runtime Documentation

Official JavaScript developer resources and documentation for serverless/runtime with 28 stars. Verified technical context for AI.

28 stars JavaScript JavaScript 19 files · ~62,942 tokens
RAW Doc

File: README.md

Serverless Framework Dashboard

This repository is the singular location of all open-source components of Serverless Framework Dashboard.

Here you will find:

  • AWS Lambda Extensions – The source code of the AWS Lambda Extensions installed by users to send metrics, traces and logs to Serverless Framework Dashboard.
  • AWS IAM Role – The AWS CloudFormation template containing an AWS IAM Role that allows Serverless Framework Dashboard permissions to specific services to provide monitoring and observability features.

File: go/packages/dev-mode/README.md

Serverless Dev Mode Extension

This extension layer will forward logs from your lambda function to serverless console dev mode.

This layer is utilizing lambda logs API. It is important to note that the lambda logs API is not necessarily meant to forward logs in real time. Logs are really mean to be batched and sent out. This means that in this project we added a wait process that will keep the lambda function running until all logs have been posted. This means that you probably shouldn't run this extension in a production environment where longer running lambda functions will result in high costs.

Development

There isn't much you have to do to build/deploy this code. Simply run the following command and the code will be deployed to whatever AWS account your AWS CLI is configured for.

shell
make deploy

The command above will output a layer arn once successfully deployed.

After the layer is deployed you can attach this layer to any lambda function, just be sure to create the following environment variables.

Env Variable Description Required
SLS_DEV_MODE_ORG_ID This is the id of the org that you will be publishing to true
SLS_PUBLISH_ENDPOINT This is endpoint that you want logs to be forwarded to. This is helpful if you are trying to send logs to dev. false

Testing

This app is reusing unit tests from our node extension so the unit tests live in ../node/packages/aws-lambda-otel-extension/test/unit/external/index.test.ts

These tests will spin up a local server that emulates the lambda API server.

To run these tests locally simply run

shell
make test

Integrations tests

Integrations tests for this extension are using the integration testing setup/framework that we are using for all other projects in this monorepo. This means that the integration tests are hosted in ../../../node/test/go/dev-mode folder. Check this folder for more details about the integration tests.

Releasing a version

When you are ready to release a new version of this extension simply increment the version number in the version.txt file.

Regional Endpoints

This app uses regional endpoints when publishing telemetry data. This keeps our data transfer as fast as possible so that customer lambda functions do not experience unnecessarily long total durations while this extension forwards data to our backend.

This does mean that if AWS adds a region or a region is not listed in the regionMap in the publishUrl file it is possible for telemetry API calls to fail. So it is important that if a new region is added to AWS that we deploy a new set of endpoints in platform-core.

File: go/packages/dev-mode/version.txt

0.7.3

File: go/packages/slslambda/README.md

Go SDK

Go SDK reports Traces, Captured Errors and Captured Warnings to Serverless Console
from the AWS lambda Go runtime environment. The SDK library must be added and
instrumented in your AWS Lambda function handler.

Key terms

  • A Captured Error is one instance of an error that is sent to Serverless
    Console. It can be viewed in the Trace Explorer Details.
  • A Captured Warning is one instance of a string that is sent to
    Serverless Console, much like a Captured Error.

Compatibility

While Serverless Console is developed by the makers of the Serverless Framework,
the entire Serverless Console product and this SDK are 100% agnostic of the
deployment tool you use. Serverless Console and this SDK work just as well with
Terraform, CDK, SAM, Pulumi, etc, as they do with Serverless Framework.

Installation

Install the package

To instrument your Lambda function code you just need to replace
"github.com/aws/aws-lambda-go/lambda" import with "github.com/serverless/console/go/packages/slslambda".

Before:

go
package main

import (
	"github.com/aws/aws-lambda-go/lambda"
)

func main() {
	lambda.Start(handle)
}

func handle() {}

After:

go
package main

import (
	"github.com/serverless/console/go/packages/slslambda"
)

func main() {
	slslambda.Start(handle)
}

func handle() {}

Enable Logging

Logging must be enabled on your org in Serverless Console in order for the data to be ingested.

Enable Tracing, Logging, and Dev Mode

Set environment variable

The package does require SLS_ORG_ID environment variable to be set in your Lambda function.
You must do that manually using AWS API or AWS Console.

Capturing Errors

go
slslambda.CaptureError(ctx, err)

Capturing Warnings

go
slslambda.CaptureWarning(ctx, "something bad will happen soon")

Example

You can find a working example in the example directory.

File: instrumentation/aws/iam-role-cfn-template.yaml

Serverless Inc.'s Observability AWS IAM Role CloudFormation Template

This is an AWS CloudFormation Template featuring the IAM Role required for Serverless Inc.'s

(serverless.com) monitoring & observability products. It features a lot of AWS services

because Serverless Inc.'s observability products support many AWS services.

This template aims to be secure and user-friendly for your security leaders. It features:

- Clear separation of READ and (a few) WRITE permissions.

- Explicit permissions for IAM Actions. No asterisks.

- Removal of all sensitive IAM READ Actions (e.g. Data Records, Secrets, Source Code)

- In-line descriptions of every Resource and Action.

- Additional comments from Serverless Inc.

We're standing by to answer your questions. Please contact our sales team at: [email protected]

AWSTemplateFormatVersion: "2010-09-09"
Resources:
ServerlessIntegrationStackReporter:
Type: AWS::CloudFormation::CustomResource
Version: "1.0"
Properties:
ServiceToken:
Ref: ReportServiceToken
ExternalId:
Ref: ExternalId
Version:
Ref: Version
ServerlessEventSubscriptionExecutionRole:
Type: AWS::IAM::Role
Properties:
RoleName: ServerlessEventSubscriptionExecutionRole
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
Service:
- events.amazonaws.com
Action:
- sts:AssumeRole
Policies:
- PolicyName: EventBridgeInvokeAPI
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: events:InvokeApiDestination
Resource:
- !Sub "arn:aws:events::${AWS::AccountId}:api-destination/serverless_event_/*"
ServerlessRole:
Type: AWS::IAM::Role
Properties:
RoleName: ServerlessRole
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
AWS:
Fn::Join:
- ":"
- - "arn"
- "aws"
- "iam"
- ""
- Ref: AccountId
- "root"
Action:
- sts:AssumeRole
Condition:
StringEquals:
sts:ExternalId:
Ref: ExternalId
Path: "/"
ServerlessMonitoringRole:
Type: AWS::IAM::Role
Properties:
RoleName: ServerlessMonitoringRole
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
Service:
- streams.metrics.cloudwatch.amazonaws.com
- firehose.amazonaws.com
- logs.amazonaws.com
Action:
- sts:AssumeRole
Condition:
StringEquals:
sts:ExternalId:
Ref: AWS::AccountId
Path: "/"

SERVERLESS ROLE READ PERMISSIONS

ServerlessReadOnlyPolicyAtoD:
Type: AWS::IAM::ManagedPolicy
Properties:
Roles:
- !Ref ServerlessRole
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
#
## API Gateway V1
#

text
# Gets information about the current Account resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetAccount.html
          - "apigateway:GetAccount"
          # Describe an existing Authorizer resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetAuthorizer.html
          - "apigateway:GetAuthorizer"
          # Describe an existing Authorizers resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetAuthorizers.html
          - "apigateway:GetAuthorizers"
          # Describe a BasePathMapping resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetBasePathMapping.html
          - "apigateway:GetBasePathMapping"
          # Represents a collection of BasePathMapping resources.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetBasePathMappings.html
          - "apigateway:GetBasePathMappings"
          # Gets information about a Deployment resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetDeployment.html
          - "apigateway:GetDeployment"
          # Gets information about a Deployments collection.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetDeployments.html
          - "apigateway:GetDeployments"
          # Represents a domain name that is contained in a simpler, more intuitive URL that can be called.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetDomainName.html
          - "apigateway:GetDomainName"
          # Represents a collection of DomainName resources.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetDomainNames.html
          - "apigateway:GetDomainNames"
          # Exports a deployed version of a RestApi in a specified format.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetExport.html
          - "apigateway:GetExport"
          # Gets a GatewayResponse of a specified response type on the given RestApi.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetGatewayResponse.html
          - "apigateway:GetGatewayResponse"
          # Gets the GatewayResponses collection on the given RestApi.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetGatewayResponses.html
          - "apigateway:GetGatewayResponses"
          # Get the integration settings.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetIntegration.html
          - "apigateway:GetIntegration"
          # Represents a get integration response.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetIntegrationResponse.html
          - "apigateway:GetIntegrationResponse"
          # Describe an existing Method resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetMethod.html
          - "apigateway:GetMethod"
          # Describes a MethodResponse resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetMethodResponse.html
          - "apigateway:GetMethodResponse"
          # Describes an existing model defined for a RestApi resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetModel.html
          - "apigateway:GetModel"
          # Describes existing Models defined for a RestApi resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetModels.html
          - "apigateway:GetModels"
          # Generates a sample mapping template that can be used to transform a payload into the structure of a model.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetModelTemplate.html
          - "apigateway:GetModelTemplate"
          # Gets a RequestValidator of a given RestApi.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetRequestValidator.html
          - "apigateway:GetRequestValidator"
          # Gets the RequestValidators collection of a given RestApi.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetRequestValidators.html
          - "apigateway:GetRequestValidators"
          # Lists information about a resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetResource.html
          - "apigateway:GetResource"
          # Lists information about a collection of Resource resources.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetResources.html
          - "apigateway:GetResources"
          # Lists the RestApi resource in the collection.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetRestApi.html
          - "apigateway:GetRestApi"
          # Lists the RestApis resources for your collection.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetRestApis.html
          - "apigateway:GetRestApis"
          # Gets information about a Stage resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetStage.html
          - "apigateway:GetStage"
          # Gets information about one or more Stage resources.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetStages.html
          - "apigateway:GetStages"
          # Gets the Tags collection for a given resource.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetTags.html
          - "apigateway:GetTags"
          # Gets the usage data of a usage plan in a specified time interval.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetUsage.html
          - "apigateway:GetUsage"
          # Gets a usage plan of a given plan identifier.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetUsagePlan.html
          - "apigateway:GetUsagePlan"
          # Gets all the usage plans of the caller's account.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetUsagePlans.html
          - "apigateway:GetUsagePlans"
          # Gets a specified VPC link under the caller's account in a region.
          # https://docs.aws.amazon.com/apigateway/latest/api/API_GetVpcLink.html
          - "apigateway:GetVpcLink"

          #
          ## API Gateway V2
          #
          # Serverless Inc. Comments: API Gateway V1 & V2 have overlapping IAM Actions.  However, V2 (AKA HTTP API) has additional IAM Actions, and we cover those here.

          # Represents an API.
          # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/apis-apiid.html#GetApi
          - "apigateway:GetApi"
          # Represents your APIs as a collection.
          # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/apis.html#GetApis
          - "apigateway:GetApis"
          # Represent an API mapping.
          # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/domainnames-domainname-apimappings-apimappingid.html#GetApiMapping
          - "apigateway:GetApiMapping"
          # Represents the collection of responses for an integration.
          # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/apis-apiid-integrations-integrationid-integrationresponses.html#GetIntegrationResponses
          - "apigateway:GetIntegrationResponses"
          # Represents an API integration.
          # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/apis-apiid-integrations-integrationid.html#GetIntegration
          - "apigateway:GetIntegration"
          # Represents the collection of integrations for an API.
          # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/apis-apiid-integrations.html#GetIntegrations
          - "apigateway:GetIntegrations"
          # Represents a route for an API.
          # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/apis-apiid-routes-routeid.html#GetRoute
          - "apigateway:GetRoute"
          # Represents the collection of routes for an API.
          # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/apis-apiid-routes.html#GetRoutes
          - "apigateway:GetRoutes"
          # Represents a route response.
          # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/apis-apiid-routes-routeid-routeresponses-routeresponseid.html#GetRouteResponse
          - "apigateway:GetRouteResponse"
          # Represents the collection of responses for a route.
          # https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/apis-apiid-routes-routeid-routeresponses.html#GetRouteResponses
          - "apigateway:GetRouteResponses"

          #
          ## App Runner
          #

          # Grants permission to retrieve the description of an AWS App Runner automatic scaling configuration resource.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeAutoScalingConfiguration.html
          - "apprunner:DescribeAutoScalingConfiguration"
          # Grants permission to retrieve descriptions of custom domain names associated with an AWS App Runner service.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeCustomDomains.html
          - "apprunner:DescribeCustomDomains"
          # Grants permission to retrieve the description of an AWS App Runner observability configuration resource.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeObservabilityConfiguration.html
          - "apprunner:DescribeObservabilityConfiguration"
          # Grants permission to retrieve the description of an operation that occurred on an AWS App Runner service.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeOperation.html
          - "apprunner:DescribeOperation"
          # Grants permission to retrieve the description of an AWS App Runner service resource.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeService.html
          - "apprunner:DescribeService"
          # Grants permission to retrieve the description of an AWS App Runner VPC connector resource.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_DescribeVpcConnector.html
          - "apprunner:DescribeVpcConnector"
          # Grants permission to retrieve a list of AWS App Runner automatic scaling configurations in your AWS account.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_ListAutoScalingConfigurations.html
          - "apprunner:ListAutoScalingConfigurations"
          # Grants permission to retrieve a list of AWS App Runner connections in your AWS account.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_ListConnections.html
          - "apprunner:ListConnections"
          # Grants permission to retrieve a list of AWS App Runner observability configurations in your AWS account.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_ListObservabilityConfigurations.html
          - "apprunner:ListObservabilityConfigurations"
          # Grants permission to retrieve a list of operations that occurred on an AWS App Runner service resource.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_ListOperations.html
          - "apprunner:ListOperations"
          # Grants permission to retrieve a list of running AWS App Runner services in your AWS account.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_ListServices.html
          - "apprunner:ListServices"
          # Grants permission to list tags associated with an AWS App Runner resource.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_ListTagsForResource.html
          - "apprunner:ListTagsForResource"
          # Grants permission to retrieve a list of AWS App Runner VPC connectors in your AWS account.
          # https://docs.aws.amazon.com/apprunner/latest/api/API_ListVpcConnectors.html
          - "apprunner:ListVpcConnectors"

          #
          ## AppSync
          #

          # Grants permission to read custom domain name - GraphQL API association details in AppSync.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetApiAssociation.html
          - "appsync:GetApiAssociation"
          # Grants permission to retrieve a data source.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetDataSource.html
          - "appsync:GetDataSource"
          # Grants permission to read information about a custom domain name in AppSync.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetDomainName.html
          - "appsync:GetDomainName"
          # Grants permission to retrieve a function.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetFunction.html
          - "appsync:GetFunction"
          # Grants permission to retrieve a GraphQL API.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetGraphqlApi.html
          - "appsync:GetGraphqlApi"
          # Grants permission to retrieve the introspection schema for a GraphQL API.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetIntrospectionSchema.html
          - "appsync:GetIntrospectionSchema"
          # Grants permission to retrieve a resolver.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetResolver.html
          - "appsync:GetResolver"
          # Grants permission to retrieve the current status of a schema creation operation.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_GetSchemaCreationStatus.html
          - "appsync:GetSchemaCreationStatus"
          # Grants permission to list the data sources for a given API.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListDataSources.html
          - "appsync:ListDataSources"
          # Grants permission to enumerate custom domain names in AppSync.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListDomainNames.html
          - "appsync:ListDomainNames"
          # Grants permission to list the functions for a given API.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListFunctions.html
          - "appsync:ListFunctions"
          # Grants permission to list GraphQL APIs.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListGraphqlApis.html
          - "appsync:ListGraphqlApis"
          # Grants permission to list the resolvers for a given API and type.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListResolvers.html
          - "appsync:ListResolvers"
          # Grants permission to list the resolvers that are associated with a specific function.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListResolversByFunction.html
          - "appsync:ListResolversByFunction"
          # Grants permission to list the tags for a resource.
          # https://docs.aws.amazon.com/appsync/latest/APIReference/API_ListTagsForResource.html
          - "appsync:ListTagsForResource"

          #
          ## Autoscaling
          #

          # Describes the scalable resources in the specified scaling plan.
          # https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_DescribeScalingPlanResources.html
          - "autoscaling-plans:DescribeScalingPlanResources"
          # Describes the specified scaling plans or all of your scaling plans.
          # https://docs.aws.amazon.com/autoscaling/plans/APIReference/API_DescribeScalingPlans.html
          - "autoscaling-plans:DescribeScalingPlans"

          #
          ## CloudFormation
          #

          # Grants permission to return information about a CloudFormation extension publisher.
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribePublisher.html
          - "cloudformation:DescribePublisher"
          # Grants permission to return the stack instance that's associated with the specified stack set, AWS account, and region.
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackInstance.html
          - "cloudformation:DescribeStackInstance"
          # Grants permission to return a description of the specified resource in the specified stack.
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackResource.html
          - "cloudformation:DescribeStackResource"
          # Grants permission to return AWS resource descriptions for running and deleted stacks.
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackResources.html
          - "cloudformation:DescribeStackResources"
          # Grants permission to return the description of the specified stack set.
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackSet.html
          - "cloudformation:DescribeStackSet"
          # Grants permission to return the description for the specified stack.
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStacks.html
          - "cloudformation:DescribeStacks"
          # Grants permission to return summary information about stack instances that are associated with the specified stack set.
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackSets.html
          - "cloudformation:ListStackInstances"
          # Grants permission to return descriptions of all resources of the specified stack.
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackResources.html
          - "cloudformation:ListStackResources"
          # Grants permission to return summary information about stack sets that are associated with the user.
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStackSets.html
          - "cloudformation:ListStackSets"
          # Grants permission to return the summary information for stacks whose status matches the specified StackStatusFilter.
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ListStacks.html
          - "cloudformation:ListStacks"

          #
          ## CloudFront
          #

          # Grants permission to get a CloudFront function summary.
          # https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_DescribeFunction.html
          - "cloudfront:DescribeFunction"
          # Grants permission to get the cache policy.
          # https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetCachePolicy.html
          - "cloudfront:GetCachePolicy"
          # Grants permission to get the cache policy configuration.
          # https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetCachePolicyConfig.html
          - "cloudfront:GetCachePolicyConfig"
          # Grants permission to get the information about a web distribution.
          # https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetDistribution.html
          - "cloudfront:GetDistribution"
          # Grants permission to get the configuration information about a distribution.
          # https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_GetDistributionConfig.html
          - "cloudfront:GetDistributionConfig"
          # Grants permission to list the distributions associated with your AWS account.
          # https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributions.html
          - "cloudfront:ListDistributions"
          # Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified cache policy.
          # https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListDistributionsByCachePolicyId.html
          - "cloudfront:ListDistributionsByCachePolicyId"
          # Grants permission to get a list of CloudFront functions.
          # https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListFunctions.html
          - "cloudfront:ListFunctions"
          # Grants permission to list tags for a CloudFront resource.
          # https://docs.aws.amazon.com/cloudfront/latest/APIReference/API_ListTagsForResource.html
          - "cloudfront:ListTagsForResource"

