Amazon API Gateway と AWS Lambda 関数の CI/CD パイプラインをつくる [AWS SAM + AWS CloudFormation]

こんにちは、SCSK の広野です。

私は Amazon API Gateway と AWS Lambda 関数の CI/CD を学習する社内研修を開催しておりまして、研修用 CI/CD パイプラインを AWS Code シリーズのサービスと AWS SAM (Serverless Application Model)、AWS CloudFormation で作成しています。

本記事では、その環境を抜粋して AWS CloudFormation でデプロイできるようにしたものを紹介します。

アーキテクチャ

以下のように、AWS サービスを組み合わせて作成しています。

• 開発環境は AWS Cloud9 を使用。
• ソースコード管理に AWS CodeCommit を使用。Lambda 関数コードだけでなく、ビルド設定ファイル buildspec.yml と AWS SAM テンプレートファイル template.yml もセットで管理する。
• コードの変更検知に Amazon EventBridge を使用。AWS CodeCommit のソースコードが変更されると CI/CD パイプラインを開始させる。
• CI/CD パイプラインに AWS CodePipeline を使用。ビルドステージで AWS CodeBuild、AWS SAM を、デプロイステージで AWS CloudFormation を使用。AWS SAM で API Gateway と Lambda 関数をデプロイする。
• パイプラインの各ステージで作成される成果物 (アーティファクト) 置き場に Amazon S3 を使用。
  ※図は簡略化していますが 2つのバケットがあります。SAM テンプレート (API Gateway と Lambda 関数リソース作成) と Lambda 関数コードの ZIP で。

CI/CD パイプライン準備

CI/CD パイプラインは、以下の AWS CloudFormation テンプレートを流すことでデプロイできます。※ Cloud9 や VPC は除く

AWSTemplateFormatVersion: 2010-09-09
Description: The CloudFormation template that creates a S3 bucket, a CI/CD environment with Code service series, and relevant IAM roles.

Parameters:
# ------------------------------------------------------------#
# Input Parameters
# ------------------------------------------------------------#
  YourID:
    Type: String
    Description: Please fill your full name and today's date, or another unique name. (e.g. yujihirono20231202) You can not use any upper cases and special characters.
    MaxLength: 100
    MinLength: 5

Resources:
# ------------------------------------------------------------#
# CodeCommit Repository
# ------------------------------------------------------------#
  SampleProjectRep:
    Type: AWS::CodeCommit::Repository
    Properties:
      RepositoryName: !Sub SampleProject-${YourID}
      Tags:
        - Key: Cost
          Value: !Ref YourID

# ------------------------------------------------------------#
# EventBridge Rule for Starting CodePipeline
# ------------------------------------------------------------#
  SampleProjectRepPipelineEventsRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub SampleProject-StartPipelineRule-${YourID}
      EventBusName: !Sub "arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/default"
      EventPattern:
        source:
          - aws.codecommit
        resources:
          - !GetAtt SampleProjectRep.Arn
        detail-type:
          - "CodeCommit Repository State Change"
        detail:
          event:
            - referenceCreated
            - referenceUpdated
          referenceName:
            - master
      State: ENABLED
      Targets:
        - Arn:
            Fn::Join:
              - ""
              - - "arn:"
                - Ref: AWS::Partition
                - ":codepipeline:"
                - Ref: AWS::Region
                - ":"
                - Ref: AWS::AccountId
                - ":"
                - Ref: Pipeline
          Id: Target0
          RoleArn: !GetAtt PipelineEventsRole.Arn
    DependsOn:
      - PipelineEventsRole
      - Pipeline

# ------------------------------------------------------------#
# CodeBuild Project Role (IAM)
# ------------------------------------------------------------#
  BuildProjectRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub BldPrjRole-${YourID}
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
        Version: "2012-10-17"

