Kong Kong Tutorials, 17 Aug 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Serverless Security With Kong's AWS Lambda Plugin

Description

This video will walk you through how to set up serverless security with Kong's AWS Lambda plugin. Install Kong Gateway: https://bit.ly/3rYb9SV

Find all referenced docs and code in this blog post: https://bit.ly/3iQxe4H

▬▬▬▬▬▬ TIMECODES ▬▬▬▬▬▬
0:00 - Intro
0:27 - Write Our Function
1:27 - Deploy Function to AWS Lambda
2:50 - Obtain Credentials for Invoking Lambda
6:51 - Configure Kong Gateway
9:20 - Add AWS Lambda Plugin to Kong
11:38 - Send HTTP Requests and Examine Results with Insomnia
13:03 - Wrap Up

#AWSLambda #APIgateway #Serverless #AWS #Lambda #KongPlugins #KongGateway #ServerlessSecurity

A

In this walkthrough we're going to look at the aws lambda plug-in for kong gateway, we'll write a simple function in node.js and deploy it to aws lambda, we'll set up the proper im credentials to invoke that landa and then we'll configure con gateway to associate a route with the invocation of that lambda to join along in this walkthrough. You will need an aws account and also the aws, cli and kong gateway installed to your local machine.

A

We'll start by writing a simple function which follows the aws documentation on the shape that a function in lambda should take. Let's start in a text editor, the exported handler is a function that is called with an event, a context and a callback we're going to write a basic first iteration of this function, just to make sure we can invoke it successfully.

A

We'll enhance this function a bit more shortly in our function, we create a result, object which will be passed to our callback function, which lambda uses in emitting the invocation response.

A

Our result has a status code, headers and a body with a message.

A

At the end of our function, we call callback and we pass in our result, object as the second argument.

A

Next, in the aws console we'll use the lambda service to create a new function for our walkthrough, we'll be working in the u.s west 2 region.

A

We click on create function, we set a name for our function and we choose a node.js runtime.

A

Once our lambda has been created, we navigate to the code source and find index.js.

A

And we paste in the function code that we just wrote.

A

Then we click on deploy.

A

We can quickly test our function for errors within this interface. We click on test and then on configure test event. We use the default hello, world template, set an event name and then click on create.

A

Now, with this test event configuration selected, we click on test. The execution results show the result of our function, call with its status code, headers and body with message.

A

Of course, we want to invoke our lambda remotely. Ideally it will be the kong plugin that invokes the lamba. First, though, let's work on invoking the lambda at the command line with the aws cli installed, we can try to run the command to invoke our function.

A

The command is aws lambda invoke, followed by the region. Then the invocation type, which we set to request response, then our function name and the last argument, which is a file where the response should be written.

A

When we run the command, we see the error message unable to locate credentials, so we need to run aws configure that's going to ask us for an aws im users, access key id and secret access. Key, let's head over to aws im to set up a user in our aws console. We navigate to aws im then to users.

A

We create a new iam user, which we will call kong lambda invoker.

A

We will give this user programmatic access.

A

For now we'll skip through permissions tags and review and instead just immediately create the user. We'll add permissions in our next step.

A

Now we have an access key id and a secret access key typically you'll want to keep these secret, I'm showing them here in this walkthrough, but we'll be deleting this user after the video.

A

Back in our command line, we run aws configure.

A

We're asked to enter an access key id which we have from the user. We just created. We copy paste that id in from the aws console and we do the same with the secret access key and we set our region and our response format.

A

Now that our iam user has been created and configured, we run our invoke command again. This time, we're shown a different error that our user is not authorized to invoke this lambda function. So now we'll go back to aws im to create a policy permissions to invoke this function, and then we will attach that policy to this user.

A

We are going to need our lambda's unique arn for this policy. So first, let's navigate to lambda, find our lambda and find that arn there. It is we'll copy it.

A

Then we head back to aws im and we navigate to policies. Then we add a new policy.

A

We'll use the json policy editor writing in our policy.