          #
          ## CloudTrail
          #

          # Grants permission to list settings for the trails associated with the current region for your account.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DescribeTrails.html
          - "cloudtrail:DescribeTrails"
          # Grants permission to retrieve a JSON-formatted list of information about the specified trail.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetTrailStatus.html
          - "cloudtrail:GetTrailStatus"
          # Grants permission to list the tags for trails or event data stores in the current region.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListTags.html
          - "cloudtrail:ListTags"
          # Grants permission to list trails associated with the current region for your account.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_ListTrails.html
          - "cloudtrail:ListTrails"
          # Grants permission to look up API activity events captured by CloudTrail that create, update, or delete resources in your account.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_LookupEvents.html
          - "cloudtrail:LookupEvents"

          #
          ## Cloudwatch
          #

          # Grants permission to retrieve the history for the specified alarm.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarmHistory.html
          - "cloudwatch:DescribeAlarmHistory"
          # Grants permission to describe all alarms, currently owned by the user's account.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarms.html
          - "cloudwatch:DescribeAlarms"
          # Grants permission to describe all alarms configured on the specified metric, currently owned by the user's account.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarmsForMetric.html
          - "cloudwatch:DescribeAlarmsForMetric"
          # Grants permission to list the anomaly detection models that you have created in your account.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAnomalyDetectors.html
          - "cloudwatch:DescribeAnomalyDetectors"
          # Grants permission to disable a collection of insight rules.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DisableInsightRules.html
          - "cloudwatch:DescribeInsightRules"
          # Grants permission to display the details of the CloudWatch dashboard you specify.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetDashboard.html
          - "cloudwatch:GetDashboard"
          # Grants permission to return the top-N report of unique contributors over a time range for a given insight rule.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetInsightRuleReport.html
          - "cloudwatch:GetInsightRuleReport"
          # Grants permission to retrieve batch amounts of CloudWatch metric data and perform metric math on retrieved data.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html
          - "cloudwatch:GetMetricData"
          # Grants permission to retrieve statistics for the specified metric.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStatistics.html
          - "cloudwatch:GetMetricStatistics"
          # Grants permission to return the details of a CloudWatch metric stream.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStream.html
          - "cloudwatch:GetMetricStream"
          # Grants permission to retrieve snapshots of metric widgets.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricWidgetImage.html
          - "cloudwatch:GetMetricWidgetImage"
          # Grants permission to return a list of all CloudWatch dashboards in your account.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListDashboards.html
          - "cloudwatch:ListDashboards"
          # Grants permission to return a list of all CloudWatch metric streams in your account.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetricStreams.html
          - "cloudwatch:ListMetricStreams"
          # Grants permission to retrieve a list of valid metrics stored for the AWS account owner.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html
          - "cloudwatch:ListMetrics"
          # Grants permission to list tags for an Amazon CloudWatch resource.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListTagsForResource.html
          - "cloudwatch:ListTagsForResource"

          #
          ## Cloudwatch Logs
          #

          # Grants permissions to return all the log groups that are associated with the AWS account making the request.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html
          - "logs:DescribeLogGroups"
          # Grants permissions to return all the log streams that are associated with the specified log group.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html
          - "logs:DescribeLogStreams"
          # Grants permissions to return all the subscription filters associated with the specified log group.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeSubscriptionFilters.html
          - "logs:DescribeSubscriptionFilters"
          # Grants permissions to retrieve log events, optionally filtered by a filter pattern from the specified log group.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html
          - "logs:FilterLogEvents"
          # Grants permissions to list the tags for the specified log group.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_ListTagsLogGroup.html
          - "logs:ListTagsLogGroup"
          # Grants permissions to test the filter pattern of a metric filter against a sample of log event messages.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_TestMetricFilter.html
          - "logs:TestMetricFilter"

          #
          ## Cost Explorer
          #

          # Grants permission to retrieve descriptions such as the name, ARN, rules, definition, and effective dates of a Cost Category.
          # https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_DescribeCostCategoryDefinition.html
          - "ce:DescribeCostCategoryDefinition"
          # Grants permission to retrieve the cost and usage metrics for your account.
          # https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsage.html
          - "ce:GetCostAndUsage"
          # Grants permission to retrieve the cost and usage metrics with resources for your account.
          # https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostAndUsageWithResources.html
          - "ce:GetCostAndUsageWithResources"
          # Grants permission to query Cost Catagory names and values for a specified time period.
          # https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetCostCategories.html
          - "ce:GetCostCategories"
          # Grants permission to query tags for a specified time period.
          # https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_GetTags.html
          - "ce:GetTags"
          # Grants permission to list Cost Allocation Tags.
          # https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_ListCostAllocationTags.html
          - "ce:ListCostAllocationTags"
          # Grants permission to retrieve names, ARN, and effective dates for all Cost Categories.
          # https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_ListCostCategoryDefinitions.html
          - "ce:ListCostCategoryDefinitions"
          # Grants permission to list tags for a Cost Explorer resource.
          # https://docs.aws.amazon.com/aws-cost-management/latest/APIReference/API_ListTagsForResource.html
          - "ce:ListTagsForResource"

          #
          ## DynamoDB
          #

          # Grants permission to describe an existing backup of a table.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeBackup.html
          - "dynamodb:DescribeBackup"
          # Grants permission to check the status of the backup restore settings on the specified table.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeContinuousBackups.html
          - "dynamodb:DescribeContinuousBackups"
          # Grants permission to describe the contributor insights status and related details for a given table or global secondary index.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeContributorInsights.html
          - "dynamodb:DescribeContributorInsights"
          # Grants permission to describe an existing Export of a table.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeExport.html
          - "dynamodb:DescribeExport"
          # Grants permission to return information about the specified global table.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeGlobalTable.html
          - "dynamodb:DescribeGlobalTable"
          # Grants permission to return settings information about the specified global table.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeGlobalTableSettings.html
          - "dynamodb:DescribeGlobalTableSettings"
          # Grants permission to grant permission to describe the status of Kinesis streaming and related details for a given table.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeKinesisStreamingDestination.html
          - "dynamodb:DescribeKinesisStreamingDestination"
          # Grants permission to return the current provisioned-capacity limits for your AWS account in a region, both for the region as a whole and for any one DynamoDB table that you create there.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeLimits.html
          - "dynamodb:DescribeLimits"
          # Grants permission to describe one or more of the Reserved Capacity purchased.
          - "dynamodb:DescribeReservedCapacity"
          # Grants permission to describe Reserved Capacity offerings that are available for purchase.
          - "dynamodb:DescribeReservedCapacityOfferings"
          # Grants permission to return information about a stream, including the current status of the stream, its Amazon Resource Name (ARN), the composition of its shards, and its corresponding DynamoDB table.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeStream.html
          - "dynamodb:DescribeStream"
          # Grants permission to return information about the table.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeTable.html
          - "dynamodb:DescribeTable"
          # Grants permission to describe the auto scaling settings across all replicas of the global table.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeTableReplicaAutoScaling.html
          - "dynamodb:DescribeTableReplicaAutoScaling"
          # Grants permission to give a description of the Time to Live (TTL) status on the specified table.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_DescribeTimeToLive.html
          - "dynamodb:DescribeTimeToLive"
          # Grants permission to list backups associated with the account and endpoint.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListBackups.html
          - "dynamodb:ListBackups"
          # Grants permission to list the ContributorInsightsSummary for all tables and global secondary indexes associated with the current account and endpoint.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListContributorInsights.html
          - "dynamodb:ListContributorInsights"
          # Grants permission to list exports associated with the account and endpoint.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListExports.html
          - "dynamodb:ListExports"
          # Grants permission to list all global tables that have a replica in the specified region.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListGlobalTables.html
          - "dynamodb:ListGlobalTables"
          # Grants permission to return an array of stream ARNs associated with the current account and endpoint.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListStreams.html
          - "dynamodb:ListStreams"
          # Grants permission to return an array of table names associated with the current account and endpoint.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListTables.html
          - "dynamodb:ListTables"
          # Grants permission to list all tags on an Amazon DynamoDB resource.
          # https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ListTagsOfResource.html
          - "dynamodb:ListTagsOfResource"
        Resource: "*"

ServerlessReadOnlyPolicyEtoK:
Type: AWS::IAM::ManagedPolicy
Properties:
Roles:
- !Ref ServerlessRole
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
#
## Elastic Container Service
#

text
# Grants permission to describe one or more Amazon ECS capacity providers.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeCapacityProviders.html
          - "ecs:DescribeCapacityProviders"
          # Grants permission to describes one or more of your clusters.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeClusters.html
          - "ecs:DescribeClusters"
          # Grants permission to describes Amazon ECS container instances.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeContainerInstances.html
          - "ecs:DescribeContainerInstances"
          # Grants permission to describe the specified services running in your cluster.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeServices.html
          - "ecs:DescribeServices"
          # Grants permission to describe a task definition. You can specify a family and revision to find information about a specific task definition, or you can simply specify the family to find the latest ACTIVE revision in that family.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTaskDefinition.html
          - "ecs:DescribeTaskDefinition"
          # Grants permission to describe Amazon ECS task sets.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTaskSets.html
          - "ecs:DescribeTaskSets"
          # Grants permission to describe a specified task or tasks.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DescribeTasks.html
          - "ecs:DescribeTasks"
          # Grants permission to list the account settings for an Amazon ECS resource for a specified principal.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListAccountSettings.html
          - "ecs:ListAccountSettings"
          # Grants permission to lists the attributes for Amazon ECS resources within a specified target type and cluster.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListAttributes.html
          - "ecs:ListAttributes"
          # Grants permission to get a list of existing clusters.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListClusters.html
          - "ecs:ListClusters"
          # Grants permission to get a list of container instances in a specified cluster.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListContainerInstances.html
          - "ecs:ListContainerInstances"
          # Grants permission to get a list of services that are running in a specified cluster.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListServices.html
          - "ecs:ListServices"
          # Grants permission to get a list of tags for the specified resource.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListTagsForResource.html
          - "ecs:ListTagsForResource"
          # Grants permission to get a list of task definition families that are registered to your account (which may include task definition families that no longer have any ACTIVE task definitions).
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListServices.html
          - "ecs:ListTaskDefinitionFamilies"
          # Grants permission to get a list of task definitions that are registered to your account.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListTaskDefinitions.html
          - "ecs:ListTaskDefinitions"
          # Grants permission to get a list of tasks for a specified cluster.
          # https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_ListTasks.html
          - "ecs:ListTasks"

          #
          ## ElastiCache
          #

          # Grants permission to list information about provisioned cache clusters.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheClusters.html
          - "elasticache:DescribeCacheClusters"
          # Grants permission to list available cache engines and their versions.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheEngineVersions.html
          - "elasticache:DescribeCacheEngineVersions"
          # Grants permission to list cache parameter group descriptions.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheParameterGroups.html
          - "elasticache:DescribeCacheParameterGroups"
          # Grants permission to retrieve the detailed parameter list for a particular cache parameter group.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheParameters.html
          - "elasticache:DescribeCacheParameters"
          # Grants permission to list cache subnet group descriptions.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeCacheSubnetGroups.html
          - "elasticache:DescribeCacheSubnetGroups"
          # Grants permission to retrieve the default engine and system parameter information for the specified cache engine.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeEngineDefaultParameters.html
          - "elasticache:DescribeEngineDefaultParameters"
          # Grants permission to list events related to clusters, cache security groups, and cache parameter groups.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeEvents.html
          - "elasticache:DescribeEvents"
          # Grants permission to list information about global replication groups.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeGlobalReplicationGroups.html
          - "elasticache:DescribeGlobalReplicationGroups"
          # Grants permission to list information about provisioned replication groups.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeReplicationGroups.html
          - "elasticache:DescribeReplicationGroups"
          # Grants permission to list information about purchased reserved cache nodes.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeReservedCacheNodes.html
          - "elasticache:DescribeReservedCacheNodes"
          # Grants permission to list details of the update actions for a set of clusters or replication groups.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeUpdateActions.html
          - "elasticache:DescribeUpdateActions"
          # Grants permission to list information about Redis user groups.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeUserGroups.html
          - "elasticache:DescribeUserGroups"
          # Grants permission to list information about Redis users.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_DescribeUsers.html
          - "elasticache:DescribeUsers"
          # Grants permission to list available node type that can be used to scale a particular Redis cluster or replication group.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ListAllowedNodeTypeModifications.html
          - "elasticache:ListAllowedNodeTypeModifications"
          # Grants permission to list tags for an ElastiCache resource.
          # https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ListTagsForResource.html
          - "elasticache:ListTagsForResource"

          #
          ## Elastic Load Balancing V1
          #

          # Grants permission to describe the state of the specified instances with respect to the specified load balancer.
          # https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeInstanceHealth.html
          - "elasticloadbalancing:DescribeInstanceHealth"
          # Grants permission to describe the attributes for the specified load balancer.
          # https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancerAttributes.html
          - "elasticloadbalancing:DescribeLoadBalancerAttributes"
          # Grants permission to describe the specified policies.
          # https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancerPolicies.html
          - "elasticloadbalancing:DescribeLoadBalancerPolicies"
          # Grants permission to describe the specified load balancer policy types
          # https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancerPolicyTypes.html
          - "elasticloadbalancing:DescribeLoadBalancerPolicyTypes"
          # Grants permission to describe the specified the load balancers. If no load balancers are specified, the call describes all of your load balancers.
          # https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancers.html
          - "elasticloadbalancing:DescribeLoadBalancers"
          # Grants permission to describe the tags associated with the specified load balancers.
          # https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeTags.html
          - "elasticloadbalancing:DescribeTags"

          #
          ## Elastic Load Balancing V2
          #

          # Grants permission to describe the Elastic Load Balancing resource limits for the AWS account.
          # https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeAccountLimits.html
          - "elasticloadbalancing:DescribeAccountLimits"
          # Grants permission to describe the specified listeners or the listeners for the specified Application Load Balancer.
          # https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeListeners.html
          - "elasticloadbalancing:DescribeListeners"
          # Grants permission to describe the attributes for the specified load balancer.
          # https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeLoadBalancerAttributes.html
          - "elasticloadbalancing:DescribeLoadBalancerAttributes"
          # Grants permission to describe the specified the load balancers. If no load balancers are specified, the call describes all of your load balancers.
          # https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeLoadBalancers.html
          - "elasticloadbalancing:DescribeLoadBalancers"
          # Grants permission to describe the specified rules or the rules for the specified listener.
          # https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeRules.html
          - "elasticloadbalancing:DescribeRules"
          # Grants permission to describe the tags associated with the specified resource.
          # https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTags.html
          - "elasticloadbalancing:DescribeTags"
          # Grants permission to describe the attributes for the specified target group.
          # https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTargetGroupAttributes.html
          - "elasticloadbalancing:DescribeTargetGroupAttributes"
          # Grants permission to describe the specified target groups or all of your target groups.
          # https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTargetGroups.html
          - "elasticloadbalancing:DescribeTargetGroups"
          # Grants permission to describe the health of the specified targets or all of your targets.
          # https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTargetHealth.html
          - "elasticloadbalancing:DescribeTargetHealth"

          #
          ## Elastic Map Reduce
          #

          # Grants permission to get details about a cluster, including status, hardware and software configuration, VPC settings, and so on.
          # https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeCluster.html
          - "elasticmapreduce:DescribeCluster"
          # Grants permission to get details about a cluster step.
          # https://docs.aws.amazon.com/emr/latest/APIReference/API_DescribeStep.html
          - "elasticmapreduce:DescribeStep"
          # Grants permission to view information about an EMR Studio.
          # https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html
          - "elasticmapreduce:DescribeStudio"
          # Grants permission to get details about the bootstrap actions associated with a cluster.
          # https://docs.aws.amazon.com/emr/latest/APIReference/API_ListBootstrapActions.html
          - "elasticmapreduce:ListBootstrapActions"
          # Grants permission to get the status of accessible clusters.
          # https://docs.aws.amazon.com/emr/latest/APIReference/API_ListClusters.html
          - "elasticmapreduce:ListClusters"
          # Grants permission to get details of instance fleets in a cluster.
          # https://docs.aws.amazon.com/emr/latest/APIReference/API_ListInstanceFleets.html
          - "elasticmapreduce:ListInstanceFleets"
          # Grants permission to get details of instance groups in a cluster.
          # https://docs.aws.amazon.com/emr/latest/APIReference/API_ListInstanceGroups.html
          - "elasticmapreduce:ListInstanceGroups"
          # Grants permission to get details about the Amazon EC2 instances in a cluster.
          # https://docs.aws.amazon.com/emr/latest/APIReference/API_ListInstances.html
          - "elasticmapreduce:ListInstances"
          # Grants permission to list steps associated with a cluster.
          # https://docs.aws.amazon.com/emr/latest/APIReference/API_ListSteps.html
          - "elasticmapreduce:ListSteps"
          # Grants permission to list summary information about EMR Studio session mappings.
          # https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html
          - "elasticmapreduce:ListStudioSessionMappings"
          # Grants permission to list summary information about EMR Studios.
          # https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-studio.html
          - "elasticmapreduce:ListStudios"

          #
          ## OpenSearch Service
          #

          # Grants permission to view a description of the domain configuration for the specified OpenSearch Service domain, including the domain ID, service endpoint, and ARN.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-describedomain
          - "es:DescribeDomain"
          # Grants permission to view the Auto-Tune configuration of the domain for the specified OpenSearch Service domain, including the Auto-Tune state and maintenance schedules.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-describeautotune
          - "es:DescribeDomainAutoTunes"
          # Grants permission to view a description of the configuration options and status of an OpenSearch Service domain.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-describedomainconfig
          - "es:DescribeDomainConfig"
          # Grants permission to view a description of the domain configuration for up to five specified OpenSearch Service domains.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-describedomains
          - "es:DescribeDomains"
          # Grants permission to view a description of the domain configuration for the specified OpenSearch Service domain, including the domain ID, service endpoint, and ARN. This permission is deprecated. Use DescribeDomain instead.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-describedomain
          - "es:DescribeElasticsearchDomain"
          # Grants permission to view a description of the configuration and status of an OpenSearch Service domain. This permission is deprecated. Use DescribeDomainConfig instead.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-describedomainconfig
          - "es:DescribeElasticsearchDomainConfig"
          # Grants permission to view a description of the domain configuration for up to five specified Amazon OpenSearch domains. This permission is deprecated. Use DescribeDomains instead.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-describedomains
          - "es:DescribeElasticsearchDomains"
          # Grants permission to describe all packages available to OpenSearch Service domains.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-describepackages
          - "es:DescribePackages"
          # Grants permission to display the names of all OpenSearch Service domains that the current user owns.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-listdomainnames
          - "es:ListDomainNames"
          # Grants permission to list all OpenSearch Service domains that a package is associated with.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-listdomainsforpackage
          - "es:ListDomainsForPackage"
          # Grants permission to list all instance types and available features for a given OpenSearch version. This permission is deprecated. Use ListInstanceTypeDetails instead.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-listinstancetypedetails
          - "es:ListElasticsearchInstanceTypeDetails"
          # Grants permission to list all EC2 instance types that are supported for a given OpenSearch version.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html
          - "es:ListElasticsearchInstanceTypes"
          # Grants permission to list all instance types and available features for a given OpenSearch or Elasticsearch version.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-listinstancetypedetails
          - "es:ListInstanceTypeDetails"
          # Grants permission to list all packages associated with the OpenSearch Service domain.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-listpackagesfordomain
          - "es:ListPackagesForDomain"
          # Grants permission to display all resource tags for an OpenSearch Service domain.
          # https://docs.aws.amazon.com/opensearch-service/latest/developerguide/configuration-api.html#configuration-api-actions-listtags
          - "es:ListTags"