# ------------------------------------------------------------#
# CodeBuild Project Role Policy (IAM)
# ------------------------------------------------------------#
  BuildProjectRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub BldPrjRolePolicy-${YourID}
      PolicyDocument:
        Statement:
          - Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Effect: Allow
            Resource:
              - Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":logs:"
                    - Ref: AWS::Region
                    - ":"
                    - Ref: AWS::AccountId
                    - :log-group:/aws/codebuild/
                    - Ref: BuildProject
                    - :*
              - Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":logs:"
                    - Ref: AWS::Region
                    - ":"
                    - Ref: AWS::AccountId
                    - :log-group:/aws/codebuild/
                    - Ref: BuildProject
          - Action:
              - codebuild:BatchPutCodeCoverages
              - codebuild:BatchPutTestCases
              - codebuild:CreateReport
              - codebuild:CreateReportGroup
              - codebuild:UpdateReport
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - ":codebuild:"
                  - Ref: AWS::Region
                  - ":"
                  - Ref: AWS::AccountId
                  - :report-group/
                  - Ref: BuildProject
                  - -*
          - Action: s3:PutObject
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - !GetAtt PipelinePackageBucket.Arn
                  - /*
          - Action:
              - s3:Abort*
              - s3:DeleteObject*
              - s3:GetBucket*
              - s3:GetObject*
              - s3:List*
              - s3:PutObject
              - s3:PutObjectLegalHold
              - s3:PutObjectRetention
              - s3:PutObjectTagging
              - s3:PutObjectVersionTagging
            Effect: Allow
            Resource:
              - !GetAtt PipelineArtifactBucket.Arn
              - Fn::Join:
                  - ""
                  - - !GetAtt PipelineArtifactBucket.Arn
                    - /*
        Version: "2012-10-17"
      Roles:
        - Ref: BuildProjectRole
    DependsOn:
      - BuildProjectRole
      - PipelineArtifactBucket
      - PipelinePackageBucket

# ------------------------------------------------------------#
# CodeBuild Project
# ------------------------------------------------------------#
  BuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: !Sub SampleProjectBuild-${YourID}
      Artifacts:
        Type: CODEPIPELINE
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        EnvironmentVariables:
          - Name: S3_BUCKET
            Type: PLAINTEXT
            Value:
              Ref: PipelinePackageBucket
        Image: "aws/codebuild/standard:7.0"
        ImagePullCredentialsType: CODEBUILD
        PrivilegedMode: false
        Type: LINUX_CONTAINER
      ServiceRole: !GetAtt BuildProjectRole.Arn
      Source:
        Type: CODEPIPELINE
      Cache:
        Type: NO_CACHE
      Tags:
        - Key: Cost
          Value: !Ref YourID
    DependsOn:
      - BuildProjectRole

# ------------------------------------------------------------#
# CodePipeline Build Package Bucket (S3)
# ------------------------------------------------------------#
  PipelinePackageBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub codepipeline-package-${YourID}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Cost
          Value: !Ref YourID

# ------------------------------------------------------------#
# CodePipeline Artifact Bucket (S3)
# ------------------------------------------------------------#
  PipelineArtifactBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub codepipeline-artifact-${YourID}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Cost
          Value: !Ref YourID

# ------------------------------------------------------------#
# CodePipeline Role (IAM)
# ------------------------------------------------------------#
  PipelineRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub PlRole-${YourID}
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: codepipeline.amazonaws.com
        Version: "2012-10-17"

# ------------------------------------------------------------#
# CodePipeline Role Policy (IAM)
# ------------------------------------------------------------#
  PipelineRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub PlRolePolicy-${YourID}
      PolicyDocument:
        Statement:
          - Action:
              - s3:Abort*
              - s3:DeleteObject*
              - s3:GetBucket*
              - s3:GetObject*
              - s3:List*
              - s3:PutObject
              - s3:PutObjectLegalHold
              - s3:PutObjectRetention
              - s3:PutObjectTagging
              - s3:PutObjectVersionTagging
            Effect: Allow
            Resource:
              - !GetAtt PipelineArtifactBucket.Arn
              - Fn::Join:
                  - ""
                  - - !GetAtt PipelineArtifactBucket.Arn
                    - /*
          - Action: sts:AssumeRole
            Effect: Allow
            Resource:
              - !GetAtt PipelineBuildCodeBuildActionRole.Arn
              - !GetAtt PipelineDeployCreateChangeSetActionRole.Arn
              - !GetAtt PipelineDeployExecuteChangeSetActionRole.Arn
              - !GetAtt PipelineSourceCodeCommitActionRole.Arn
        Version: "2012-10-17"
      Roles:
        - Ref: PipelineRole
    DependsOn:
      - PipelineRole
      - PipelineArtifactBucket
      - PipelineBuildCodeBuildActionRole
      - PipelineDeployCreateChangeSetActionRole
      - PipelineDeployExecuteChangeSetActionRole
      - PipelineSourceCodeCommitActionRole

