LambdaからALB経由でAPIを呼び出し、HTTPステータスを監視してみた

sudo vi /var/www/html/http-trigger-test

Hello from EC2 API!

sudo ls /var/www/html/http-trigger-test

sudo openssl genrsa -out server.key 2048

vi openssl.cnf

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
C = JP
L = Default City
O = Default Company Ltd
CN = <ALB_DNS_NAME>

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = <ALB_DNS_NAME>

sudo openssl req -x509 -new -key server.key -out server.crt -days 365 -config openssl.cnf

openssl x509 -in server.crt -text -noout | grep -A 1 "Subject Alternative Name"

openssl x509 -in server.crt -serial -noout

openssl s_client -connect <ALB_DNS_NAME> -servername alb-api-test-621678629.ap-northeast-1.elb.amazonaws.com 2>/dev/null | openssl x509 -serial -noout

import urllib.request
import urllib.error
import ssl
import os
import logging


logger = logging.getLogger()
logger.setLevel(logging.INFO)


def lambda_handler(event, context):
    url = "https://<ALB_DNS_NAME>/http-trigger-test"

    cert_path = os.path.join(
        os.path.dirname(__file__),
        "server.crt"
    )

    ssl_context = ssl.create_default_context(
        cafile=cert_path
    )

    try:
        with urllib.request.urlopen(
            url,
            context=ssl_context
        ) as response:
            status_code = response.status
            body = response.read().decode("utf-8")

    except urllib.error.HTTPError as error:
        status_code = error.code
        body = error.read().decode("utf-8")

    print(f"Request URL: {url}")
    print(f"Response Status Code: {status_code}")

    if status_code >= 300:
        logger.error(
            f"API request failed. "
            f"URL={url}, "
            f"StatusCode={status_code}, "
            f"ResponseBody={body}"
        )

        raise RuntimeError(
            f"API request failed. "
            f"URL={url}, "
            f"StatusCode={status_code}, "
            f"ResponseBody={body}"
        )

    return {
        "statusCode": status_code,
        "body": body
    }

AWSTemplateFormatVersion: '2010-09-09'

Description: >
  CloudFormation template for EventBridge Scheduler and Lambda

Parameters:
  LambdaCodeBucket:
    Type: String
    Description: Lambda deployment package S3 bucket name

  LambdaCodeKey:
    Type: String
    Description: Lambda deployment package S3 key

  ScheduleExpression:
    Type: String
    Default: cron(0 0 * * ? *)
    Description: EventBridge Scheduler schedule expression

Resources:

  ##################################################
  # Shared CloudWatch Logs Log Group
  ##################################################
  SharedLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: "/aws/lambda/request-api-logs"
      RetentionInDays: 120

  ##################################################
  # Lambda Execution Role
  ##################################################
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-lambda-execution-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole

      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

  ##################################################
  # Lambda
  ##################################################
  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub ${AWS::StackName}-lambda
      Runtime: python3.12
      Handler: lambda_function.lambda_handler
      Role: !GetAtt LambdaExecutionRole.Arn

      Code:
        S3Bucket: !Ref LambdaCodeBucket
        S3Key: !Ref LambdaCodeKey

      Timeout: 60
      MemorySize: 128

      LoggingConfig:
        LogGroup: !Ref SharedLogGroup

  ##################################################
  # EventBridge Scheduler Execution Role
  ##################################################
  SchedulerExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-scheduler-execution-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - scheduler.amazonaws.com
            Action:
              - sts:AssumeRole

      Policies:
        - PolicyName: InvokeLambda
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource:
                  - !GetAtt LambdaFunction.Arn

  ##################################################
  # EventBridge Scheduler
  ##################################################
  EventBridgeScheduler:
    Type: AWS::Scheduler::Schedule
    Properties:
      Name: !Sub ${AWS::StackName}-scheduler

      FlexibleTimeWindow:
        Mode: 'OFF'

      ScheduleExpression: !Ref ScheduleExpression

      ScheduleExpressionTimezone: Asia/Tokyo

      State: ENABLED

      Target:
        Arn: !GetAtt LambdaFunction.Arn
        RoleArn: !GetAtt SchedulerExecutionRole.Arn

Outputs:

  LambdaFunctionArn:
    Description: Lambda function ARN
    Value: !GetAtt LambdaFunction.Arn

  SchedulerArn:
    Description: EventBridge Scheduler ARN
    Value: !GetAtt EventBridgeScheduler.Arn

  SchedulerExecutionRoleArn:
    Description: EventBridge Scheduler execution role ARN
    Value: !GetAtt SchedulerExecutionRole.Arn

  SharedLogGroupName:
    Description: Shared CloudWatch Logs log group name
    Value: !Ref SharedLogGroup