          #
          ## Health
          #

          # Grants permission to retrieve a list of accounts that have been affected by the specified events in organization.
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeAffectedAccountsForOrganization.html
          - "health:DescribeAffectedAccountsForOrganization"
          # Grants permission to retrieve a list of entities that have been affected by the specified events.
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeAffectedEntities.html
          - "health:DescribeAffectedEntities"
          # Grants permission to retrieve a list of entities that have been affected by the specified events and accounts in organization.
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeAffectedEntitiesForOrganization.html
          - "health:DescribeAffectedEntitiesForOrganization"
          # Grants permission to retrieve the number of entities that are affected by each of the specified events.
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEntityAggregates.html
          - "health:DescribeEntityAggregates"
          # Grants permission to retrieve the number of events of each event type (issue, scheduled change, and account notification).
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventAggregates.html
          - "health:DescribeEventAggregates"
          # Grants permission to retrieve detailed information about one or more specified events.
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventDetails.html
          - "health:DescribeEventDetails"
          # Grants permission to retrieve detailed information about one or more specified events for provided accounts in organization.
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventDetailsForOrganization.html
          - "health:DescribeEventDetailsForOrganization"
          # Grants permission to retrieve the event types that meet the specified filter criteria.
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventTypes.html
          - "health:DescribeEventTypes"
          # Grants permission to retrieve information about events that meet the specified filter criteria.
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEvents.html
          - "health:DescribeEvents"
          # Grants permission to retrieve information about events that meet the specified filter criteria in organization.
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeEventsForOrganization.html
          - "health:DescribeEventsForOrganization"
          # Grants permission to retrieve the status of enabling or disabling the Organizational View feature.
          # https://docs.aws.amazon.com/health/latest/APIReference/API_DescribeHealthServiceStatusForOrganization.html
          - "health:DescribeHealthServiceStatusForOrganization"

          #
          ## Kinesis
          #

          # Grants permission to describe the specified stream.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeStream.html
          - "kinesis:DescribeStream"
          # Grants permission to get the description of a registered stream consumer.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeStreamConsumer.html
          - "kinesis:DescribeStreamConsumer"
          # Grants permission to provide a summarized description of the specified Kinesis data stream without the shard list.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeStreamSummary.html
          - "kinesis:DescribeStreamSummary"
          # Grants permission to list the shards in a stream and provides information about each shard.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListShards.html
          - "kinesis:ListShards"
          # Grants permission to list the stream consumers registered to receive data from a Kinesis stream using enhanced fan-out, and provides information about each consumer.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListStreamConsumers.html
          - "kinesis:ListStreamConsumers"
          # Grants permission to list your streams.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListStreams.html
          - "kinesis:ListStreams"
          # Grants permission to list the tags for the specified Amazon Kinesis stream.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListTagsForStream.html
          - "kinesis:ListTagsForStream"
        Resource: "*"

ServerlessReadOnlyPolicyLtoX:
Type: AWS::IAM::ManagedPolicy
Properties:
Roles:
- !Ref ServerlessRole
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
#
## Lambda
#

text
# Grants permission to view details about an account's limits and usage in an AWS Region.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetAccountSettings.html
          - "lambda:GetAccountSettings"
          # Grants permission to view details about an AWS Lambda function alias.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetAlias.html
          - "lambda:GetAlias"
          # Grants permission to view details about an AWS Lambda event source mapping.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetEventSourceMapping.html
          - "lambda:GetEventSourceMapping"
          # Grants permission to view details about the reserved concurrency configuration for a function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionConcurrency.html
          - "lambda:GetFunctionConcurrency"
          # Grants permission to view details about the version-specific settings of an AWS Lambda function or version.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionConfiguration.html
          - "lambda:GetFunctionConfiguration"
          # Grants permission to view the configuration for asynchronous invocation for a function, version, or alias.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionEventInvokeConfig.html
          - "lambda:GetFunctionEventInvokeConfig"
          # Grants permission to read function url configuration for a Lambda function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionUrlConfig.html
          - "lambda:GetFunctionUrlConfig"
          # Grants permission to view details about a version of an AWS Lambda layer. Note this action also supports GetLayerVersionByArn API.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersion.html
          - "lambda:GetLayerVersion"
          # Grants permission to view the resource-based policy for a version of an AWS Lambda layer.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersionPolicy.html
          - "lambda:GetLayerVersionPolicy"
          # Grants permission to view the resource-based policy for an AWS Lambda function, version, or alias.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetPolicy.html
          - "lambda:GetPolicy"
          # Grants permission to view the provisioned concurrency configuration for an AWS Lambda function's alias or version.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetProvisionedConcurrencyConfig.html
          - "lambda:GetProvisionedConcurrencyConfig"
          # Grants permission to retrieve a list of aliases for an AWS Lambda function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListAliases.html
          - "lambda:ListAliases"
          # Grants permission to retrieve a list of AWS Lambda code signing configs.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListCodeSigningConfigs.html
          - "lambda:ListCodeSigningConfigs"
          # Grants permission to retrieve a list of AWS Lambda event source mappings.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListEventSourceMappings.html
          - "lambda:ListEventSourceMappings"
          # Grants permission to retrieve a list of configurations for asynchronous invocation for a function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionEventInvokeConfigs.html
          - "lambda:ListFunctionEventInvokeConfigs"
          # Grants permission to read function url configurations for a function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionUrlConfigs.html
          - "lambda:ListFunctionUrlConfigs"
          # Grants permission to retrieve a list of AWS Lambda functions, with the version-specific configuration of each function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctions.html
          - "lambda:ListFunctions"
          # Grants permission to retrieve a list of AWS Lambda functions by the code signing config assigned.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionsByCodeSigningConfig.html
          - "lambda:ListFunctionsByCodeSigningConfig"
          # Grants permission to retrieve a list of versions of an AWS Lambda layer.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListLayerVersions.html
          - "lambda:ListLayerVersions"
          # Grants permission to retrieve a list of AWS Lambda layers, with details about the latest version of each layer.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListLayers.html
          - "lambda:ListLayers"
          # Grants permission to retrieve a list of provisioned concurrency configurations for an AWS Lambda function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListProvisionedConcurrencyConfigs.html
          - "lambda:ListProvisionedConcurrencyConfigs"
          # Grants permission to retrieve a list of tags for an AWS Lambda function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListTags.html
          - "lambda:ListTags"
          # Grants permission to retrieve a list of versions for an AWS Lambda function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_ListVersionsByFunction.html
          - "lambda:ListVersionsByFunction"

          #
          ## Resource Group Tagging
          #

          # Grants permission to return tagged or previously tagged resources in the specified AWS Region for the calling account.
          # https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetResources.html
          - "tag:GetResources"
          # Grants permission to returns tag keys currently in use in the specified AWS Region for the calling account.
          # https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetTagKeys.html
          - "tag:GetTagKeys"
          # Grants permission to return tag values for the specified key that are used in the specified AWS Region for the calling account.
          # https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/API_GetTagValues.html
          - "tag:GetTagValues"

          #
          ## RDS
          #

          # Grants permission to return a list of DBClusterParameterGroup descriptions.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterParameterGroups.html
          - "rds:DescribeDBClusterParameterGroups"
          # Grants permission to return the detailed parameter list for a particular DB cluster parameter group.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusterParameters.html
          - "rds:DescribeDBClusterParameters"
          # Grants permission to return information about provisioned Aurora DB clusters.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBClusters.html
          - "rds:DescribeDBClusters"
          # Grants permission to return a list of the available DB engines.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBEngineVersions.html
          - "rds:DescribeDBEngineVersions"
          # Grants permission to return information about provisioned RDS instances.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstances.html
          - "rds:DescribeDBInstances"
          # Grants permission to return a list of DBParameterGroup descriptions.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBParameterGroups.html
          - "rds:DescribeDBParameterGroups"
          # Grants permission to return the detailed parameter list for a particular DB parameter group.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBParameters.html
          - "rds:DescribeDBParameters"
          # Grants permission to view proxies.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxies.html
          - "rds:DescribeDBProxies"
          # Grants permission to view proxy endpoints.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxyEndpoints.html
          - "rds:DescribeDBProxyEndpoints"
          # Grants permission to view database proxy target group details.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxyTargetGroups.html
          - "rds:DescribeDBProxyTargetGroups"
          # Grants permission to view database proxy target details.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBProxyTargets.html
          - "rds:DescribeDBProxyTargets"
          # Grants permission to return a list of DBSecurityGroup descriptions.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSecurityGroups.html
          - "rds:DescribeDBSecurityGroups"
          # Grants permission to return a list of DBSubnetGroup descriptions.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBSubnetGroups.html
          - "rds:DescribeDBSubnetGroups"
          # Grants permission to display a list of categories for all event source types, or, if specified, for a specified source type.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEventCategories.html
          - "rds:DescribeEventCategories"
          # Grants permission to list all the subscription descriptions for a customer account.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEventSubscriptions.html
          - "rds:DescribeEventSubscriptions"
          # Grants permission to return events related to DB instances, DB security groups, DB snapshots, and DB parameter groups for the past 14 days.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeEvents.html
          - "rds:DescribeEvents"
          # Grants permission to return a list of the source AWS Regions where the current AWS Region can create a Read Replica or copy a DB snapshot from.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeSourceRegions.html
          - "rds:DescribeSourceRegions"
          # Grants permission to list all tags on an Amazon RDS resource.
          # https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ListTagsForResource.html
          - "rds:ListTagsForResource"

          #
          ## Route 53
          #

          # Grants permission to get a list of the CIDR blocks within a specified CIDR collection.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListCidrBlocks.html
          - "route53:ListCidrBlocks"
          # Grants permission to get a list of the CIDR collections that are associated with the current AWS account.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListCidrCollections.html
          - "route53:ListCidrCollections"
          # Grants permission to get a list of the CIDR locations that belong to a specified CIDR collection.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListCidrLocations.html
          - "route53:ListCidrLocations"
          # Grants permission to get a list of geographic locations that Route 53 supports for geolocation.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListGeoLocations.html
          - "route53:ListGeoLocations"
          # Grants permission to get a list of the health checks that are associated with the current AWS account.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHealthChecks.html
          - "route53:ListHealthChecks"
          # Grants permission to get a list of the public and private hosted zones that are associated with the current AWS account.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHostedZones.html
          - "route53:ListHostedZones"
          # Grants permission to get a list of your hosted zones in lexicographic order. Hosted zones are sorted by name with the labels reversed.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHostedZonesByName.html
          - "route53:ListHostedZonesByName"
          # Grants permission to get a list of all the private hosted zones that a specified VPC is associated with.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListHostedZonesByVPC.html
          - "route53:ListHostedZonesByVPC"
          # Grants permission to list the configurations for DNS query logging that are associated with the current AWS account or the configuration that is associated with a specified hosted zone.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListQueryLoggingConfigs.html
          - "route53:ListQueryLoggingConfigs"
          # Grants permission to list the records in a specified hosted zone.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListResourceRecordSets.html
          - "route53:ListResourceRecordSets"
          # Grants permission to list the reusable delegation sets that are associated with the current AWS account.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListReusableDelegationSets.html
          - "route53:ListReusableDelegationSets"
          # Grants permission to list tags for one health check or hosted zone.
          # https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListTagsForResource.html
          - "route53:ListTagsForResource"

          #
          ## S3
          #

          # Grants permission to retrieve the configurations for a multi region access point.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DescribeMultiRegionAccessPointOperation.html
          - "s3:DescribeMultiRegionAccessPointOperation"
          # Grants permission to return configuration information about the specified access point.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPoint.html
          - "s3:GetAccessPoint"
          # Grants permission to retrieve the configuration of the object lambda enabled access point.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointConfigurationForObjectLambda.html
          - "s3:GetAccessPointConfigurationForObjectLambda"
          # Grants permission to create an object lambda enabled accesspoint.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointForObjectLambda.html
          - "s3:GetAccessPointForObjectLambda"
          # Grants permission to return the policy status for a specific access point policy.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicyStatus.html
          - "s3:GetAccessPointPolicyStatus"
          # Grants permission to return the policy status for a specific object lambda access point policy.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetAccessPointPolicyStatusForObjectLambda.html
          - "s3:GetAccessPointPolicyStatusForObjectLambda"
          # Grants permission to retrieve the PublicAccessBlock configuration for an AWS account.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetPublicAccessBlock.html
          - "s3:GetAccountPublicAccessBlock"
          # Grants permission to use the acl subresource to return the access control list (ACL) of an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html
          - "s3:GetBucketAcl"
          # Grants permission to return the CORS configuration information set for an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketCors.html
          - "s3:GetBucketCORS"
          # Grants permission to return the Region that an Amazon S3 bucket resides in.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html
          - "s3:GetBucketLocation"
          # Grants permission to return the logging status of an Amazon S3 bucket and the permissions users have to view or modify that status.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLogging.html
          - "s3:GetBucketLogging"
          # Grants permission to get the notification configuration of an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketNotification.html
          - "s3:GetBucketNotification"
          # Grants permission to retrieve ownership controls on a bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketOwnershipControls.html
          - "s3:GetBucketOwnershipControls"
          # Grants permission to return the policy of the specified bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicy.html
          - "s3:GetBucketPolicy"
          # Grants permission to return the tag set associated with an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketTagging.html
          - "s3:GetBucketTagging"
          # Grants permission to return the versioning state of an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketVersioning.html
          - "s3:GetBucketVersioning"
          # Grants permission to return the website configuration for an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketWebsite.html
          - "s3:GetBucketWebsite"
          # Grants permission to get a metrics configuration from an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketMetricsConfiguration.html
          - "s3:GetMetricsConfiguration"
          # Grants permission to return configuration information about the specified multi region access point.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetMultiRegionAccessPoint.html
          - "s3:GetMultiRegionAccessPoint"
          # Grants permission to returns the access point policy associated with the specified multi region access point.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetMultiRegionAccessPointPolicy.html
          - "s3:GetMultiRegionAccessPointPolicy"
          # Grants permission to list access points.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListAccessPoints.html
          - "s3:ListAccessPoints"
          # Grants permission to list object lambda enabled accesspoints.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_ListAccessPointsForObjectLambda.html
          - "s3:ListAccessPointsForObjectLambda"
          # Grants permission to list all buckets owned by the authenticated sender of the request.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListBuckets.html
          - "s3:ListAllMyBuckets"
          # Grants permission to list metadata about all the versions of objects in an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectVersions.html
          - "s3:ListBucketVersions"

          #
          ## SES V1 (Simple Email Service )
          # https://docs.aws.amazon.com/ses/latest/APIReference/API_Operations.html

          # Grants permission to return the email sending status of your account.
          # https://docs.aws.amazon.com/ses/latest/APIReference/API_GetAccountSendingEnabled.html
          - "ses:GetAccountSendingEnabled"
          # Grants permission to returns the user's sending statistics.
          # https://docs.aws.amazon.com/ses/latest/APIReference/API_GetSendStatistics.html
          - "ses:GetSendStatistics"
          # Grants permission to return the template object, which includes the subject line, HTML par, and text part for the template you specify.
          # https://docs.aws.amazon.com/ses/latest/APIReference/API_GetTemplate.html
          - "ses:GetTemplate"
          # Grants permission to list the email templates present in your account.
          # https://docs.aws.amazon.com/ses/latest/APIReference/API_ListTemplates.html
          - "ses:ListTemplates"
          # Grants permission to list all of the email addresses that have been verified in your account.
          # https://docs.aws.amazon.com/ses/latest/APIReference/API_ListVerifiedEmailAddresses.html
          - "ses:ListVerifiedEmailAddresses"

          #
          ## SES V2 (Simple Email Service )
          #

          # Grants permission to get information about the email-sending status and capabilities for your account.
          # https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetAccount.html
          - "ses:GetAccount"
          # Grants permission to retrieve the results of a predictive inbox placement test.
          # https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDeliverabilityTestReport.html
          - "ses:GetDeliverabilityTestReport"
          # Grants permission to retrieve all the deliverability data for a specific campaign.
          # https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDomainDeliverabilityCampaign.html
          - "ses:GetDomainDeliverabilityCampaign"
          # Grants permission to retrieve inbox placement and engagement rates for the domains that you use to send email.
          # https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_GetDomainStatisticsReport.html
          - "ses:GetDomainStatisticsReport"
          # Grants permission to retrieve the list of the predictive inbox placement tests that you've performed, regardless of their statuses, for your account.
          # https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListDeliverabilityTestReports.html
          - "ses:ListDeliverabilityTestReports"
          # Grants permission to list deliverability data for campaigns that used a specific domain to send email during a specified time range.
          # https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListDomainDeliverabilityCampaigns.html
          - "ses:ListDomainDeliverabilityCampaigns"
          # Grants permission to list the email identities for your account.
          # https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListEmailIdentities.html
          - "ses:ListEmailIdentities"
          # Grants permission to list all of the email templates for your account.
          # https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListEmailTemplates.html
          - "ses:ListEmailTemplates"
          # Grants permission to retrieve a list of the tags (keys and values) that are associated with a specific resource for your account.
          # https://docs.aws.amazon.com/ses/latest/APIReference-V2/API_ListTagsForResource.html
          - "ses:ListTagsForResource"

          #
          ## SNS (Simple Notification System)
          #

          # Grants permission to return a list of the requester's subscriptions.
          # https://docs.aws.amazon.com/sns/latest/api/API_ListSubscriptions.html
          - "sns:ListSubscriptions"
          # Grants permission to return a list of the subscriptions to a specific topic.
          # https://docs.aws.amazon.com/sns/latest/api/API_ListSubscriptionsByTopic.html
          - "sns:ListSubscriptionsByTopic"
          # Grants permission to list all tags added to the specified Amazon SNS topic.
          # https://docs.aws.amazon.com/sns/latest/api/API_ListTagsForResource.html
          - "sns:ListTagsForResource"
          # Grants permission to return a list of the requester's topics.
          # https://docs.aws.amazon.com/sns/latest/api/API_ListTopics.html
          - "sns:ListTopics"

          #
          ## SQS (Simple Queue Service)
          #

          # Grants permission to get attributes for the specified queue.
          # https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueAttributes.html
          - "sqs:GetQueueAttributes"
          # Grants permission to return the URL of an existing queue.
          # https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_GetQueueUrl.html
          - "sqs:GetQueueUrl"
          # Grants permission to return a list of your queues that have the RedrivePolicy queue attribute configured with a dead letter queue.
          # https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListDeadLetterSourceQueues.html
          - "sqs:ListDeadLetterSourceQueues"
          # Grants permission to list tags added to an SQS queue.
          # https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListQueueTags.html
          - "sqs:ListQueueTags"
          # Grants permission to return a list of your queues.
          # https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_ListQueues.html
          - "sqs:ListQueues"

