AWS DevOps Demo: Lambda + API Gateway + Terraform

Minimal, production-ready example for interview discussion:

• AWS Lambda (Python)
• API Gateway HTTP API (v2)
• IAM role with least-privilege
• Terraform IaC provisioning
• Packaging/deploy instructions
• Curl test

Overview

Architecture: HTTP API → Lambda (Python 3.12) → CloudWatch Logs.

• Lambda emits structured JSON logs with service, level, message, plus request context.
• API Gateway $default stage writes access logs to CloudWatch.
• IAM role grants only basic CloudWatch Logs permissions via the managed AWSLambdaBasicExecutionRole policy.

Files

• lambda_function.py – Handler with structured logging, JSON response.
• main.tf – Terraform for IAM role, Lambda, HTTP API, integration, route, stage, and Lambda permission.

Prerequisites

• Terraform ≥ 1.5
• AWS account credentials configured (e.g., aws configure). The identity must have permissions to create IAM roles/policies, Lambda, API Gateway, and CloudWatch log groups.
• PowerShell on Windows (for the provided commands)

Quickstart (Windows PowerShell)

From the repository folder aws_devops_demo:

$ErrorActionPreference = "Stop"

# 1) Package the Lambda
New-Item -ItemType Directory -Force .\build | Out-Null
Compress-Archive -Path .\lambda_function.py -DestinationPath .\build\lambda.zip -Force

# 2) Deploy with Terraform (change region if desired)
terraform init
terraform apply -auto-approve -var "region=us-east-1"

# 3) Test the endpoint
$endpoint = terraform output -raw api_endpoint
curl.exe -sS "$endpoint/hello"

Expected JSON response:

{
  "service": "aws-devops-demo",
  "message": "Hello from Lambda",
  "requestId": "..."
}

Optional: include a correlation ID header to see it in logs

curl.exe -sS -H "x-correlation-id: demo-123" "$endpoint/hello"

Observability

• Lambda structured logs: CloudWatch Logs (default group /aws/lambda/aws-devops-demo-hello).
• API Gateway access logs: CloudWatch Logs in /aws/apigw/aws-devops-demo-http-api.

Security & Least Privilege

• Lambda execution role uses only AWSLambdaBasicExecutionRole for logs.
• aws_lambda_permission restricts API Gateway invocation to the GET /hello route for this API.
• Resource names prefixed by aws-devops-demo for clear scoping.

Customize

• Change the project prefix:
  • Update var.project default in main.tf, or pass -var "project=your-prefix" during terraform apply.
• Change region: pass -var "region=your-aws-region".
• Adjust memory/timeout/env in aws_lambda_function if needed.

Cleanup

Destroy all resources to avoid charges:

terraform destroy -auto-approve -var "region=us-east-1"

Notes for Interviews

• Uses HTTP API (API Gateway v2) with AWS_PROXY and payload format 2.0.
• $default stage simplifies base URL (no stage path).
• Hash-based code updates via source_code_hash ensure Terraform deploys new zip builds.