# ------------------------------------------------------------#
# CodePipeline
# ------------------------------------------------------------#
  Pipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: !Sub SampleProjectPipeline-${YourID}
      RoleArn: !GetAtt PipelineRole.Arn
      Stages:
        - Actions:
            - ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeCommit
                Version: "1"
              Configuration:
                RepositoryName: !GetAtt SampleProjectRep.Name
                BranchName: master
                PollForSourceChanges: false
              Name: CodeCommit
              OutputArtifacts:
                - Name: Artifact_Source_CodeCommit
              RoleArn: !GetAtt PipelineSourceCodeCommitActionRole.Arn
              RunOrder: 1
          Name: Source
        - Actions:
            - ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: "1"
              Configuration:
                ProjectName:
                  Ref: BuildProject
              InputArtifacts:
                - Name: Artifact_Source_CodeCommit
              Name: CodeBuild
              OutputArtifacts:
                - Name: Artifact_Build_CodeBuild
              RoleArn: !GetAtt PipelineBuildCodeBuildActionRole.Arn
              RunOrder: 1
          Name: Build
        - Actions:
            - ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                StackName: !Sub SampleProject-Stack-${YourID}
                Capabilities: CAPABILITY_NAMED_IAM
                RoleArn: !GetAtt PipelineDeployCreateChangeSetRole.Arn
                ActionMode: CHANGE_SET_REPLACE
                ChangeSetName: !Sub SampleProject-Deploy-${YourID}
                TemplatePath: Artifact_Build_CodeBuild::packaged.yaml
                ParameterOverrides: !Sub '{"YourID": "${YourID}"}'
              InputArtifacts:
                - Name: Artifact_Build_CodeBuild
              Name: CreateChangeSet
              RoleArn: !GetAtt PipelineDeployCreateChangeSetActionRole.Arn
              RunOrder: 1
            - ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: CloudFormation
                Version: "1"
              Configuration:
                StackName: !Sub SampleProject-Stack-${YourID}
                ActionMode: CHANGE_SET_EXECUTE
                ChangeSetName: !Sub SampleProject-Deploy-${YourID}
              Name: ExecuteChangeSet
              RoleArn: !GetAtt PipelineDeployExecuteChangeSetActionRole.Arn
              RunOrder: 2
          Name: Deploy
      ArtifactStore:
        Location:
          Ref: PipelineArtifactBucket
        Type: S3
      Tags:
        - Key: Cost
          Value: !Ref YourID
    DependsOn:
      - SampleProjectRep
      - PipelineRoleDefaultPolicy
      - PipelineRole
      - PipelineSourceCodeCommitActionRole
      - PipelineBuildCodeBuildActionRole
      - PipelineDeployCreateChangeSetActionRole
      - PipelineDeployExecuteChangeSetActionRole
      - PipelineArtifactBucket

# ------------------------------------------------------------#
# CodePipeline Source Code Commit Action Role (IAM)
# ------------------------------------------------------------#
  PipelineSourceCodeCommitActionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub PlSrcCcActionRole-${YourID}
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              AWS:
                Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":iam::"
                    - Ref: AWS::AccountId
                    - :root
        Version: "2012-10-17"