          #
          ## Step Functions
          #

          # Grants permission to describe an activity.
          # https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeActivity.html
          - "states:DescribeActivity"
          # Grants permission to describe an execution.
          # https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeExecution.html
          - "states:DescribeExecution"
          # Grants permission to describe a state machine.
          # https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachine.html
          - "states:DescribeStateMachine"
          # Grants permission to describe the state machine for an execution.
          # https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachineForExecution.html
          - "states:DescribeStateMachineForExecution"
          # Grants permission to be used by workers to retrieve a task (with the specified activity ARN) which has been scheduled for execution by a running state machine.
          # https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetActivityTask.html
          - "states:GetActivityTask"
          # Grants permission to return the history of the specified execution as a list of events.
          # https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetExecutionHistory.html
          - "states:GetExecutionHistory"
          # Grants permission to list the existing activities.
          # https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListActivities.html
          - "states:ListActivities"
          # Grants permission to list the executions of a state machine.
          # https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListExecutions.html
          - "states:ListExecutions"
          # Grants permission to lists the existing state machines.
          # https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachines.html
          - "states:ListStateMachines"
          # Grants permission to list tags for an AWS Step Functions resource.
          # https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListTagsForResource.html
          - "states:ListTagsForResource"

          #
          ## X-Ray
          #

          # Grants permission to retrieve a list of traces specified by ID. Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs.
          # https://docs.aws.amazon.com/xray/latest/api/API_BatchGetTraces.html
          - "xray:BatchGetTraces"
          # Grants permission to retrieve group resource details.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetGroup.html
          - "xray:GetGroup"
          # Grants permission to retrieve all active group details.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetGroups.html
          - "xray:GetGroups"
          # Grants permission to retrieve the details of a specific insight.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetInsight.html
          - "xray:GetInsight"
          # Grants permission to retrieve the events of a specific insight.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetInsightEvents.html
          - "xray:GetInsightEvents"
          # Grants permission to retrieve the part of the service graph which is impacted for a specific insight.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetInsightImpactGraph.html
          - "xray:GetInsightImpactGraph"
          # Grants permission to retrieve the summary of all insights for a group and time range with optional filters.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetInsightSummaries.html
          - "xray:GetInsightSummaries"
          # Grants permission to retrieve all sampling rules.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingRules.html
          - "xray:GetSamplingRules"
          # Grants permission to retrieve information about recent sampling results for all sampling rules.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingStatisticSummaries.html
          - "xray:GetSamplingStatisticSummaries"
          # Grants permission to request a sampling quota for rules that the service is using to sample requests.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetSamplingTargets.html
          - "xray:GetSamplingTargets"
          # Grants permission to retrieve a document that describes services that process incoming requests, and downstream services that they call as a result.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetServiceGraph.html
          - "xray:GetServiceGraph"
          # Grants permission to retrieve an aggregation of service statistics defined by a specific time range bucketed into time intervals.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetTimeSeriesServiceStatistics.html
          - "xray:GetTimeSeriesServiceStatistics"
          # Grants permission to retrieve a service graph for one or more specific trace IDs.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetTraceGraph.html
          - "xray:GetTraceGraph"
          # Grants permission to retrieve IDs and metadata for traces available for a specified time frame using an optional filter. To get the full traces, pass the trace IDs to BatchGetTraces.
          # https://docs.aws.amazon.com/xray/latest/api/API_GetTraceSummaries.html
          - "xray:GetTraceSummaries"
          # Grants permission to list tags for an X-Ray resource.
          # https://docs.aws.amazon.com/xray/latest/api/API_ListTagsForResource.html
          - "xray:ListTagsForResource"
        Resource: "*"

SERVERLESS ROLE WRITE PERMISSIONS

ServerlessWritePolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
Roles:
- !Ref ServerlessRole
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
#
## API Gateway
#
# Serverless Inc. Comments: This enables us to automatically configure and continuously verify configuration exists for enabling logging from API Gateway and ingesting those logs.
# Changes information about a Stage resource.

text
# Grants permission to update stage
          # https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonapigatewaymanagementv2.html#amazonapigatewaymanagementv2-Stage
          - "apigateway:UpdateStage"

          ##
          ## Cloudwatch Logs
          #
          # Serverless Inc. Comments: These enables us to automatically configure and continuously verify configuration exists Subscription filters for Cloudwatch.
          # Creates or updates a destination. This operation is used only to create destinations for cross-account subscriptions.
          # A destination encapsulates a physical resource (such as an Amazon Kinesis stream) and enables you to subscribe to a real-time stream of log events for a different account, ingested using PutLogEvents.
          # Through an access policy, a destination controls what is written to it. By default, PutDestination does not set any access policy with the destination, which means a cross-account user cannot call PutSubscriptionFilter against this destination. To enable this, the destination owner must call PutDestinationPolicy after PutDestination.

          # Creates a log group with the specified name.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogGroup.html
          - "logs:CreateLogGroup"
          # Grants permissions to create or update a Destination.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDestination.html
          - "logs:PutDestination"
          # Grants permissions to create or update an access policy associated with an existing Destination.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDestinationPolicy.html
          - "logs:PutDestinationPolicy"
          # Grants permissions to create or update a subscription filter and associates it with the specified log group.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutSubscriptionFilter.html
          - "logs:PutSubscriptionFilter"
          # Grants permissions to delete a subscription filter associated with the specified log group.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteSubscriptionFilter.html
          - "logs:DeleteSubscriptionFilter"

          #
          ## Lambda
          # https://docs.aws.amazon.com/lambda/latest/dg/API_Operations.html

          # Grants permission to modify the version-specific settings of an AWS Lambda function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html
          - "lambda:UpdateFunctionConfiguration"
          # Grants permission to invoke a function asynchronously.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_InvokeAsync.html
          - "lambda:InvokeAsync"
          # Grants permission to invoke an AWS Lambda function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html
          - "lambda:InvokeFunction"

          #
          ## S3
          #

          # Grants permission to receive notifications when certain events happen in an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketNotification.html
          - "s3:PutBucketNotification"
        Resource: "*"
      - Effect: Allow
        Action:
          # Grants permission to delete a specified stack.s
          # https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteStack.html
          - "cloudformation:DeleteStack"
          # Grants permission to delete the specified managed policy and remove it from any IAM entities (users, groups, or roles) to which it is attached.
          # https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html
          - "iam:DeletePolicy"
          # Grants permission to delete the specified role.
          # https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteRole.html
          - "iam:DeleteRole"
          # Grants permission to detach a managed policy from the specified role.
          # https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachRolePolicy.html
          - "iam:DetachRolePolicy"
          # Grants permission to delete a version from the specified managed policy
          # https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicyVersion.html
          - "iam:DeletePolicyVersion"
          # Grants permission to retrieve information about the specified managed policy, including the policy's default version and the total number of identities to which the policy is attached.
          # https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetPolicy.html
          - "iam:GetPolicy"
          # Grants permission to list information about the versions of the specified managed policy, including the version that is currently set as the policy's default version.
          # https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListPolicyVersions.html
          - "iam:ListPolicyVersions"
          - "iam:DeleteRolePolicy"
          # Grants permission to Create the Service Linked Roles that Serverless needs to operate. Each ServiceLinkedRole is defined in the resource block below
          # https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateServiceLinkedRole.html
          - "iam:CreateServiceLinkedRole"
        Resource:
          - !Sub arn:aws:iam::${AWS::AccountId}:role/aws-service-role/apidestinations.events.amazonaws.com/AWSServiceRoleForAmazonEventBridgeApiDestinations
          - !Sub "${AWS::StackId}"
          - !Sub "arn:aws:iam::${AWS::AccountId}:role/ServerlessRole"
          - !Sub "arn:aws:iam::${AWS::AccountId}:role/ServerlessMonitoringRole"
          - !Sub "arn:aws:iam::${AWS::AccountId}:policy/Serverless-Inc-Role-Stack-Serverless*"
          - !Sub "arn:aws:iam::${AWS::AccountId}:role/ServerlessEventSubscriptionExecutionRole"

SERVERLESS ROLE MONITORING PERMISSIONS

ServerlessMonitoringPolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
Roles:
- !Ref ServerlessRole
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
#
##
###
#### Serverless Metrics - Cloudwatch Stream policies
###
##
#

text
# Grants permission to return the details of a CloudWatch metric stream.
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStream.html
          - "cloudwatch:GetMetricStream"
          # Grants permission to create a CloudWatch metric stream, or update an existing metric stream if it already exists
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_PutMetricStream.html
          - "cloudwatch:PutMetricStream"
          # Grants permission to delete the CloudWatch metric stream that you specify
          # https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DeleteMetricStream.html
          - "cloudwatch:DeleteMetricStream"
        Resource:
          - !Sub "arn:aws:cloudwatch:*:${AWS::AccountId}:metric-stream/serverless_metrics-stream"
      - Effect: Allow
        Action:
          #
          ##
          ###
          #### Serverless Logs - Cloud Watch Logs Filter
          ###
          ##
          #

          ##
          ## Cloudwatch Logs
          #
          # Serverless Inc. Comments: These enables us to automatically configure and continuously verify configuration exists Subscription filters for Cloudwatch.
          # Creates or updates a destination. This operation is used only to create destinations for cross-account subscriptions.
          # A destination encapsulates a physical resource (such as an Amazon Kinesis stream) and enables you to subscribe to a real-time stream of log events for a different account, ingested using PutLogEvents.
          # Through an access policy, a destination controls what is written to it. By default, PutDestination does not set any access policy with the destination, which means a cross-account user cannot call PutSubscriptionFilter against this destination. To enable this, the destination owner must call PutDestinationPolicy after PutDestination.

          # Grants permissions to create or update a Destination.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDestination.html
          - "logs:PutDestination"
          # Grants permissions to create or update an access policy associated with an existing Destination.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDestinationPolicy.html
          - "logs:PutDestinationPolicy"
          # Grants permissions to create or update a subscription filter and associates it with the specified log group.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutSubscriptionFilter.html
          - "logs:PutSubscriptionFilter"
          # Grants permissions to delete a subscription filter associated with the specified log group.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteSubscriptionFilter.html
          - "logs:DeleteSubscriptionFilter"
        Resource:
          - !Sub "arn:aws:cloudwatch:*:${AWS::AccountId}:metric-stream/serverless_metrics-stream"
      - Effect: Allow
        Action:
          #
          ##
          ###
          #### Serverless Monitoring - Kinesis Firehose Delivery policies
          ###
          ##
          #

          # Grants permission to describe the specified delivery stream and gets the status.
          # https://docs.aws.amazon.com/firehose/latest/APIReference/API_DescribeDeliveryStream.html
          - "firehose:DescribeDeliveryStream"
          # Grants permission to create a delivery stream.
          # https://docs.aws.amazon.com/firehose/latest/APIReference/API_CreateDeliveryStream.html
          - "firehose:CreateDeliveryStream"
          # Grants permission to delete a delivery stream and its data.
          # https://docs.aws.amazon.com/firehose/latest/APIReference/API_DeleteDeliveryStream.html
          - "firehose:DeleteDeliveryStream"
          # Grants permission to update a delivery stream's destination configuration.
          # https://docs.aws.amazon.com/firehose/latest/APIReference/API_UpdateDestination.html
          - "firehose:UpdateDestination"
        Resource:
          - !Sub "arn:aws:firehose:*:${AWS::AccountId}:deliverystream/serverless_metrics-firehose"
          - !Sub "arn:aws:firehose:*:${AWS::AccountId}:deliverystream/serverless_logs-firehose"
      - Effect: Allow
        Action:
          #
          ##
          ###
          #### Serverless Metrics - Kinesis Firehose required S3 Bucket policies
          ###
          ##
          #

          # Grants permission to return the Region that an Amazon S3 bucket resides in.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html
          - "s3:GetBucketLocation"
          # Grants permission to create a new bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html
          - "s3:CreateBucket"
          # Grants permission to delete the bucket named in the URI.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
          - "s3:DeleteBucket"
          # Grants permission to list some or all of the objects in an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html
          - "s3:ListBucket"
          # Grants permission to remove the null version of an object and insert a delete marker, which becomes the current version of the object.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html
          - "s3:DeleteObject"
          # Grants permission to attach a bucket policy to an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketPolicy.html
          - "s3:PutBucketPolicy"
          # Grants permission to remove a bucket policy on an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html
          - "s3:DeleteBucketPolicy"
          # Grants permission to create or update a Lifecycle Configuration on an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLifecycleConfiguration.html
          - "s3:PutLifecycleConfiguration"
          - "s3:GetLifecycleConfiguraiton"

        Resource:
          # The bucket name will include unique id to avoid bucket duplication
          - "arn:aws:s3:::serverless.firehose-backup-*"
          # Legacy buckets for firehoses
          - "arn:aws:s3:::serverless.metrics-firehose-backup-*"
          - "arn:aws:s3:::serverless.logs-firehose-backup-*"
      - Effect: Allow
        Sid: "ServerlessIncEventBridgeAccess"
        Action:
          # Grants permission to retrive details about a Connection in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeConnection.html
          - "events:DescribeConnection"
          # Grants permission to retrive details about a Rule in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeRule.html
          - "events:DescribeRule"
          # Grants permission to retrieve details about an API Destination in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DescribeApiDestination.html
          - "events:DescribeApiDestination"
          # Grants permission to create a new Connection in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateConnection.html
          - "events:CreateConnection"
          # Grants permission to create a new API Destination in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_CreateApiDestination.html
          - "events:CreateApiDestination"
          # Grants permission to create or update an Event Rule in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutRule.html
          - "events:PutRule"
          # Grants permission to create or update an Event Rule Target in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_PutTargets.html
          - "events:PutTargets"
          # Grants permission to update a Connection in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdateConnection.html
          - "events:UpdateConnection"
          # Grant permission to update an API Destination in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_UpdateApiDestination.html
          - "events:UpdateApiDestination"
          # Grant permission to delete an Event Rule in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteRule.html
          - "events:DeleteRule"
          # Grant permission to delete a Connection in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteConnection.html
          - "events:DeleteConnection"
          # Grant permission to delete an API Destination in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteApiDestination.html
          - "events:DeleteApiDestination"
          # Grant permission to remove an Event Rule Target in Amazon Eventbridge.
          # https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_RemoveTargets.html
          - "events:RemoveTargets"
        Resource:
          - !Sub "arn:aws:events:*:${AWS::AccountId}:rule/serverless_*"
          - !Sub "arn:aws:events:*:${AWS::AccountId}:rule/default/serverless_*"
          - !Sub "arn:aws:events:*:${AWS::AccountId}:api-destination/serverless_*"
          - !Sub "arn:aws:events:*:${AWS::AccountId}:connection/serverless_*"
      - Effect: Allow
        Sid: "ServerlessIncCloudtrailAccess"
        Action:
          # Grants permission to retrieve settings information for a trail in AWS CloudTrail.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetTrail.html
          - "cloudtrail:GetTrail"
          # Grants permission to create a trail in AWS CloudTrail.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_CreateTrail.html
          - "cloudtrail:CreateTrail"
          # Grants permission to delete a trail in AWS CloudTrail.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DeleteTrail.html
          - "cloudtrail:DeleteTrail"
          # Grants permission to update a trail in AWS CloudTrail.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_UpdateTrail.html
          - "cloudtrail:UpdateTrail"
          # Grants permission to start logging AWS CloudTrail events for a trail in AWS CloudTrail.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StartLogging.html
          - "cloudtrail:StartLogging"
          # Grants permission to stop logging AWS CloudTrail events for a trail in AWS CloudTrail.
          # https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html
          - "cloudtrail:StopLogging"
        Resource:
          - !Sub "arn:aws:cloudtrail:*:${AWS::AccountId}:trail/serverless_trail"
      - Effect: Allow
        Sid: "ServerlessIncEventBridgeSecretsAccess"
        Action:
          # Grants permission to create a secret in AWS Secrets Manager.
          # https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_CreateSecret.html
          - "secretsmanager:CreateSecret"
          # Grants permission to update a secret in AWS Secrets Manager.
          # https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_UpdateSecret.html
          - "secretsmanager:UpdateSecret"
          # Grants permission to retrieve the details of a secret in AWS Secrets Manager.
          # https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DescribeSecret.html
          - "secretsmanager:DescribeSecret"
          # Grants permission to delete a secret in AWS Secrets Manager.
          # https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html
          - "secretsmanager:DeleteSecret"
          # Grants permission to retrieve a secret value in AWS Secrets Manager.
          # https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html
          - "secretsmanager:GetSecretValue"
          # Grants permission to create or update a secret value in AWS Secrets Manager.
          # https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_PutSecretValue.html
          - "secretsmanager:PutSecretValue"
        Resource: !Sub "arn:aws:secretsmanager:*:${AWS::AccountId}:secret:events!connection/serverless_event_connection/*"

SERVERLESS ROLE ASSUME PERMISSIONS

ServerlessAssumePolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
Roles:
- !Ref ServerlessRole
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
# Grants permission to pass a role to a service.
# https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html
- "iam:PassRole"
Resource:
- !Sub "arn:aws:iam::${AWS::AccountId}:role/ServerlessMonitoringRole"
- !GetAtt ServerlessEventSubscriptionExecutionRole.Arn

SERVERLESS Metrics ROLE PERMISSIONS

ServerlessMonitoringStreamPolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
Roles:
- !Ref ServerlessMonitoringRole
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
#
##
###
#### Serverless Monitoring Stream - Kinesis Firehose policies
###
##
#

text
# Grants permission to write a single data record into an Amazon Kinesis Firehose delivery stream.
          # https://docs.aws.amazon.com/firehose/latest/APIReference/API_PutRecord.html
          - "firehose:PutRecord"
          # Grants permission to write multiple data records into a delivery stream in a single call, which can achieve higher throughput per producer than when writing single records.
          # https://docs.aws.amazon.com/firehose/latest/APIReference/API_PutRecordBatch.html
          - "firehose:PutRecordBatch"
        Resource:
          - !Sub "arn:aws:firehose:*:${AWS::AccountId}:deliverystream/serverless_metrics-firehose"
          - !Sub "arn:aws:firehose:*:${AWS::AccountId}:deliverystream/serverless_logs-firehose"

ServerlessMonitoringFirehosePolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
Roles:
- !Ref ServerlessMonitoringRole
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
#
##
###
#### Serverless Metrics Stream - Glue policies
###
##
#

text
# Grants permission to retrieve a table.
          # https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTable
          - "glue:GetTable"
          # Grants permission to retrieve a version of a table.
          # https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTableVersion
          - "glue:GetTableVersion"
          # Grants permission to retrieve a list of versions of a table.
          # https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-catalog-tables.html#aws-glue-api-catalog-tables-GetTableVersions
          - "glue:GetTableVersions"
        Resource:
          - !Sub "arn:aws:glue:*:${AWS::AccountId}:catalog"
          - !Sub "arn:aws:glue:*:${AWS::AccountId}:database/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"
          - !Sub "arn:aws:glue:*:${AWS::AccountId}:table/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"
      - Effect: Allow
        Action:
          #
          ##
          ###
          #### Serverless Metrics Stream - S3 policies
          ###
          ##
          #

