинициализироваться во всех регионах aws, так как стоит (Region.AWS_GLOBAL) и будет вылетать ошибка. Поэтому нужно подождать этой инициализации(с помощью Waiters aws java sdk v2 или явно усыпить поток Thread.sleep(), или еще как нибудь).
• Для лямбды использующий язык java поставьте в настройках timeout и memory побольше дефолтных не хватит
• Так же почитайте на сайте aws bucket, lambda и др сервисы, которые вы использутет про лимиты(например Lambda limits).