# ------------------------------------------------------------#
# CodePipeline Source CodeCommit Action Role Policy (IAM)
# ------------------------------------------------------------#
  PipelineSourceCodeCommitActionRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub PlSrcCcActionRolePolicy-${YourID}
      PolicyDocument:
        Statement:
          - Action:
              - s3:Abort*
              - s3:DeleteObject*
              - s3:GetBucket*
              - s3:GetObject*
              - s3:List*
              - s3:PutObject
              - s3:PutObjectLegalHold
              - s3:PutObjectRetention
              - s3:PutObjectTagging
              - s3:PutObjectVersionTagging
            Effect: Allow
            Resource:
              - !GetAtt PipelineArtifactBucket.Arn
              - Fn::Join:
                  - ""
                  - - !GetAtt PipelineArtifactBucket.Arn
                    - /*
          - Action:
              - codecommit:CancelUploadArchive
              - codecommit:GetBranch
              - codecommit:GetCommit
              - codecommit:GetUploadArchiveStatus
              - codecommit:UploadArchive
            Effect: Allow
            Resource: !GetAtt SampleProjectRep.Arn
        Version: "2012-10-17"
      Roles:
        - Ref: PipelineSourceCodeCommitActionRole
    DependsOn:
      - PipelineArtifactBucket
      - SampleProjectRep
      - PipelineSourceCodeCommitActionRole

# ------------------------------------------------------------#
# CodePipeline Events Role (IAM)
# ------------------------------------------------------------#
  PipelineEventsRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub PlEventsRole-${YourID}
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
        Version: "2012-10-17"

# ------------------------------------------------------------#
# CodePipeline Events Role Policy (IAM)
# ------------------------------------------------------------#
  PipelineEventsRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub PlEventsRolePolicy-${YourID}
      PolicyDocument:
        Statement:
          - Action: codepipeline:StartPipelineExecution
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - ":codepipeline:"
                  - Ref: AWS::Region
                  - ":"
                  - Ref: AWS::AccountId
                  - ":"
                  - Ref: Pipeline
        Version: "2012-10-17"
      Roles:
        - Ref: PipelineEventsRole
    DependsOn:
      - PipelineEventsRole

# ------------------------------------------------------------#
# CodePipeline Build CodeBuild Action Role (IAM)
# ------------------------------------------------------------#
  PipelineBuildCodeBuildActionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub PlBldCbActionRole-${YourID}
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              AWS:
                Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":iam::"
                    - Ref: AWS::AccountId
                    - :root
        Version: "2012-10-17"

# ------------------------------------------------------------#
# CodePipeline Build CodeBuild Action Role Policy (IAM)
# ------------------------------------------------------------#
  PipelineBuildCodeBuildActionRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub PlBldCbActionRolePolicy-${YourID}
      PolicyDocument:
        Statement:
          - Action:
              - codebuild:BatchGetBuilds
              - codebuild:StartBuild
              - codebuild:StopBuild
            Effect: Allow
            Resource: !GetAtt BuildProject.Arn
        Version: "2012-10-17"
      Roles:
        - Ref: PipelineBuildCodeBuildActionRole
    DependsOn:
      - BuildProject
      - PipelineBuildCodeBuildActionRole

# ------------------------------------------------------------#
# CodePipeline Deploy Create ChangeSet Action Role (IAM)
# ------------------------------------------------------------#
  PipelineDeployCreateChangeSetActionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub PlDepCrChsetActionRole-${YourID}
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              AWS:
                Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":iam::"
                    - Ref: AWS::AccountId
                    - :root
        Version: "2012-10-17"

# ------------------------------------------------------------#
# CodePipeline Deploy Create ChangeSet Action Role Policy (IAM)
# ------------------------------------------------------------#
  PipelineDeployCreateChangeSetActionRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub PlDepCrChsetActionRolePolicy-${YourID}
      PolicyDocument:
        Statement:
          - Action: iam:PassRole
            Effect: Allow
            Resource: !GetAtt PipelineDeployCreateChangeSetRole.Arn
          - Action:
              - s3:GetBucket*
              - s3:GetObject*
              - s3:List*
            Effect: Allow
            Resource:
              - !GetAtt PipelineArtifactBucket.Arn
              - Fn::Join:
                  - ""
                  - - !GetAtt PipelineArtifactBucket.Arn
                    - /*
          - Action:
              - cloudformation:CreateChangeSet
              - cloudformation:DeleteChangeSet
              - cloudformation:DescribeChangeSet
              - cloudformation:DescribeStacks
            Condition:
              StringEqualsIfExists:
                cloudformation:ChangeSetName: !Sub SampleProject-Deploy-${YourID}
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - ":cloudformation:"
                  - Ref: AWS::Region
                  - ":"
                  - Ref: AWS::AccountId
                  - !Sub :stack/SampleProject-Stack-${YourID}/*
        Version: "2012-10-17"
      Roles:
        - Ref: PipelineDeployCreateChangeSetActionRole
    DependsOn:
      - PipelineDeployCreateChangeSetRole
      - PipelineArtifactBucket
      - PipelineDeployCreateChangeSetActionRole