          # Grants permission to abort a multipart upload.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_AbortMultipartUpload.html
          - "s3:AbortMultipartUpload"
          # Grants permission to return the Region that an Amazon S3 bucket resides in.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketLocation.html
          - "s3:GetBucketLocation"
          # Grants permission to retrieve objects from Amazon S3.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html
          - "s3:GetObject"
          # Grants permission to list some or all of the objects in an Amazon S3 bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html
          - "s3:ListBucket"
          # Grants permission to list in-progress multipart uploads.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListMultipartUploads.html
          - "s3:ListBucketMultipartUploads"
          # Grants permission to add an object to a bucket.
          # https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html
          - "s3:PutObject"
        Resource:
          - "arn:aws:s3:::serverless.firehose-backup-*"
          - "arn:aws:s3:::serverless.firehose-backup-*/*"
          # Legacy buckets for firehoses
          - "arn:aws:s3:::serverless.metrics-firehose-backup-*"
          - "arn:aws:s3:::serverless.metrics-firehose-backup-*/*"
          - "arn:aws:s3:::serverless.logs-firehose-backup-*"
          - "arn:aws:s3:::serverless.logs-firehose-backup-*/*"
      - Effect: Allow
        Action:
          #
          ##
          ###
          #### Serverless Metrics Stream - Lambda policies
          ###
          ##
          #

          # Grants permission to invoke an AWS Lambda function.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html
          - "lambda:InvokeFunction"
          # Grants permission to view details about the version-specific settings of an AWS Lambda function or version.
          # https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionConfiguration.html
          - "lambda:GetFunctionConfiguration"
        Resource:
          - !Sub "arn:aws:lambda:*:${AWS::AccountId}:function:%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"
      - Effect: Allow
        Action:
          #
          ##
          ###
          #### Serverless Metrics Stream - KMS (Key Management Service) policies
          ###
          ##
          #

          # Controls permission to use the AWS KMS key to generate data keys. You can use the data keys to encrypt data outside of AWS KMS.
          # https://docs.aws.amazon.com/kms/latest/APIReference/API_GenerateDataKey.html
          - "kms:GenerateDataKey"
          # Controls permission to decrypt ciphertext that was encrypted under an AWS KMS key.
          # https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html
          - "kms:Decrypt"
        Resource:
          - !Sub "arn:aws:kms:*:${AWS::AccountId}:key/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"
      - Effect: Allow
        Action:
          #
          ##
          ###
          #### Serverless Metrics Stream - CloudWatch Logs policies
          ###
          ##
          #

          # Grants permissions to upload a batch of log events to the specified log stream.
          # https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutLogEvents.html
          - "logs:PutLogEvents"
        Resource:
          - !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/kinesisfirehose/serverless_metrics-firehose:log-stream:*"
          - !Sub "arn:aws:logs:*:${AWS::AccountId}:log-group:%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%:log-stream:*"
      - Effect: Allow
        Action:
          #
          ##
          ###
          #### Serverless Metrics Stream - Kinesis policies
          ###
          ##
          #

          # Grants permission to describe the specified stream.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_DescribeStream.html
          - "kinesis:DescribeStream"
          # Grants permission to get a shard iterator. A shard iterator expires five minutes after it is returned to the requester.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetShardIterator.html
          - "kinesis:GetShardIterator"
          # Grants permission to get data records from a shard.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_GetRecords.html
          - "kinesis:GetRecords"
          # Grants permission to list the shards in a stream and provides information about each shard.
          # https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListShards.html
          - "kinesis:ListShards"
        Resource:
          - !Sub "arn:aws:kinesis:*:${AWS::AccountId}:stream/%FIREHOSE_POLICY_TEMPLATE_PLACEHOLDER%"

Parameters:
AccountId:
Type: String
ReportServiceToken:
Type: String
ExternalId:
Type: String
Version:
Type: String

File: node/package.json

{
"repository": "serverless/runtime",
"author": "Serverless, Inc.",
"husky": {
"hooks": {
"pre-commit": "lint-staged"
}
},
"lint-staged": {
".js": [
"eslint"
],
".{css,html,js,json,md,yaml,yml}": [
"prettier -c"
]
},
"devDependencies": {
"@aws-lambda-powertools/logger": "^1.10.0",
"@aws-sdk/client-api-gateway": "^3.358.0",
"@aws-sdk/client-apigatewayv2": "^3.358.0",
"@aws-sdk/client-cloudwatch-logs": "^3.358.0",
"@aws-sdk/client-dynamodb": "^3.358.0",
"@aws-sdk/client-iam": "^3.358.0",
"@aws-sdk/client-lambda": "^3.358.0",
"@aws-sdk/client-s3": "^3.358.0",
"@aws-sdk/client-sns": "^3.358.0",
"@aws-sdk/client-sqs": "^3.358.0",
"@aws-sdk/client-sts": "^3.358.0",
"@commitlint/cli": "^17.6.5",
"@commitlint/lint": "^17.6.5",
"@octokit/rest": "^19.0.13",
"@rollup/plugin-multi-entry": "^4.1.0",
"@rollup/plugin-node-resolve": "^13.3.0",
"@rollup/plugin-typescript": "^8.5.0",
"@serverless/eslint-config": "^5.1.0",
"@serverless/sdk-schema": "^0.15.6",
"@serverless/test": "^11.1.1",
"@serverless/utils": "^6.11.1",
"@tsconfig/node16": "^1.0.4",
"adm-zip": "^0.5.10",
"bunyan": "^1.8.15",
"chai": "^4.3.7",
"chalk": "^4.1.2",
"child-process-ext": "^2.1.1",
"deasync": "^0.1.28",
"esbuild": "^0.15.18",
"esbuild-plugin-d.ts": "^1.1.0",
"eslint": "^8.43.0",
"eslint-plugin-import": "^2.27.5",
"essentials": "^1.2.0",
"express": "^4.18.2",
"ext": "^1.7.0",
"fast-glob": "^3.2.12",
"fs2": "^0.3.9",
"git-list-updated": "^1.2.1",
"github-release-from-cc-changelog": "^2.3.0",
"husky": "^4.3.8",
"lint-staged": "^13.2.2",
"lodash": "^4.17.21",
"log": "^6.3.1",
"log-node": "^8.0.3",
"long": "^5.2.3",
"memoizee": "^0.4.15",
"mocha": "^9.2.2",
"ncjsm": "^4.3.2",
"node-fetch": "^2.6.11",
"node-machine-id": "^1.1.12",
"pino": "^8.14.1",
"prettier": "^2.8.8",
"rimraf": "^3.0.2",
"rollup": "^2.79.1",
"rollup-plugin-dts": "^4.2.3",
"serverless-http": "^3.2.0",
"standard-version": "^9.5.0",
"stream-promise": "^3.2.0",
"timers-ext": "^0.1.7",
"toml": "^3.0.0",
"ts-proto": "^1.150.1",
"tslib": "^2.5.3",
"type": "^2.7.2",
"typescript": "^4.9.5",
"uni-global": "^1.0.0",
"uuid": "^9.0.0",
"winston": "^3.9.0",
"yargs-parser": "^21.1.1"
},
"scripts": {
"lint": "eslint .",
"lint:updated": "pipe-git-updated --ext=js --base=main -- eslint",
"prettier-check": "prettier -c "/*.{css,html,js,json,md,yaml,yml}"",
"prettier-check:updated": "pipe-git-updated --ext=css --ext=html --ext=js --ext=json --ext=md --ext=yaml --ext=yml --base=main -- prettier -c",
"prettify": "prettier --write --ignore-path .gitignore "/.{css,html,js,json,md,yaml,yml}"",
"prettify:updated": "pipe-git-updated --ext=css --ext=html --ext=js --ext=json --ext=md --ext=yaml --ext=yml --base=main -- prettier --write",
"test:dev-mode:integration": "mocha "test/go/dev-mode/test/integration/**/.test.js"",
"test:aws-lambda-sdk:integration:python": "mocha "test/python/aws-lambda-sdk/integration.test.js"",
"test:aws-lambda-sdk:integration:go": "mocha "test/go/aws-lambda-sdk/integration.test.js""
},
"engines": {
"node": ">=14.0"
},
"license": "MIT"
}

File: node/RELEASE_PROCESS.md

Release process

Semi-automation

All packages of the Serverless Runtime project rely on semantic commit messages, which allow for streamlining the release process (versioning and changelog generation is automated)

See proposed Commit Message Guidelines

Semantic commit messages are not required in PRs coming from forks (community contributions). Yet, such PR is expected to be squash merged by project members with a single semantic commit message.

PRs coming from branches have commit messages validated with commmitlint

Release flow

Releases for each package are triggered manually by preparing release PRs.

Preparation steps:

  1. Create the release branch (should derive from the current main state)
  2. Bump version ranges of all dependencies to the latest supported versions (e.g., if the latest version of a dependency is 2.3.5 and the range in a package.json is ^2.2.4, then it should be updated to ^2.3.5)
  3. Commit eventual dependency version updates with the following commit message:
    chore: Bump dependencies
  4. Run npm run prepare-release command.
    It'll automatically bump the version in package.json to the expected one (by inspecting changes since the previous release) and will generate a new changelog entry.
  5. Improve generated changelog entry in CHANGELOG.md if needed.
  6. Commit package.json and CHANGELOG.md changes with the following commit message:
    chore: Release v<version>
  7. Push branch upstream and create a PR.
  8. After PR is accepted by CI and one of the reviewers, merge it via "Rebase and merge" option

Further actions are automated in CI context:

  1. main CI build detects that release PR was merged (by fact that it covers change of version field in package.json file). Having that (after successful tests pass) version tag is created and pushed to the repository.
  2. Tag CI build publishes a new version to npm, also it retrieves release notes from CHANGELOG.md and publishes them to GitHub.

Updating release notes for already published versions

Improvements to release notes can be done at any time to any already published version:

  1. Update CHANGELOG.md with desired changes (ensure they'd also end in main)
  2. Push updated release notes to GitHub by running:
    npx github-release-from-cc-changelog <versionTag>

File: node/packages/aws-lambda-otel-extension/README.md

@serverless/aws-lambda-otel-extension

AWS Lambda extension that gathers [OpenTelemetry](https://opentelemetry.io/) data and sends it to the Serverless Console ingestion servers

Package is still in an experimental stage and subject to major changes.

At this point, only Node.js runtime is supported, but this support will be extended in the near future

How does it work?

The extension is a lambda layer with a source maintained in opt folder. There are two extensions configured within a layer:

  1. External, placed in opt/otel-extension/external folder, which gathers information (from (1) execution environment (2) AWS Lambdas APIs (3) Data provided via internal extension) and sends the compliant OpenTelemetry payload to Serverless Console ingestion servers
  2. Internal, placed in opt/otel-extension/internal folder, which is pre-run in the same process as Node.js Lambda handler, and through pre-setup instrumentation gathers additional data about invocations, which is sent to external extension

What telemetry payload does it generate?

TODO: This section will be completed in the near future

How to configure AWS Lambda to use it?

1. Build layer artifact

1.2 Node.js runtime version (external + internal extension)

Note: pre-build layer artifacts are published to our AWS accounts, and instead of building it manually (as documented below) it is advised to rely on them instead (for ARN's of the pre-published layers check registry files which are attached to GitHub releases)

sh
# Ensure layer dependencies are installed
cd external/otel-extension-external
npm install
cd ../../internal/otel-extension-internal-node
npm install

# Build artifact
cd ../../
npm run build

Artifact is generated into dist/extension.zip file

1.3 Runtime agnostic version (just external extension)

Runtime agnostic version (of just external layer) can be built as following

sh
# Ensure layer dependencies are installed
cd external/otel-extension-external
npm install

# Build artifact
cd ../../
npm run build:external

Artifact is generated into dist/extension-external.zip file

1.4 Custom settings

Monitoring settings (as documented below) can also be bundled into generated layers, for that pass path to settings file with --settings-filename param. File is expected to be a valid Node.js CJS module, It can be plain JSON, or JS, which can be helpful in case of dynamically resolved settings

sh
npm run build -- --settings-filename <path>

2. Publish layer

Publish layer artifact to your AWS account

3. Attach layer to target Lambda and configure necessary environment variables

Ensure that layer version ARN is listed in Lambda layers.

Ensure that internal extension of a layer is pre-loaded by configuring AWS_LAMBDA_EXEC_WRAPPER environment variable with /opt/otel-extension-internal-node/exec-wrapper.sh

4. Configure monitoring settings

Monitoring settings are expected to be provided in JSON format at SLS_EXTENSION environment variable.

Required settings:

`orgId`

Serverless Console organization id

`namespace`

Namespace at which reports should be grouped (Serverless Framework sets it with service name)

`environment`

Application environment (Serverless Framework sets with stage value)

`ingestToken`

Serverless Console ingestion token, to be obtained via Serverless Console API. At this point it's resolved automatically in context of the Serverless Framework (manual resolution instructions will be provided in a near future)

Optional settings:

`logs`

Settings that affect log monitoring. Supported options:

  • logs.disabled - Set to true to disable logs monitoring

`request`

Settings that affect requests monitoring. Supported options:

  • request.disabled - Set to true to disable requests monitoring

`response`

Settings that affect response monitoring. Supported options:

  • response.disabled - Set to true to disable response monitoring

Generated reports structure

TODO: Complete documentation on generated telemetry reports is in the works

Response reports

Any non JSON objects in either a simple response or a HTTP response payload are not included

For example, the following will be sent without any modifications 👇

json
{ "message": "lambda response" }
json
{ "statusCode": 200, "body": "{\"message\": \"lambda response\"}" }

The following responses will be altered

Simple non JSON object responses will be ignored

Input Output
"Lambda response" Ignored
true Ignored
12 Ignored

HTTP Responses with a non JSON body will be ignored

Input Output
{ "statusCode": 200, "body": "lambda response" } { "statusCode": 200 }

Tests

Tests can only be run in context of package repository (they're not included with npm package).

See Tests documentation

File: node/packages/aws-lambda-otel-extension/CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

[0.5.2](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-07-14)

Bug Fixes

  • Ensure broken settings do not break extension (9d09dfd)

[0.5.1](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-07-14)

Performance Improvements

  • Patch ineffective require-in-the-middle setup (62672b9)

[0.5.0](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-07-12)

⚠ BREAKING CHANGES

  • Configuration variable SLS_OTEL_USER_SETTINGS is renamed to SLS_EXTENSION
  • Introduce new mandatory orgId, namespace and environment settings (required by the Serverless Console)
  • Extension is no longer observability tool agnostic. It's reconfigured to report specifically to the Serverless Console.
    At the same time its configuration settings are simplified:
    • Support for destination in all configuration groups is dropped.
    • New required ingestToken property is introduced (for injection of kinesis server authentication token)
    • Support for metrics.outputType and traces.outputType was removed (reports are hardcoded to be send in protobuf.

Features

  • New mandatory orgId, namespace and environment settings (cc009de)
  • On invalid user settings make extension ineffective (8f7128b)
  • Remove support for [metrics|traces].outputType (91e7e03)
  • Rename SLS_OTEL_USER_SETTINGS into SLS_EXTENSION (aa2b00b)
  • Unconditionally send reports to the Serverless Console (80ef8dc)
  • Support bundling of custom settings into layers (cd699bc)
  • Allow environment changes in bundled settings (6e7bf67)

Maintenance Improvements

  • Add debug log on event/next response (33950f2)
  • Centralize user settings handling (b2bb89d)
  • Improve clarity of build script (3db6c0d)

[0.4.6](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-06-29)

Bug Fixes

  • Fix handling of promise resolution (867b3bc)

Maintenance Improvements

  • Improve resolution handling (938ce98)
  • Simplify stale callback handling (fb2885a)

[0.4.5](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-06-29)

Bug Fixes

  • Fix handling of a case where telemetryData arrives before eventData (26991ee)

Maintenance Improvements

  • Add debug logs on internal extension requests timing (2d2c2db)
  • Ensure to reuse HTTP(S) connection sockets (82d295a)
  • Remove node-fetch dependency (688e24d)

[0.4.4](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-06-27)

Bug Fixes

  • Fix handling of doubled resolution (8eacf17)

Performance Improvements

  • Optimize protobuf encoding by using pre-compiled interface (70f26e6)
  • Improve telemetry server response time (60ae043)

Maintenance Improvements

  • Clarify wrapping logic (2b203f0)
  • Cleanup invalid async mark (7423971)

[0.4.3](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-06-23)

Features

  • Add attributes and resource to req/res payload (18d69e9)

Maintenance Improvements

  • Changed getCurrentRequestData to getRequestContext (a80a961)
  • Added invoke time to internal context (c70d60a)

[0.4.2](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-06-15)

Maintenance Improvements

  • Adjusted errorType for handled/unhandled (4fe0437)
  • Updated timeout errorType (d9b60cd)

[0.4.1](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-06-13)

Bug Fixes

  • Fix ESM support in Node.js v16 runtime (2547826)

Maintenance Improvements

  • Cleanup timeout setup (ec7c67a)
  • Debug log telemetry data cache handling (b69e62f)
  • Ensure to flush report in one log line (64ca1dd)
  • Generalize debugLogs handling (bd6340b)
  • Improve debug logging (6aef91c)
  • Unify debug log handling (57aceba)

[0.4.0](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-06-02)

⚠ BREAKING CHANGES

  • All configuration settings are now set in JSON object in context of SLS_OTEL_USER_SETTINGS environment variable. Handling of following environment variables was replaced:
    • SLS_OTEL_REPORT_METRICS_URL (replaced by metrics.destination)
    • SLS_OTEL_REPORT_TRACES_URL (replaced by traces.destination)
    • SLS_OTEL_REPORT_LOGS_URL (replaced by logs.destination)
    • SLS_OTEL_REPORT_REQUEST_RESPONSE_URL (replaced by request.destination and response.destination)
    • SLS_OTEL_REPORT_REQUEST_HEADERS (replaced by common.destination.requestHeaders)
  • disableLogsMonitoring is replaced by logs.disabled
  • disableRequestResponseMonitoring is replaced by request.disabled and response.disabled

Features

  • Generalize request handling and integrate settings propagated via environment variables into user settings (e73acca)
  • Support new user settings format (c6904b6)

Bug Fixes

  • Wait for request/response hooks before settling invocation (6742606)
  • Ensure to handle property thenable/callback race (77bf67f)

Maintenance Improvements

  • Do not accept multiple paylaods at request functions (db33381)

[0.3.2](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-05-31)

Features

  • Filter out Serverless Dashboard data logs (b35c41c)

[0.3.1](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-05-26)

Bug Fixes

  • Fix dependencies configuration (9b41fa6)

Maintenance Improvements

  • Bundle internal and external extensions into a single file (9195c1e)
  • Distinguish JSON from request data (aa0141b)
  • Improve debug log for ingestion server requests (d2b5233)
  • Improve debug log for telemetry payload (b133ea6)
  • Log extension overhead processing durations (7ddb265)
  • Remove obsolete debug log (59ae9a8)
  • Rename logMessage to debugLog (b7c2edc)
  • Simplify protobuf processing (e339066)

