🎉 We are launching a new weekly show: Hot off the Cloud

🎉 We are launching a new weekly show

Unboxing S3 Object Lambda

Michael Wittig – 05 May 2021

Amazon S3 Object Lambda offers a way to execute a Lambda function when someone wants to download a file (GetObject) from an S3 bucket. You can implement whatever logic you wish and return any data as the response via the WriteGetObjectResponse API. Keep in mind that the Lambda function must finish within 60 seconds and is called synchronously.

Unboxing S3 Object Lambda

Our unboxing series gives a first insight into new services or features. An unboxing is not as detailed as a service review.

How S3 Object Lambda works

The following figure shows the needed components:

S3 Object Lambda


Looking for a new challenge?

  • tecRacer

    Cloud Consultant • AWS Migrations

    tecRacer • Premier AWS Consulting Partner • Germany, Austria, Portugal, and Switzerland
    Assessment Transformation Change Management
  • DEMICON

    Senior Lead Full Stack Developer

    DEMICON • AWS Advanced Consulting Partner • Remote
    AWS JavaScript/TypeScript Angular React

Let’s look at the parts more closely:

  • S3 Object Lamda Access Point: References your Lambda function and your S3 Access Point. Block Public Access is always enabled.
  • Lambda function: Invoked when a GetObject request is made to the S3 Object Lambda Access Point.
  • S3 Access Point: Takes care of the non GetObject requests (such as ListObjects) and serves the pre-signed URL of the original file passed into the Lambda function.
  • S3 Bucket: Stores the original file (in fact, the original file could be non-existent).

In the following video, I go into more details and share code with you:

  • Introducing S3 Object Lambda
  • Use Cases
  • Demo: Generating content
  • Understanding Pricing
  • Pitfall: Keep the Lambda function running

Pricing

You pay for the following:

  • S3 Get Object API (as usual)
  • Lambda invocation
  • Lambda GB-second
  • $0.005 per GB returned via WriteGetObjectResponse

Source Code

---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'S3 Object Lambda Demo'
Resources:
Bucket:
Type: 'AWS::S3::Bucket'
Properties: {}
FunctionLogGroup:
Type: 'AWS::Logs::LogGroup'
Properties:
LogGroupName: !Sub '/aws/lambda/${Function}'
RetentionInDays: 14
FunctionRole:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: 'lambda.amazonaws.com'
Action: 'sts:AssumeRole'
Policies:
- PolicyName: 's3-object-lambda'
PolicyDocument:
Statement:
- Effect: Allow
Action: 's3-object-lambda:WriteGetObjectResponse'
Resource: '*'
FunctionPolicy:
Type: 'AWS::IAM::Policy'
Properties:
Roles:
- !Ref FunctionRole
PolicyName: lambda
PolicyDocument:
Statement:
- Effect: Allow
Action:
- 'logs:CreateLogStream'
- 'logs:PutLogEvents'
Resource: !GetAtt 'FunctionLogGroup.Arn'
Function:
Type: 'AWS::Lambda::Function'
Properties:
Code:
ZipFile: |
const AWS = require('aws-sdk');
const s3 = new AWS.S3({apiVersion: '2006-03-01'});
exports.handler = async (event) => {
console.log(JSON.stringify(event));
await s3.writeGetObjectResponse({
RequestRoute: event.getObjectContext.outputRoute,
RequestToken: event.getObjectContext.outputToken,
Body: 'hello'
}).promise()
return {};
};
Handler: 'index.handler'
MemorySize: 128
Role: !GetAtt 'FunctionRole.Arn'
Runtime: 'nodejs12.x'
Timeout: 60
AccessPoint:
Type: 'AWS::S3::AccessPoint'
Properties:
Bucket: !Ref Bucket
LambdaAccessPoint:
Type: 'AWS::S3ObjectLambda::AccessPoint'
Properties:
Name: !Ref 'AWS::StackName'
ObjectLambdaConfiguration:
SupportingAccessPoint: !Sub 'arn:${AWS::Partition}:s3:${AWS::Region}:${AWS::AccountId}:accesspoint/${AccessPoint}'
TransformationConfigurations:
- Actions:
- GetObject
ContentTransformation:
AwsLambda:
FunctionArn: !GetAtt 'Function.Arn'
Outputs:
BucketName:
Value: !Ref Bucket
LambdaAccessPointArn:
Value: !GetAtt 'LambdaAccessPoint.Arn'

To invoke the S3 Object Lambda Access Point, run with your ARN: aws s3api get-object --bucket arn:aws:s3-object-lambda:us-east-1:123456789123:accesspoint/s3-object-lambda --key file.txt outfile.txt

Become a cloudonaut supporter

Michael Wittig

Michael Wittig ( Email, Twitter, or LinkedIn )

We launched the cloudonaut blog in 2015. Since then, we have published 360 articles, 49 podcast episodes, and 48 videos. It's all free and means a lot of work in our spare time. We enjoy sharing our AWS knowledge with you.

Please support us

Have you learned something new by reading, listening, or watching our content? With your help, we can spend enough time to keep publishing great content in the future. Learn more

$
Amount must be a multriply of 5. E.g, 5, 10, 15.

Thanks to Alan Leech, Alex DeBrie, ANTHONY RAITI, Christopher Hipwell, Jaap-Jan Frans, Jason Yorty, Jeff Finley, Jens Gehring, jhoadley, Johannes Grumböck, Johannes Konings, John Culkin, Jonas Mellquist, Juraj Martinka, Kamil Oboril, Ken Snyder, Markus Ellers, Ross Mohan, Ross Mohan, sam onaga, Satyendra Sharma, Shawn Tolidano, Simon Devlin, Thorsten Hoeger, Todd Valentine, Victor Grenu, and all anonymous supporters for your help! We also want to thank all supporters who purchased a cloudonaut t-shirt.