# ------------------------------------------------------------#
# CodePipeline Deploy Create ChangeSet Role (IAM)
# ------------------------------------------------------------#
  PipelineDeployCreateChangeSetRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub PlDepCrChsetRole-${YourID}
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
        Version: "2012-10-17"

# ------------------------------------------------------------#
# CodePipeline Deploy Create ChangeSet Role Policy (IAM)
# ------------------------------------------------------------#
  PipelineDeployCreateChangeSetRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub PlDepCrChsetRolePolicy-${YourID}
      PolicyDocument:
        Statement:
          - Action:
              - s3:GetBucket*
              - s3:GetObject*
              - s3:List*
            Effect: Allow
            Resource:
              - !GetAtt PipelineArtifactBucket.Arn
              - Fn::Join:
                  - ""
                  - - !GetAtt PipelineArtifactBucket.Arn
                    - /*
          - Action: "*"
            Effect: Allow
            Resource: "*"
        Version: "2012-10-17"
      Roles:
        - Ref: PipelineDeployCreateChangeSetRole
    DependsOn:
      - PipelineArtifactBucket
      - PipelineDeployCreateChangeSetRole

# ------------------------------------------------------------#
# CodePipeline Deploy Execute ChangeSet Action Role (IAM)
# ------------------------------------------------------------#
  PipelineDeployExecuteChangeSetActionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub PlDepExecChsetActionRole-${YourID}
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              AWS:
                Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":iam::"
                    - Ref: AWS::AccountId
                    - :root
        Version: "2012-10-17"

# ------------------------------------------------------------#
# CodePipeline Deploy Execute ChangeSet Action Role Policy (IAM)
# ------------------------------------------------------------#
  PipelineDeployExecuteChangeSetActionRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub PlDepExecChsetActionRolePolicy-${YourID}
      PolicyDocument:
        Statement:
          - Action:
              - cloudformation:DescribeChangeSet
              - cloudformation:DescribeStacks
              - cloudformation:ExecuteChangeSet
            Condition:
              StringEqualsIfExists:
                cloudformation:ChangeSetName: !Sub SampleProject-Deploy-${YourID}
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - ":cloudformation:"
                  - Ref: AWS::Region
                  - ":"
                  - Ref: AWS::AccountId
                  - !Sub :stack/SampleProject-Stack-${YourID}/*
        Version: "2012-10-17"
      Roles:
        - Ref: PipelineDeployExecuteChangeSetActionRole
    DependsOn:
      - PipelineDeployExecuteChangeSetActionRole

CI/CD パイプライン使用方法

AWS Cloud9 準備

今回は、API Gateway と Lambda 関数をコードで管理します。コードは AWS CodeCommit で管理し、コードの編集は AWS Cloud9 を使用します。あらかじめ CodeCommit の該当するリポジトリ と Cloud9 を連携する必要があります。ここでは、この準備の説明は割愛します。以下の AWS 公式ドキュメントを参考に準備頂けると幸いです。

コードの準備

API Gateway と Lambda 関数をデプロイするために、以下 3 種類のコードファイルを準備します。ファイル名はこの例のまま使用頂いた方が良いです。(CI/CD パイプライン内で指定している都合でw)