[0.3.0](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-05-23)

⚠ BREAKING CHANGES

  • Path to exec wrapper has changed from /opt/otel-extension/internal/exec-wrapper.sh to /opt/otel-extension-internal-node/exec-wrapper.sh. Change should be reflected when configuring AWS_LAMBDA_EXEC_WRAPPER environment variable for lambda

Features

  • Build script for runtime agnostic version of external extension (e9fb48c)
  • Split internal and external extension into independent extensions (13a7a72)

Bug Fixes

  • Fix handling of JSON type payloads (5ba0175)

Maintenance Improvements

  • Rewrite external extension (73cfc5c)
  • Drop node-fetch dependency in external extension (cca15ed)
  • Provide separate userSettings source for both extensions (5a6909d)
  • Remove lodash.isobject dependency (4773a7c)
  • Remove OTEL_SERVER_PORT definition from common scope (fe443a7)
  • Remove common logMessage (a620a06)

[0.2.21](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-04-29)

Features

  • Avoid sending binary response data (dbb3711)

[0.2.20](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-04-26)

Bug Fixes

  • Updated timeout error message (2f49bcd)

[0.2.19](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-04-21)

Features

  • Suport userSettings.disableLogsMonitoring (54d1fa9)
  • Support userSettings.disableRequestResponseMonitoring (b7998b4)

Maintenance Improvements

  • Centralize log listener server handling (39fb512)
  • Centralize log listener server host and port configuration (1c38e2d)
  • Centralize subscription configuration (c6ffbc8)
  • Improve handling of dead paths (9336587)
  • Remove obsolete error handling (7310032)
  • Remove obsolete handling from telemetry server (247dec6)
  • Reorder initial setup (7f9e364)

[0.2.18](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-04-13)

Bug Fixes

  • Adjusted code for integration tests (5709511)
  • fixed integration test (81aa93f)
  • Fixed waitFor bug (8cf697a)

[0.2.17](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-04-13)

Bug Fixes

[0.2.13](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-04-13)

Bug Fixes

[0.2.12](https://github.com/serverless/runtime/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-04-13)

Bug Fixes

  • Include spanId in req/res data (1801503)

Maintenance Improvements

  • Automate extension version resolution (d1d8c12)
  • Improve faas.collector_version format (9ccbfa1)
  • Optimize instrumentations setup (99b47fd)
  • Prevent misleading "No modules.." warning (85fbc39)
  • Remove obsolete config configuration (5b448ba)
  • Remove obsolete instrumentation registration (014b6b3)
  • Remove obsolete payload compression (f5ceb3d)

File: node/packages/aws-lambda-otel-extension/package.json

{
"name": "@serverless/aws-lambda-otel-extension",
"repository": "serverless/runtime",
"version": "0.5.2",
"author": "Serverless, Inc.",
"dependencies": {
"adm-zip": "^0.5.9",
"child-process-ext": "^2.1.1",
"esbuild": "^0.14.49",
"essentials": "^1.2.0",
"fs2": "^0.3.9",
"memoizee": "^0.4.15",
"protobufjs": "^6.11.3",
"semver": "^7.3.7",
"yargs-parser": "^21.0.1"
},
"standard-version": {
"tagPrefix": "@serverless/aws-lambda-otel-extension@",
"path": ".",
"skip": {
"commit": true,
"tag": true
},
"types": [
{
"type": "feat",
"section": "Features"
},
{
"type": "fix",
"section": "Bug Fixes"
},
{
"type": "perf",
"section": "Performance Improvements"
},
{
"type": "refactor",
"section": "Maintenance Improvements"
}
]
},
"scripts": {
"build": "./scripts/build.js dist/extension.zip",
"build:external": "./scripts/build.js dist/extension-external.zip --mode=2",
"build:internal": "./scripts/build.js dist/extension-internal.zip --mode=1",
"generate-proto": "pbjs -t static-module -w commonjs -o external/otel-extension-external/proto.js proto/metric-service.proto proto/trace-service.proto",
"prepare-release": "standard-version && prettier --write CHANGELOG.md",
"test": "mocha "test/unit//*.test.js"",
"test:isolated": "mocha-isolated "test/unit//.test.js"",
"test:integration": "mocha "test/integration/**/.test.js"",
"test:performance": "mocha test/benchmark/performance.test.js"
},
"publishConfig": {
"access": "public"
},
"license": "MIT"
}

File: node/packages/aws-lambda-otel-extension/external/otel-extension-external/package.json

{
"dependencies": {
"protobufjs": "^6.11.3"
}
}

File: node/packages/aws-lambda-otel-extension/internal/otel-extension-internal-node/package.json

{
"dependencies": {
"@opentelemetry/api": "~1.0.4",
"@opentelemetry/core": "^1.4.0",
"@opentelemetry/instrumentation": "^0.27.0",
"@opentelemetry/instrumentation-aws-lambda": "^0.28.1",
"@opentelemetry/instrumentation-aws-sdk": "^0.5.1",
"@opentelemetry/instrumentation-dns": "^0.27.1",
"@opentelemetry/instrumentation-express": "^0.27.1",
"@opentelemetry/instrumentation-fastify": "^0.26.0",
"@opentelemetry/instrumentation-graphql": "^0.27.4",
"@opentelemetry/instrumentation-grpc": "^0.27.0",
"@opentelemetry/instrumentation-hapi": "^0.27.1",
"@opentelemetry/instrumentation-http": "^0.27.0",
"@opentelemetry/instrumentation-ioredis": "^0.27.1",
"@opentelemetry/instrumentation-koa": "^0.28.1",
"@opentelemetry/instrumentation-mongodb": "^0.28.0",
"@opentelemetry/instrumentation-mysql": "^0.27.1",
"@opentelemetry/instrumentation-net": "^0.27.1",
"@opentelemetry/instrumentation-pg": "^0.28.0",
"@opentelemetry/instrumentation-redis": "^0.28.0",
"@opentelemetry/resource-detector-aws": "^1.1.1",
"@opentelemetry/resources": "^1.4.0",
"@opentelemetry/sdk-trace-base": "^1.4.0",
"@opentelemetry/sdk-trace-node": "^1.4.0",
"lodash.clone": "^4.5.0",
"lodash.get": "^4.4.2",
"require-in-the-middle": "^5.1.0"
}
}

File: node/packages/aws-lambda-otel-extension/test/README.md

Tests

Unit tests

Unit tests are configured to be independent of any external infrastructure (AWS Lambda environment is emulated), and can be run offline

bash
npm test

Integration tests

AWS account is needed to run integration tests, and AWS credentials need to be configured.

In tests, the home folder is mocked, therefore AWS access cannot be reliably set up via the AWS_PROFILE variable or any other means that rely on configuration placed in the home folder.

Easiest is to run tests is by setting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION environment variables.

Tests create a temporary layer and Lambda resources and remove them after the test is finalized.

All created resourced are named or prefixed with test-otel-extension-<testUid> string, where testUid is four characters taken from local machine id or in case of CI runs a random string. testUid string can also be overridden via environment variable TEST_UID

bash
npm run test:integration

Performance tests

Both AWS credentials Serverless Console credentials are needed to run performance test.

Test confirms on performance of the extension instrumentation. Specifically they validate whether introduced initialization and invocation duration overhead doesn't go beyond agreed threshold.

Same as in case of integration tests, home folder is mocked, so AWS credentials cannot be set via AWS_PROFILE (easiest it to provide them via AWS_ACCESS_KEY_ID, and AWS_SECRET_ACCESS_KEY).

Console credentials need to be provided with following environment variables:

  • SLS_ORG_NAME - Name of the organization
  • SLS_ORG_TOKEN - Authentication org token, which can be obtained for given organization in Console UI

Otherwise characteristic of test is very same as in case of integration tests (please follow it's documentation)

bash
npm run test:performance

Environment variables

How extensions behave, for various testing purposes, can be tweaked with following environment variables:

Variables handled in extension logic

  • SERVERLESS_PLATFORM_STAGE - Ingestion server stage to which reports should be propagated (default is prod, with this setting it can be overridden to dev)
  • SLS_DEBUG_EXTENSION - Log debug messages, of which scope is to:
    • Mark certain processing points
    • Log payloads which are send between extensions and to the external ingestion server
    • Report durations overhead that extension introduces
  • SLS_TEST_EXTENSION_INTERNAL_LOG - In context of the internal extension, log payloads instead of sending them to the external extension
  • SLS_TEST_EXTENSION_HOSTNAME - Custom environment hostname. Used to override sandbox when setting up log subscription server
  • SLS_TEST_EXTENSION_REPORT_TYPE - Set to json to pass reports in direct JSON format instead of Protobuf
  • SLS_TEST_EXTENSION_REPORT_DESTINATION - Telemetry reports normally are sent to the Console ingestion servers, with this variable this can be overridden:
    • Set to s3:////<root-key> to send reports to S3 bucket
    • Set to log to just log reports into process stdout

Variables handled by test suite

  • SLS_TEST_EXTENSION_COMMAND - (Processed only in context of the external extension unit test) A command to run external extension process (e.g. node path/to/external-extension/module.js)
  • TEST_LAYER_FILENAME - Path to .zip file of a layer which contains both external and internal Node.js extensions, against which tests should be run
  • TEST_EXTERNAL_LAYER_FILENAME - Path to .zip file of a layer which contains external (runtime agnostic) extension. Triggers mode in which two layers are attached to the lambda (one with external and other with internal extension)
  • TEST_INTERNAL_LAYER_FILENAME - Path to .zip file of a layer which contains just internal Node.js extension. Triggers mode in which two layers are attached to the lambda (one with external and other with internal extension)

File: node/packages/aws-lambda-otel-extension/test/benchmark/README.md

Benchmarks

Tested use cases

Node.js function ([`callback`](../../fixtures/lambdas/callback.js))

No-op Node.js function. Handler takes callback and immediately invokes it with dummy payload

Node.js + Express function ([`express`](../../fixtures/lambdas/express.js))

Simple express app with two endpoints which respond with dummy payload.
Function is invoked with payload that reflects one that function will receive if it would be triggered through API Gateway integration

Node.js 250ms function ([`250ms`](../../fixtures/lambdas/250ms.js))

No-op Node.js function. Handler takes callback waits 250ms and invokes it with dummy payload.
In this case produced extension invocation overheads are slightly smaller as some of the extension work is done during lambda operation

Node.js 1s function ([`1s`](../../fixtures/lambdas/1s.js))

No-op Node.js function. Handler takes callback waits 1 second and invokes it with dummy payload.
In this case, produced extension invocation overheads are additionally reduced. Tests show that for longer going functions overheads remain same as for that one

Node.js heavy logging function ([`logger`](../../fixtures/lambdas/logger.js))

Logs 1000 individual log messages via console.log in short time frames

It's the only case which writes any logs (in other cases log reporting is not existing).

Benchmark variants

`bare`

No instrumentation (bare run with no extension layers onboard).

As there are no extensions loaded, there's no extension duration overhead introduced, and benchmark will naturally report them with zeros.

What we get is metrics from AWS report, that confirm on initialization duration, invocation duration, billed invocation duration and max memory used.

`externalOnly`

Just external extension which processes lambda event cycle. As no internal extension is loaded, no reports are processed and send by the external extension.

Difference from bare is that external extension process is initialized by AWS, and its that process that monitors and queues lambda invocation event cycle.

This additional process management introduces natural duration overhead which is best calculated by reading duration as reported by AWS for this variant and subtracting from it a bare variant duration

There's no time spent here on processing reports and propagating them to the ingestion server (as none are to be send from the internal extension). So internally measured invocation duration overhead of external extension is also reported as not existing

`internalOnly`

Just internal extension which generates telemetry reports and logs them to the console (when external extension is loaded those would be send to the external extension)

Difference from bare is that original lambda logic is additionally wrapped with internal extension log. Measured difference simply show what overhead is produced by gathering telemetry in context of the lambda handler process.

`jsonLog`

External & internal extensions are loaded. Internal extension operates fully (generates telemetry and sends it to external extension), while in external extension just report payloads are generated and logged into stdout (there's no conversion to Protobuf and not reporting to the remote ingestion server).

Difference from externalOnly is purely that internal extension is loaded and fully active and that it sends reports to the external extension.

Comparing its duration overhead against externalOnly and subtracting overehead of internalOnly shows how much overhead is introduced by sending telemetry payloads to the external extension and processing it in its scope

`protoLog`

Exactly same as jsonLog with a difference, that in the external extension JSON payloads are converted to the Protobuf (and it's Protobuf output that's logged to the stdout)

Comparing duration differences with jsonLog we can see how much overhead is generated by Protobuf conversion

`console`

Exactly same as protoLog but external extension reports the generated payloads to the ingestion server.

Comparing duration differences with protoLog we can see how much overhead is generated by communication with the remote ingestion server

Reported metrics

Each benchmark variant is run against 5 lambda instances.

Therefore for each metric outlined below, we get 5 numbers. Durations returned in result report are averages of those 5 values.

Internally measured durations are written by the extensions to the stdout, and are read (together with invocation reports as written by AWS) from CloudWatch logs.

Observed AWS Lambda execution lifecycle phases

Initialization (`init`)

Lambda instance initialization

Observed metrics

`init:external`

Duration of the external extension initialization logic, measured internally in external extension. It's the time between start of the external extension process, and reporting to the AWS extension API that we're ready to process Lambda invocations (AWS won't run any invocations until we do that).

This won't cover total external extension process initialization time, which is also taken by initialization of the process on its own.
Currently through benchmark reports we can see that external extension initialization takes ca 100ms, while internally measured initialization takes ca 30ms)

`init:internal`

Duration of the internal extension initialization logic, measured internally in internal extension. It's a time measured from start of the internal extension logic, until it returns for further evaluation by AWS runtime engine.

This initialization is synchronous, but internal extension may propagate some async tasks, of which processing is then mixed with tasks as issued eventually by lambda initialization logic (if it's asynchronous) or first invocation logic.

Due to how otel libraries are designed, internal extension issues an asynchronous task, still it's very minimal and shouldn't introduce any notable overhead.

As internal extension runs in very same process as lambda, there's we don't deal with other process initialization overhead. Still as this extension is handled by AWS runtime logic which otherwise is not triggered, and pollutes process memory with its objects, we still can observe some extra overhead not covered by this metric.
Currently through benchmark reports, we can see that internal extension initialization (for noop lambda) takes ca 150ms, while internally measured initialization takes ca 120ms

`init:total`

Total initialization time as reported by AWS (with initDuration metric provided in report of the first invocation)

Invocation

Benchmarks observe first invocation (first) (one that in regular circumstances immediately follows initialization), and the the second (following).

Two first invocations are observed separately, as data shows that durations of first invocation are always worse than of the second, and that for the following (third, fourth etc.) invocations numbers are similar as for the second.
This difference could be attributed to how Node.js internal optimization works, where paths which were already taken usually run faster (it's to be confirmed whether we see similar differences with other runtimes).

Observed metrics

`[first|following]:internal:request`

Invocation request handing duration in context of the Node.js internal extension. It's a time that's measured from the moment when our handler wrapper received an invocation event from AWS until we invoke the original Lambda handler.

It's a synchronous task, but extension logic starts asynchronous request to the external extension, which is processed when original lambda logic is run (or after it ends processing, in case of fast resolving lambda). This means that the extension and original handler tasks ordering is mixed, and we cannot reliably measure internally an overhead as introduced by the internal extension request handling in total.

`[first|following]:internal:response`

Invocation response handling duration in the context of the Node.js internal extension. It's a time that's measured from the moment when original handler provided response until we pass it back to AWS.

This one is asynchronous, as we propagate the response only after we're certain that extension request and response handlers have finalized its tasks (send successfully the telemetry data to the external extension).

`[first|following]:external`

Time spent in context of external extension process between receiving the platform.runtimeDone event (which signals that ongoing invocation have ended) and reporting via AWS Lambda extension API that we're ready to process next invocation )(external extension reports that only after all started ingestion server requests are finalized)

`[first|following]:total`

Total duration time as reported by AWS (with duration metric provided in invocation report)

`[first|following]:billed`

Billed duration time as reported by AWS (with billedDuration metric provided in invocation report)

`[first|following]:local

Locally measured SDK invocation time. This value is largely influenced by the location from which we run benchmarks and quality of the internet connection.

For benchmarks run against us-east-1 region, shortest values we'll get e.g. in New York, but running benchmarks in San Francisco will already add extra latency, and numbers get additionally worse, when running benchmarks from farther locations

`[first|following]:maxMemoryUsed

Max memory used as reported by AWS (with maxMemoryUsed metric provided in invocation report). It's to expose what memory overhead is introduced by the extensions

Summary

While overhead durations as measured and reported by the extensions internally help to coin where exactly performance bottlenecks occur, the real extension overhead numbers can only be deducted from durations as reported by the AWS.

With benchmark variants, as setup correctly. It's safe to assume that:

  • Comparing durations of externalOnly vs bare expose the overhead of the AWS Lambda event lifecycle handling in the external extension
  • Comparing durations of internalOnly vs bare expose the overhead of the internal extension telemetry generation
  • Comparing durations of jsonLog vs externalOnly and subtracting overhead as observed with internalOnly informs us of overhead introduced by sending telemetry payloads from internal to the external extension and processing it in its scope
  • Comparing durations of protoLog vs jsonLog expose the overhead of the Protobuf conversion that happens in external extension
  • Comparing durations of console vs protoLog expose the overhead of the communication with ingestion server that happens in external extension

Setup & Run

1. Ensure all dependencies are installed:

Run npm install in following folders:

  • external/otel-extension-external
  • internal/otel-extension-internal-node
  • test/fixtures/lambdas

2. Ensure AWS credentials

In same manner as for AWS CLI

3. Configure environment variables

  • AWS_REGION - region against which benchmarks should be run
  • SLS_ORG_NAME & SLS_ORG_TOKEN- (optional) Needed to benchmark scenario of reporting to the Console Kinesis server (if not provided, console variant will not be tested)
  • TEST_UID - (optional) common name token to be used as part of generated resource names. All generated resource names will be prefixed with test-oext-<test-uid>. If not provided, one is generated on basis of local machine id. Note: Script ensures that all generated resources are removed after benchmark is done
  • LOG_LEVEL - (optional) For more verbose output LOG_LEVEL=info can be used

4. Run

Benchmark for all configured use cases and benchmark variants can be run as:

bash
./test/scripts/benchmark.js

Generated benchmark results are output to the console in CSV format. To store them to the file output can be piped as:

bash
./test/scripts/benchmark.js > benchmark.csv

4.1 Run customization

Benchmark run can additionally be customized with following CLI params

  • --use-cases Comma separated list of function use cases to test (e.g. callback,express)
  • --benchmark-variants Comma separated list of benchmark variants to test (e.g. bare,externalOnly)
  • --memory-size Memory size to provide to lambdas (by default it's 128MB).
  • --extension-layers-mode By default benchmark are run against single layer which contains Node.js external and internal extension. By setting dual value for this mode, benchmark will be run with those two extensions provided as separate layers (and external layer will come with Node.js binary bundled)

Additionally extension layers that are used for testing can be overridden with following environment variables:

  • TEST_LAYER_FILENAME - Path to .zip file of a layer which contains both external and internal Node.js extensions. Ineffective with --extension-layers-mode=dual
  • TEST_EXTERNAL_LAYER_FILENAME - Path to .zip file of a layer which contains external (runtime agnostic) extension. Effective only with --extension-layers-mode=dual
  • TEST_INTERNAL_LAYER_FILENAME - Path to .zip file of a layer which contains just internal Node.js extension. It's effective for internalOnly benchmark variant, and in other cases effective only with --extension-layers-mode=dual

File: node/packages/aws-lambda-otel-extension/test/fixtures/lambdas/package.json

{
"dependencies": {
"express": "^4.18.1",
"serverless-http": "^3.0.1"
}
}

File: node/packages/aws-lambda-otel-extension/test/fixtures/lambdas/esm-callback/package.json

{
"type": "module"
}

File: node/packages/aws-lambda-sdk/README.md

@serverless/aws-lambda-sdk

AWS Lambda [Serverless Console](https://www.serverless.com/console) SDK

Instruments AWS Lambda functions, propagates traces to the Serverless Console and exposes Serverless SDK to function logic

Setup

1. Register with [Serverless Console](https://console.serverless.com/)

2. In [Serverless Console](https://console.serverless.com/) turn on integration for your AWS account and chosen Lambdas

3. (optionally) Fine tune default instrumentation behavior with following options

`SLS_DISABLE_HTTP_MONITORING` (or `options.disableHttpMonitoring`)

Disable tracing of HTTP and HTTPS requests

`SLS_DISABLE_REQUEST_RESPONSE_MONITORING` (or `options.disableRequestResponseMonitoring`)

(Dev mode only) Disable monitoring requests and reponses (function, AWS SDK requests and HTTP(S) requests)

`SLS_DISABLE_AWS_SDK_MONITORING` (or `options.disableAwsSdkMonitoring`)

Disable automated AWS SDK monitoring

`SLS_DISABLE_EXPRESS_MONITORING` (or `options.disableExpressMonitoring`)

Disable automated express monitoring

`SLS_DISABLE_TRACE_SAMPLING` (or `options.disableTraceSampling`)

Disable automatic trace sampling

Instrumentation

AWS Lambda SDK automatically creates aws.lambda, aws.lambda.initialization and aws.lambda.invocation trace spans.
For more details see SDK Trace spans documentation

Additionally automatic instrumentation (with caveats) is provided for:

SDK API

File: node/packages/aws-lambda-sdk/CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

[0.15.15](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-09-27)

[0.15.14](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-09-20)

Features

  • Add support for env SLS_DISABLE_TRACE_SAMPLING (#876) (e6601f7)

[0.15.13](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-08-16)

Bug Fixes

  • Update base SDK version and add test fixture for async createSpan (77c1917)

[0.15.12](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-08-10)

Bug Fixes

  • Use createSpan instead of createTraceSpan (d455c52)

[0.15.11](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-08-03)

Features

  • Add createTraceSpan support (58f3667)

[0.15.10](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-08-02)

Features

  • Support setEndpoint in Lambda SDK (c7766ee)

[0.15.9](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-07-06)

Bug Fixes

  • Ensure NODE_PATH always contains required paths (47acfd2)
  • Ensure to expose uncaught exceptions (45e4893)
  • Instrument @smithy scoped smithy client (f6fe1d7)
  • Unregister @smithy/smithy-client instrumentation on uninstall (31e8b9b)

[0.15.8](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-06-23)

Bug Fixes

  • Fix handling of request truncation (ca7d46b)

[0.15.7](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-06-22)

Features

  • Do not sample infrequently invoked functions (da93c42)
  • Increase sampling rate to 20% (a3ca4a3)

[0.15.6](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-06-15)

Features

  • Truncate payload if exceeds 256KB (516f32d)

[0.15.5](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-06-07)

Adapt updates from v0.5.20 of @serverless/sdk

[0.15.4](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-05-30)

Bug Fixes

  • Fix handling of case where runtime waits for an empty event loop (947a769)

[0.15.3](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-05-25)

Bug Fixes

  • Fix handling of not responding handlers (7d06d67)

Maintenance Improvements

  • Access sub spans collection directly (251fce4)

[0.15.2](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-05-18)

Bug Fixes

  • Placeholder stream values when reporting request/response body (03b3161)

Maintenance Improvements

  • Improve organization of replacer logic (92bb89e)

[0.15.1](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-05-17)

Features

  • Support response streaming (2e7f8d0)
  • Do not write dev mode specific events in trace payload (a324263)

Maintenance Improvements

  • Improve filter logic organization (50166a0)

[0.15.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-05-11)

⚠ BREAKING CHANGES

  • Telemetry payloads prefixed with SERVERLESS_TELEMETRY.T. are replaced with gzipped payloads written with SERVERLESS_TELEMETRY.TZ. prefix

Performance Improvements

  • Improve size of written telemetry log by gzipping it (#738) (3d28670)

[0.14.23](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-05-10)

Maintenance Improvements

  • Black box AWS SDK spans via new dedicated method (1266baa)

[0.14.22](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-05-04)

Adapt updates from v0.5.16 of @serverless/sdk

[0.14.21](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-28)

Adapt updates from v0.5.15 of @serverless/sdk

[0.14.20](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-27)

Adapt updates from v0.5.14 of @serverless/sdk

[0.14.19](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-27)

Features

  • Improve sampling resolution (beb7208)

Bug Fixes

  • Ensure our --require option is first (e7d8a3e)

[0.14.18](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-26)

Maintenance Improvements

Adapt updates from v0.5.12 of @serverless/sdk

[0.14.17](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-21)

Bug Fixes

  • Ensure sdk.runtime tag on all payloads (5f44099)

Maintenance Improvements

  • Remove no longer supported option (9ecade7)

[0.14.16](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-20)

Maintenance Improvements

Adapt bug fixes from @serverless/sdk to v0.5.10

[0.14.15](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-20)

Maintenance Improvements

Adapt bug fixes from @serverless/sdk to v0.5.9

[0.14.14](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-14)

Bug Fixes

  • Span not closed warnings are now user warnings (#649) (d2b958c)

[0.14.13](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-14)

Features

  • Add Structured Logging error capture (#643) (59db882)

[0.14.12](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-12)

Bug Fixes

  • SDK will report warning for unclosed spans (#635) (77192f3)

[0.14.11](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-06)

Features

Bug Fixes

  • Ensure to clear root span in case of internal error (#611) (7c7856e)

Maintenance Improvements

  • Improve configurablity of sampling function (e26be68)
  • Seclude isApiEvent util (81d7e4a)

[0.14.10](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-04-03)

Bug Fixes

  • Ensure aws-lambda-sdk types match aws-sdk (#597) (1e1b739)

[0.14.9](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-03-29)

Features

[0.14.8](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-03-15)

Features

  • Enforce 20% sampling on successful invocations in prod environment (80a02b4)

[0.14.7](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-02-28)

Bug Fixes

  • Ensure to not capture logs issued by the AWS runtime (2df64ee)

[0.14.6](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-02-10)

Features

  • Strip binary lambda request (2b85fe8)
  • Strip large lambda request and response bodies (afd9ec9)
  • Strip too large AWS SDK request bodies (de064c1)

Maintenance Improvements

  • Do not strip non JSON bodies (431b48e)
  • Ensure to not proces request and response when not in dev mode (9d016aa)
  • Exclude runEsbuild util (7d985c4)
  • Report binary response body removal with notice event (52588a0)

[0.14.5](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-02-02)

Maintenance Improvements

Upgrade to @serverless/sdk to v0.5.0

  • Adapt to utility rename done on SDK side (2f16112)
  • Reconfigure warnings with ._reportWarning (22b8d4f)

[0.14.4](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-02-01)

Upgrade to @serverless/sdk to v0.4.4

[0.14.3](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-01-30)

Features

  • Prevent lambda crashes on internal SDK errors (6f350a9)

Bug Fixes

  • Do not send root span without required tag to dev mode (44b0e4e)
  • Fix AWS SDK v3 request error reporting (3dd663c)
  • Fix handling of uncommon AWS SDK error report (64afe99)
  • Fix invocation closure race condition (13649b2)

Maintenance Improvements

  • Rely on newly introduced reportSdkError util (e7d9cc0)
  • Clear dead referrences to global.serverlessSdk (048e72e)
  • Improve logic explanation (96c39a6)
  • Improve readability of inline comment (e6a40a2)

[0.14.2](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-01-26)

Maintenance Improvements

[0.14.1](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-01-23)

Bug Fixes

  • Ensure to clear custom tags collection between invocations (b8eadb6)

[0.14.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-01-19)

⚠ BREAKING CHANGES

  • Outcome error meta is no longer provided with outcome error tags on aws.lambda root span.
    Instead it's transported with captured event which shares same timestamp with aws.lambda root span end time
  • Global custom tags are exposed on TracePayload instead of the root span

Features

  • Propagate all captured events to dev mode (e19b41e)

Bug Fixes

  • Ensure to not instrument requests signing (ebf90ca)
  • Handle gently non JSON compliant AWS SDK input and output (321a8f5)

Maintenance Improvements

  • Expose custom tags directly on trace instead of root span (91786ae)
  • Remove responseStartTime in favor of endTime (33618d6)
  • Report outcome error data with event instead of root span tags (87766c9)

[0.13.1](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-01-13)

Features

  • Report traces at unhandled exceptions in invocation phase (eadeaee)
  • Upgrade to @serverless/sdk v0.3.1 (Introduce servelressSdk.setTag) (78c5532)

Maintenance Improvements

  • Support trace closure at initialization phase (48262d0)

[0.13.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-01-12)

⚠ BREAKING CHANGES

  • Upgrade to @serverless/sdk v0.3. serverlessSdk.captureTraceSpan is no longer available

Features

  • Upgrade to @serverless/sdk v0.3 (e415fbc)
  • Report internal warnings with structured logs (63d046a)
  • Ensure DynamoDB tags on AWS SDK spans that cover DynamoDbDocument service (#354) (1b49f9e)

[0.12.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2023-01-05)

⚠ BREAKING CHANGES

  • global.serverlessSdk was removed. @serverless/aws-lambda-sdk and @serverless/sdk are now exposed in node path and can be required or imported naturally

Features

  • Expose @serverless/sdk in path instead of realying on a global (8f4ff07)
  • Report captured events with a trace payload (5437bd7)
  • Send captured events to dev mode (dfb7991)

Bug Fixes

  • Ensure to reset root span also in case of errors (1d8277c)
  • Initialize original handler at AWS intended processing point (60db9bf)

Maintenance Improvements

  • Centralize SDK resolution (2f8b39c)
  • Depend on @serverless/sdk (57e3621)
  • Do not send Node's console originated events to dev extension (d3a2e41)

[0.11.6](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-12-19)

Bug Fixes

  • Do not attempt to set AWS SDK request id when there's no request (85f02ad)
  • Do not crash in case of AWS SDK v2 double resolution setup (95449b8)

[0.11.5](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-12-13)

Bug Fixes

  • Fix handling of deferred spans, started before handler invocation (0970940)
  • To respect open handles wait for response to end (cc3a531)
  • Reduce number of concurrently open requests to avoid EMFILE (55d314d)
  • Clear input and output for trace payload reliably (03140cb)

Maintenance Improvements

  • Upgrade @serverless/sdk-schema to v0.14 (365ba4e)
  • Limit maximum number of concurrent requests to avoid EMFILE (d16b28c)
  • Remove dead code (73c9fa5)

[0.11.4](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-11-24)

Bug Fixes

  • Ensure to not crash in main SDK processing points (5499231)

[0.11.3](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-11-08)

Maintenance Improvements

  • Improve SDK error messaging (f35ff84)

[0.11.2](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-11-03)

Bug Fixes

  • Ensure warning ends with new line (18e902f)

Maintenance Improvements

  • Improve build script error reporting (c26c936)
  • Reshape HTTP request args handling (13a3a53)

[0.11.1](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-10-31)

Bug Fixes

  • Fix handling of no response lambdas (279c5c7)

[0.11.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-10-31)

⚠ BREAKING CHANGES

  • Upgrade @serverless/sdk-schema from v0.12 to v0.13

Features

  • Report all kind of responses (2731384)
  • Support Node.js v12 (5737b5c)

Bug Fixes

  • Fix capture of HTTP response body when it's a string (466fc22)

Maintenance Improvements

  • Cleanup support for startTime and endTime in response (e5ef5e8)
  • Upgrade to @serverless/sdk-schema v0.13 (6ad4b72)

[0.10.2](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-10-24)

Features

Bug Fixes

  • Matched invocation start/end time (1080d28)

[0.10.1](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-10-21)

[0.10.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-10-20)

⚠ BREAKING CHANGES

  • SDK Schema is upgraded to v0.11 - http.request_body, http.response_body, aws.sdk.request_body and aws.sdk.response_body tags are removed in favor of top level input and output properties.

Features

  • Adapt span.input and span.output (bb5e222)

[0.9.1](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-10-17)

Features

  • Do not trace DynamoDb request expressionValues (bbc118d)

[0.9.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-10-11)

⚠ BREAKING CHANGES

  • Dev mode communication port was changed from 2772 to 2773. For compatibiility upgrade to v0.3+ version of the dev-mode layer

Maintenance Improvements

  • Switch dev mode communication port (6df2fc9)

[0.8.1](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-10-10)

Bug Fixes

  • Ensure opt-out for request and response monitoring (0555565)

[0.8.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-10-07)

⚠ BREAKING CHANGES

  • Request and response bodies are not longer reported in CloudWatch logs

Features

  • Support "dev" mode (8e74674)
  • Report AWS SDK request and response body in dev mode (8e87989)
  • Expose HTTP request and response bodies in tags in dev mode (eefcb33)
  • In dev mode send spans as they are closed to external extension (72b59b8)
  • Do not write request and response payloads (6d604c9)

Maintenance Improvements

  • Improve variables naming (99973ff)
  • Support internal _slsIngore option to ignore HTTP requests (85cb986)

[0.7.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-09-30)

⚠ BREAKING CHANGES

  • Upgrade @serverless/sdk-schema to v0.10 (Switch from express tags to aws.lambda.http_router)
  • Rename instrument/*utilities into instrumenation/*
  • Rename serveressSdk.instrument into serverlessSdk.instrumentation

Features

  • Support for Function URL events (d9f619c)
  • Switch from express tags to aws.lambda.http_router (64f7543)

Bug Fixes

  • Fix span connections for consequently initialized async operations (cd2798e)
  • Fix open parent span resolution (84f63e9)

Maintenance Improvements

  • Add temporary debug logs (8588da0)
  • Expose debugLog util on serverlessSdk (bb25145)
  • Improve middleware span resolution (641a690)
  • Rename instrument namespace into instrumentation (88054dc)
  • Separate instrument utility context (e159740)

[0.6.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-09-26)

⚠ BREAKING CHANGES

  • Upgrade @serverless/sdk-schema to v0.9.0
  • HTTP related have changed according to changes brought with new version of @serverless/sdk-schema
  • Sub spans must be closed manually (they're no longer auto closed with closure of a parent)
  • All opened spans are auto closed with a warning on root span closure (when trace is wrapped up)
  • onCloseByParent option is replaced by onCloseByRoot, as it's only root that may auto close sub spans now
  • traceSpan.createSubSpan method was removed in favor of serverlessSdk.createTraceSpan. Since now relations between spans are resolved automaticaly internally (no need to manually decide which span is parent span)

Features

  • Allow opened children in closed spans (d2f87d7)
  • Resolve relation between spans automatically (a7e2b5e)
  • Store http.request_header_names tag (223371c)
  • Support new AWS SDK DynamoDB tags (1963d4b)
  • Upgrade HTTP related tags to contain only param names information (0fed793)

Bug Fixes

  • Fix propagation of response data (135c524)

Performance Improvements

  • Ensure to not add unused dependencies to build (ce2f6e4)

Maintenance Improvements

  • Improve test error code (a396de3)

[0.5.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-09-20)

⚠ BREAKING CHANGES

  • Upgrade @serverless/sdk-schema to v0.8

Features

  • Instrument express applications (be10ac2)
  • Trace AWS SDK requests going to any services (c6dbe17)

Maintenance Improvements

  • Uprade @serverless/sdk-schema to v0.8 (72bfa6d)

[0.4.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-09-16)

⚠ BREAKING CHANGES

  • Upgrade @serverless/sdk-schema to v0.7

Features

  • Instrument AWS SDK requests (8fe8676)
  • Support ignoring specified HTTP requests from tracing (63a0450)

Bug Fixes

  • Ensure safe requires order (f853179)

Maintenance Improvements

  • Do not crash if tag is re-set with same value (d9c5647)
  • Make serverlessSdk._initialize private (887bbc4)
  • Upgrade @serverless/sdk-schema to v0.7 (2f481f8)

[0.3.2](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-09-14)

Features

  • Write request and response payloads (b04f030)
  • An option to disable HTTP instrumentation (c5da3fd)

Maintenance Improvements

  • Cleanup logic (06869fc)
  • Do not write debug JSON payload (f94c874)
  • Generalize handling of instrumentation configuration (84887b3)

[0.3.1](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-09-12)

Features

  • Auto tracing of internal HTTP and HTTPS requests (ab8a428)
  • TraceSpan option onCloseByParent (f34b5d8)

Bug Fixes

  • Fix wrapping of nested ESM handlers (03e7c18)

Maintenance Improvements

  • Rely on tags.setMany to set initial tags set (dd8522a)

[0.3.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-09-08)

⚠ BREAKING CHANGES

  • @serverless/sdk-schema was upgraded to v0.5.0, which changed structure of API Gateway event related tags

Features

  • Setupaws.lambda.event_type and aws.lambda.event_source tags (c21622d)
  • Setup aws.lambda.http.status_code tag (f60ec61)
  • Write generic aws.lambda.http tags in case of API Gateway events (3231a6c)

[0.2.1](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-09-06)

Features

  • Instrument API Gateway v2 HTTP API (v1 payload) events (82fefe2)
  • Instrument API Gateway v2 HTTP API (v2 payload) events (f09907e)
  • Instrument SNS events (a228bb7)
  • Instrument SQS events (cea70d6)
  • Support arrays as tag values (def9dfc)

[0.2.0](https://github.com/serverless/console/compare/@serverless/[email protected]...@serverless/[email protected]) (2022-09-01)

⚠ BREAKING CHANGES

  • Telemetry payload prefix is changed from ⚡ to SERVERLESS_TELEMETRY

Features

  • Instrument API Gateway REST API events (233880f)
  • Introduce traceSpan.tags.setMany method (ab730db)

Maintenance Improvements

  • Change telemetry log prefix to SERVERLESS_TELEMETRY (52fd7df)
  • Improve tags reset handling (6bda7f9)
  • Remove ineffective code (87307e8)

0.1.0 (2022-08-29)

Features

Initial implementation

File: node/packages/aws-lambda-sdk/package.json

{
"name": "@serverless/aws-lambda-sdk",
"repository": "serverless/console",
"version": "0.15.15",
"author": "Serverless, Inc.",
"dependencies": {
"@serverless/sdk": "^0.5.26",
"@serverless/sdk-schema": "^0.15.6",
"d": "^1.0.1",
"ext": "^1.7.0",
"long": "^5.2.3",
"type": "^2.7.2"
},
"typesVersions": {
"": {
"": [
".ts-types/"
]
}
},
"standard-version": {
"tagPrefix": "@serverless/aws-lambda-sdk@",
"path": ".",
"skip": {
"commit": true,
"tag": true
},
"types": [
{
"type": "feat",
"section": "Features"
},
{
"type": "fix",
"section": "Bug Fixes"
},
{
"type": "perf",
"section": "Performance Improvements"
},
{
"type": "refactor",
"section": "Maintenance Improvements"
}
]
},
"scripts": {
"build": "./scripts/build.js dist/extension.internal.zip",
"prepare-release": "standard-version && prettier --write CHANGELOG.md",
"test": "mocha "test/unit/**/.test.js"",
"test:isolated": "mocha-isolated "test/unit//*.test.js"",
"test:integration": "mocha "test/integration//*.test.js"",
"test:performance": "mocha test/benchmark/performance.test.js"
},
"publishConfig": {
"access": "public"
},
"license": "MIT"
}

File: node/packages/aws-lambda-sdk/docs/sdk-trace.md

AWS Lambda SDK Trace

For each function invocation single AWS Lambda SDK Trace is generated.