• lambda_function.py
• buildspec.yml
• template.yml

以下、それぞれについて解説します。

lambda_function.py

Lambda 関数の実体です。ここでは、サンプルなので現在時刻を返すだけの Python コードになっています。

from datetime import datetime

def lambda_handler(event, context):
  # Get the current date and time
  now = datetime.now()

  # Format the date and time in a readable format (e.g., YYYY-MM-DD HH:MM:SS)
  current_time = now.strftime("%Y-%m-%d %H:%M:%S")

  # Return the current date and time
  return {
    "statusCode": 200,
    "body": current_time
  }

buildspec.yml

ビルドステージで何をするか、を定義したファイルです。

実際のところ、Lambda 関数コードは上述の lambda_function.py をそのまま使用するのでコンパイルすることはありません。API Gateway や Lambda 関数リソースをこの CI/CD パイプラインでデプロイするため、sam build や sam package というコマンドを使用して AWS SAM テンプレートを AWS 側で処理しやすいフォーマットに？若干変更するようです。(変更後ファイルは packaged.yaml) 

version: 0.2
phases:
  install:
    runtime-versions:
      python: 3.11
    commands:
  pre_build:
    commands:
      - sam build
  build:
    commands:
      - sam package --s3-bucket $S3_BUCKET --output-template-file packaged.yaml
artifacts:
  files:
    - packaged.yaml

template.yml

AWS SAM テンプレートファイルです。この中で、デプロイしたい API Gateway と Lambda 関数のリソースを定義しています。

AWS CloudFormation と比べるとかなり少ない行数です。標準的な設定を使用して動くリソースをデプロイしてくれます。

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  SampleProject
Transform:
- AWS::Serverless-2016-10-31
Parameters:
  YourID:
    Type: String
    Default: dummy
Resources:
  SampleFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: lambda_function.lambda_handler
      Runtime: python3.11
      Policies:
        - DynamoDBReadPolicy:
            TableName: YourTableName
      Environment:
        Variables:
          YourID: !Ref YourID
      Events:
        Api:
          Type: Api
          Properties:
            Path: /test
            Method: POST
Outputs:
  ApiEndpoint:
    Description: "APIG Endpoint"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/"

SAM (Serverless Application Model) は AWS CloudFormation よりも簡易にリソースを定義できる分、カスタマイズ性に欠けるので要件によって CloudFormation との使い分けを考える必要があります。

ここでは、全く使用しないのですが Lambda 関数に YourTableName という Amazon DynamoDB テーブルの Read Only 権限を与えています。このように AWS があらかじめ用意した権限パターンセットを使うと簡単な権限定義ができます。

最終的に、前述した通り SAM テンプレートはビルドステージで内部的に CloudFormation テンプレートに変換され、デプロイに使用されます。

実際にデプロイしてみる

CodeCommit と連携した状態の Cloud9 で、以下のようにプロジェクトのルートディレクトリに 3 つのコードを配置します。

配置後、CodeCommit にコードをプッシュします。(以下、コマンド例)

git commit -A
git commit -m "initial commit"
git push origin master

プッシュすると、自動的に CI/CD パイプライン (AWS CodePipeline) が動き出します。

Deploy ステージまで完了。

全てのステージが完了すると、API Gateway と Lambda 関数が連携された状態でデプロイされています。

Lambda 関数の IAM ロールも、デフォルトのポリシー + DynamoDB Read only 系の権限が自動的に作成されてますね。

AWS CloudFormation のコンソールを見ると、CI/CD パイプラインから実行された CloudFormation スタックがあることが確認できます。

説明は省略しますが、API Gateway や Lambda 関数を更新するときは Cloud9 のコードを更新して上記手順を繰り返します。

注意点ですが、一連の環境を削除するときには先にこの CI/CD パイプラインから呼び出された CloudFormation スタックを削除する必要があります。その後、CI/CD パイプラインをデプロイしたときのスタック削除になります。

まとめ

いかがでしたでしょうか？

API Gateway と Lambda 関数をコードでバージョン管理するときにはこのような方法を採るのが今時点のソリューションかと思います。あくまでも簡易な一例ですので、ディテールは書き換えて下さい。

本記事が皆様のお役に立てれば幸いです。