Before returning the result to AWS Lambda trace payload is written to the console with following log line:

text
SERVERLESS_TELEMETRY.T.<base64 encoded payload>

Trace tags

Tags exposed on top trace

Name Value
orgId Serverless Console organization id
service AWS Lambda function name
sdk.name Name of this package
sdk.version Version of this package

Trace spans

SDK automatically creates following spans, all spans expose TraceSpan interface

`aws.lambda`

Root span for each function invocation. In case of first invocation it contains two sub spans aws.lambda.initializaton and aws.lambda.invocation. For following invocations there's just aws.lambda.invocation sub span

Parent: None

Tags

Always present

Name Value
aws.lambda.arch Type of computer processor that Lambda uses to run the function. Check AWS Lambda Architectures
aws.lambda.is_coldstart Whether it's a cold start invocation
aws.lambda.name AWS Lambda function name
aws.lambda.request_id The identifier of the invocation request
aws.lambda.version The version of the function
aws.lambda.outcome The outcome of a function. Possible values are 'success' and 'error:handled'

Error case

Tags set in case of 'error:handled' outcome

Name Value
aws.lambda.error_exception_message Error message
aws.lambda.error_exception_stacktrace Error stack trace

HTTP Endpoint

Tags collected if event is sourced by either:

  • AWS API Gateway v1 REST API endpoint configured with AWS_PROXY integration type.
  • AWS API Gateway v2 HTTP API endpoint configured with either v1 or v2 version of a payload
  • AWS Function URL
Name Value
aws.lambda.http.method Request method
aws.lambda.http.protocol Endpoint protocol (e.g. HTTP/1.1)
aws.lambda.http.host Endpoint Domain name
aws.lambda.http.path Request path
aws.lambda.http.query_parameter_names Query parameter names
aws.lambda.http.request_header_names Request header names
aws.lambda.http.status_code Response status code
aws.lambda.http.error_code Filled, if no or invalid status code is provided by the handler

AWS API Gateway

Tags collected if event is sourced by either:

  • AWS API Gateway v1 REST API endpoint configured with AWS_PROXY integration type.
  • AWS API Gateway v2 HTTP API endpoint configured with either v1 or v2 version of a payload
Name Value
aws.lambda.event_source "aws.apigateway"
aws.lambda.event_type "aws.apigateway.rest", "aws.apigatewayv2.http.v1" or "aws.apigatewayv2.http.v2"
aws.lambda.api_gateway.account_id Account id of API Gateway
aws.lambda.api_gateway.api_id API id
aws.lambda.api_gateway.api_stage API stage
aws.lambda.api_gateway.request.id API Gateway request id
aws.lambda.api_gateway.request.time_epoch API Gateway request time
aws.lambda.api_gateway.request.path_parameter_names Path parameter names
aws.lambda.http_router.path Route path with unresolved param (potentally overriden by router framework as express if used)

Function URL

Tags collected if event is sourced by Function URL

Name Value
aws.lambda.event_source "aws.lambda"
aws.lambda.event_type "aws.lambda.url"

SQS queue message

Tags collected if event is sourced by SQS queue

Name Value
aws.lambda.event_source "aws.sqs"
aws.lambda.event_type "aws.sqs"
aws.lambda.sqs.queue_name Queue name
aws.lambda.sqs.message_ids Array of message ids

SNS topic message

Tags collected if event is sourced by SNS topic subscription

Name Value
aws.lambda.event_source "aws.sns"
aws.lambda.event_type "aws.sns"
aws.lambda.sns.topic_name Topic name
aws.lambda.sns.message_ids Array of message ids

`aws.lambda.initialization`

Covers function initialization phase.

Can be always accessed at serverlessSdk.traceSpans.awsLambdaInitialization

Parent: aws.lambda

Tags

None

`aws.lambda.invocation`

Covers function invocation phase.

Current invocation span can always be accessed at serverlessSdk.traceSpans.awsLambdaInvocation

Parent: aws.lambda

Tags

None

File: node/packages/aws-lambda-sdk/docs/sdk.md

Serverless SDK

Properties and methods of the `serverlessSdk`

Common properties for SDK are documented at SDK API

This document describes properties specific to AWS Lambda SDK

`.traceSpans`

For detailed info on spans check sdk-trace.md

  • root (also aliased as awsLambda) - Root AWS lambda span
  • awsLambdaInitialization - Initialization span
  • awsLambdaInvocation - Invocation span (not available at initialization phase)

`serverlessSdk.instrumentation`

Most of the instrumentation is setup automatically, still there are scenarios when it's difficult to ensure that (e.g. when target modules are imported as ESM, or come from bundles). In such case instrumentation need to be set manually, and then following utilities should be used:

File: node/packages/aws-lambda-sdk/docs/instrumentation/aws-sdk.md

AWS SDK instrumentation

Disable with SLS_DISABLE_AWS_SDK_MONITORING environment variable

All AWS SDK requests are traced.

Tracing is turned on automatically for AWS SDK clients that are normally loaded via Node.js require.

However if AWS SDK is bundled then instrumentation needs to be turned on manually with following steps:

javascript
import AWS from 'aws-sdk';

// Instrument AWS SDK v2:
serverlessSdk.instrumentation.awsSdkV2.install(AWS);

import { Lambda } from '@aws/client-lambda';
const lambda = new Lambda({ region: process.env.AWS_REGION });

// Instrument AWS SDK v3 Client
serverlessSdk.instrumentation.awsSdkV3Client.install(lambda);

Covered AWS SDK requests are reflected in aws.sdk.<service-name> spans

Base span tags

Tags that apply to all AWS SDK requests:

Name Value
aws.sdk.region Region to which request is made
aws.sdk.signature_version Signature version of request authentication (for latest versions of SDK it'll be "v4")
aws.sdk.service Service to which request is made
aws.sdk.operation Operation name (e.g. listtopics)
aws.sdk.request_id AWS reqeust id
aws.sdk.error If request ends with error, the error message

`aws.sdk.sns` span tags

Tags that apply to requests that go to SNS service

Name Value
aws.sdk.sns.topic_name Topic name
aws.sdk.sns.message_ids Ids of affected messages

`aws.sdk.sqs` span tags

Tags that apply to requests that go to SQS service

Name Value
aws.sdk.sqs.queue_name Queue name
aws.sdk.sqs.message_ids Ids of affected messages

`aws.sdk.dynamodb` span tags

Tags that apply to requests that go to DynamoDb service

Name Value
aws.sdk.dynamodb.table_name Affected table name
aws.sdk.dynamodb.consistent_read The value of the ConsistentRead request parameter
aws.sdk.dynamodb.limit The value of the Limit request parameter
aws.sdk.dynamodb.attributes_to_get The value of the AttributesToGet request parameter
aws.sdk.dynamodb.projection The value of the ProjectionExpression request parameter
aws.sdk.dynamodb.index_name The value of the IndexName request parameter
aws.sdk.dynamodb.scan_forward The value of the ScanIndexForward request parameter
aws.sdk.dynamodb.select The value of the Select request parameter
aws.sdk.dynamodb.filter The value of the FilterExpression request parameter
aws.sdk.dynamodb.key_condition The value of the KeyConditionExpression request parameter
aws.sdk.dynamodb.segment The value of the Segment request parameter
aws.sdk.dynamodb.total_segments The value of the TotalSegments request parameter
aws.sdk.dynamodb.count The value of the Count response parameter
aws.sdk.dynamodb.scanned_count The value of the ScannedCount response parameter

Request and response data

In developer mode, additionally request and response bodies are monitored. That can be disabled with SLS_DISABLE_REQUEST_RESPONSE_MONITORING environment variable

File: node/packages/aws-lambda-sdk/instrument/README.md

No local modules aside of main serverlessSdk object should be required in context of this directory

When relying on serverlessSdk, require it from lib/sdk

File: node/packages/aws-lambda-sdk/test/README.md

Tests

Unit tests

Unit tests are configured to be independent of any external infrastructure (AWS Lambda environment is emulated), and can be run offline

bash
npm test

Integration tests

AWS account is needed to run integration tests, and AWS credentials need to be configured.

In tests, the home folder is mocked, therefore AWS access cannot be reliably set up via the AWS_PROFILE variable or any other means that rely on configuration placed in the home folder.

Easiest is to run tests is by setting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_REGION environment variables.

Tests create a temporary layer and Lambda resources and remove them after the test is finalized.

All created resourced are named or prefixed with test-sdk-<testUid> string, where testUid is four characters taken from local machine id or in case of CI runs a random string. testUid string can also be overridden via environment variable TEST_UID

bash
npm run test:integration

Environment variables

How extensions behave, for various testing purposes, can be tweaked with following environment variables:

Variables handled in extension logic

  • SERVERLESS_PLATFORM_STAGE - Ingestion server stage to which reports should be propagated (default is prod, with this setting it can be overridden to dev)
  • SLS_SDK_DEBUG - Log debug messages, of which scope is to:
    • Mark certain processing points

Variables handled by test suite

  • TEST_INTERNAL_LAYER_FILENAME - Path to .zip file of a layer which contains just internal Node.js extension. Triggers mode in which two layers are attached to the lambda (one with external and other with internal extension)

File: node/packages/aws-lambda-sdk/test/benchmark/README.md

Benchmarks

Tested use cases

Node.js function ([`callback`](../../fixtures/lambdas/callback.js))

No-op Node.js function. Handler takes callback and immediately invokes it with dummy payload

Node.js 250ms function ([`250ms`](../../fixtures/lambdas/250ms.js))

No-op Node.js function. Handler takes callback waits 250ms and invokes it with dummy payload.
In this case produced extension invocation overheads are slightly smaller as some of the extension work is done during lambda operation

Node.js requiring function ([`requires`](../../fixtures/lambdas/requires.js))

Node.js function that requires a lot of modules

Benchmark variants

`bare`

No instrumentation (bare run with no extension layers onboard).

As there are no extensions loaded, there's no extension duration overhead introduced, and benchmark will naturally report them with zeros.

What we get is metrics from AWS report, that confirm on initialization duration, invocation duration, billed invocation duration and max memory used.

`internal`

Internal extension which calculates and logs generated traces payload to the console

Reported metrics

Each benchmark variant is run against 5 lambda instances.

Therefore for each metric outlined below, we get 5 numbers. Durations returned in result report are averages of those 5 values.

Internally measured durations are written by the extensions to the stdout, and are read (together with invocation reports as written by AWS) from CloudWatch logs.

Observed AWS Lambda execution lifecycle phases

Initialization (`init`)

Lambda instance initialization

Observed metrics

`init:internal`

Duration of the internal extension initialization logic, measured internally in internal extension. It's a time measured from start of the internal extension logic, until it returns for further evaluation by AWS runtime engine.

`init:total`

Total initialization time as reported by AWS (with initDuration metric provided in report of the first invocation)

Invocation

Benchmarks observe first invocation (first) (one that in regular circumstances immediately follows initialization), and the the second (following).

Two first invocations are observed separately, as data shows that durations of first invocation are always worse than of the second, and that for the following (third, fourth etc.) invocations numbers are similar as for the second.
This difference could be attributed to how Node.js internal optimization works, where paths which were already taken usually run faster (it's to be confirmed whether we see similar differences with other runtimes).

Observed metrics

`[first|following]:internal:request`

Invocation request handing duration in context of the Node.js internal extension. It's a time that's measured from the moment when our handler wrapper received an invocation event from AWS until we invoke the original Lambda handler.

`[first|following]:internal:response`

Invocation response handling duration in the context of the Node.js internal extension. It's a time that's measured from the moment when original handler provided response until we pass it back to AWS.

`[first|following]:total`

Total duration time as reported by AWS (with duration metric provided in invocation report)

`[first|following]:billed`

Billed duration time as reported by AWS (with billedDuration metric provided in invocation report)

`[first|following]:local

Locally measured SDK invocation time. This value is largely influenced by the location from which we run benchmarks and quality of the internet connection.

For benchmarks run against us-east-1 region, shortest values we'll get e.g. in New York, but running benchmarks in San Francisco will already add extra latency, and numbers get additionally worse, when running benchmarks from farther locations

`[first|following]:maxMemoryUsed

Max memory used as reported by AWS (with maxMemoryUsed metric provided in invocation report). It's to expose what memory overhead is introduced by the extensions

Setup & Run

1. Ensure AWS credentials

In same manner as for AWS CLI

2. Configure environment variables

  • AWS_REGION - region against which benchmarks should be run
  • SLS_ORG_ID- Console organization id (can by dummy, as it'll be part of generated trace which otherwise is not send to console servers)
  • TEST_UID - (optional) common name token to be used as part of generated resource names. All generated resource names will be prefixed with test-oext-<test-uid>. If not provided, one is generated on basis of local machine id. Note: Script ensures that all generated resources are removed after benchmark is done
  • LOG_LEVEL - (optional) For more verbose output LOG_LEVEL=info can be used

4. Run

Benchmark for all configured use cases and benchmark variants can be run as:

bash
./test/scripts/benchmark.js

Generated benchmark results are output to the console in CSV format. To store them to the file output can be piped as:

bash
./test/scripts/benchmark.js > benchmark.csv

4.1 Run customization

Benchmark run can additionally be customized with following CLI params

  • --use-cases Comma separated list of function use cases to test (e.g. callback,require)
  • --benchmark-variants Comma separated list of benchmark variants to test (e.g. internal)
  • --memory-size Memory size to provide to lambdas (by default it's 128MB).

File: node/packages/aws-lambda-sdk/test/fixtures/lambdas/package.json

{
"dependencies": {
"@aws-lambda-powertools/logger": "^1.10.0",
"@aws-sdk/client-dynamodb": "^3.358.0",
"@aws-sdk/client-lambda": "^3.358.0",
"@aws-sdk/client-s3": "^3.358.0",
"@aws-sdk/client-sns": "^3.358.0",
"@aws-sdk/client-sqs": "^3.358.0",
"@aws-sdk/client-ssm": "^3.358.0",
"@aws-sdk/client-sts": "^3.358.0",
"@aws-sdk/lib-dynamodb": "^3.358.0",
"@aws-sdk/s3-request-presigner": "^3.358.0",
"aws-sdk": "2.1313.0",
"bunyan": "^1.8.15",
"express": "^4.18.2",
"ext": "^1.7.0",
"pino": "^8.14.1",
"serverless-http": "^3.2.0",
"winston": "^3.9.0"
}
}

File: node/packages/aws-lambda-sdk/test/fixtures/lambdas/error-async-initialization/package.json

{
"type": "module"
}

File: node/packages/aws-lambda-sdk/test/fixtures/lambdas/esm-aws-sdk-v2/package.json

{
"type": "module"
}

File: node/packages/aws-lambda-sdk/test/fixtures/lambdas/esm-aws-sdk-v3/package.json

{
"type": "module"
}

File: node/packages/aws-lambda-sdk/test/fixtures/lambdas/esm-callback/package.json

{
"type": "module"
}

File: node/packages/aws-lambda-sdk/test/fixtures/lambdas/esm-express/package.json

{
"type": "module"
}

File: node/packages/aws-lambda-sdk/test/fixtures/lambdas/esm-http/package.json

{
"type": "module"
}

File: node/packages/aws-lambda-sdk/test/fixtures/lambdas/esm-nested/package.json

{
"type": "module"
}

File: node/packages/aws-lambda-sdk/test/fixtures/lambdas/esm-sdk/package.json

{
"type": "module"
}

File: node/packages/aws-lambda-sdk/test/fixtures/lambdas/esm-thenable/package.json

{
"type": "module"
}

File: node/packages/sdk/README.md

@serverless/sdk

[Serverless Console](https://www.serverless.com/console) SDK

Use case

Environment agnostic Serverless Console instrumentation functions for Node.js applications.

This library is safe to use without side-effects in any Node.js applications. It becomes effective once (one of the listed below) environment specific SDK is loaded on top.

Environment extensions

Installation

shell
npm install @serverless/sdk

Usage

CJS:

javascript
const serverlessSdk = require('@serverless/sdk');

// ...
serverlessSdk.captureError(new Error('Unexpected'));

ESM:

javascript
import serverlessSdk from '@serverless/sdk';

// ...
serverlessSdk.captureError(new Error('Unexpected'));

Setup

1. Register with [Serverless Console](https://console.serverless.com/)

2. Initialize and setup SDK specific to your enviroment

See Environment extensions

2.1 Configuration options

Common options supported by all environments:

`SLS_ORG_ID` (or `options.orgId`)

Required setting. Id of your organization in Serverless Console.

`SLS_DISABLE_HTTP_MONITORING` (or `options.disableHttpMonitoring`)

Disable tracing of HTTP and HTTPS requests. See HTTP instrumentation

`SLS_DISABLE_REQUEST_RESPONSE_MONITORING` (or `options.disableRequestResponseMonitoring`)

(Dev mode only) Disable monitoring requests and reponses (function, AWS SDK requests and HTTP(S) requests)

`SLS_DISABLE_EXPRESS_MONITORING` (or `options.disableExpressMonitoring`)

Disable automated express monitoring. See express app instrumentation

`SLS_DISABLE_CAPTURED_EVENTS_STDOUT` (or `options.disableCapturedEventsStdout`)

Disable writing captured events registered via .captureError and .captureWarning to stdout

Instrumentation

This package comes with instrumentation for following areas.

Note: instrumentation is enabled via environment specific SDK instance, relying just on @serverless/sdk doesn't enable any instrumentation)

API

Explore Related Technologies & Topics

View All 9,111+ Repositories →

Discover similar high-velocity repositories, agent skills, and OpenAPI specifications across the ecosystem.

⚡ MCP Servers Model Context Protocol → 🧠 Agent Skills Prompt & rule files → 🔌 OpenAPI Specs REST & Swagger schemas →