A

This one will allow lambda invoke function and we paste in the actual arn of the lambda that it applies to.

A

We give this policy a name and then we create it.

A

Next, we track down our imuser and we want to add permissions to that user by attaching a policy we're going to attach the invoke lambda policy that we just created.

A

And after we do that, our im user should have the permissions to invoke our lambda back at the command line. We'll try again to invoke our lambda, our user has been configured and that user now has the permissions to invoke the lambda. We run our command and it looks like it was successful.

A

Let's take a look at the response.json file to c and there is our expected lambda response.

A

Now that we have a working lambda and the credentials to invoke it remotely, let's set up kong gateway. First, we'll install kong gateway to our local machine, depending on your own environment. The steps for installing kong will vary once you've installed kong, create a project folder to store your declarative configuration file.

A

We create the project folder, and then we run kong, config init, which generates a boilerplate configuration yaml file for us we'll get back to this file shortly.

A

We need to configure kong upon startup to use this declarative configuration file for that we go to slash, etc cong that folder should have a kong.conf.default file. We copy it and rename it as kong.conf.

A

Now, let's open that file to edit it, we have two changes to make.

A

At around line 938, we need to uncomment the line for the database setting and set database equal to off then at around line. 1122 uncomment the declarative, config line and set it to the absolute path to the declarative, configuration yaml file in our project. Folder.

A

We save the file and exit.

A

Now, let's go edit, that declarative configuration file.

A

We're going to start with a basic setup which has a single service, we'll call it my service and the url for that upstream service will be https, colon, slash, http, stat, dot, us 200.

A

This is just a basic http response code testing site this specific url returns a 200 okay response code.

A

Next, we'll set up a single route, we'll call this my lambda route and we'll associate it with our upstream service and the path for our route will be slash. Lambda.

A

Let's save our file.

A

And we'll start up kong now, if we send a curl request to our kong proxy address, which is localhost at port 8000 to the slash lambda path associated with our route, we get our 200 okay response great. Now we want to edit our declarative configuration file so that kong uses the aws lambda plugin. Let's open our file again.

A

First, we can remove our upstream service. Our route no longer needs to be associated with an upstream service, since requests will go to the lambda invocation. Instead. Next, we add a plugins section. We add one plugin, which is named aws lambda. This is not an arbitrary name. This is the specific name of the plugin that is bundled with congateway.

A

We associate the plugin with our route and then we configure our plugin.

A

We need our aws key and our aws secret. This was the access key id and the secret access key associated with our im user. So we get those and we copy paste them in.

A

We also specify our aws region and our function name, and then we add three configuration options forward: request body forward, request, headers and forward request uri. This will take any headers body and query parameters which are sent to kong and make sure that that same data is sent to the lambda invocation.

A

We save our file and then we restart call.

A

Let's go ahead and send our curl request again.

A

We see that status code, header and the body with a message kong is properly invoking our lambda.

A

Let's update our lambda function code to access that request, header, query, string, parameters and body. We return to the aws console to the source code for my lambda and we edit our index.js file to look like this.

A

Our result, body will now have three keys. We have incoming headers, which will look to the incoming event argument and grab its request. Headers.

A

We have incoming query parameters which we will set to event dot request, uri args and we have incoming body which we'll set to event dot request body.

A

Then we deploy our updated code just to craft our http requests more easily and examine the results more easily, we'll use insomnia, which is a desktop http client.

A

First, we make a basic request to our kong, proxy and path with no parameters or body.

A

We'll set a few additional headers of our own, including test header 1, with the value test, value 1.

A

We send the request and here's the result. The response body shows incoming headers, which are the original headers that the insomnia client sent to our kong proxy now forwarded to the lambda invocation. These include the values that we explicitly set in insomnia.

A

Next, we'll add query string parameters onto our request, url.

A

We send the request and the result shows our query stream parameters echoed back to us in the incoming query parameters key of the response body.

A

Lastly, we'll send a post request and attach a json body.

A

In this final request, we see the incoming headers the incoming query parameters and the incoming body, which equals the json body that we sent with our request, and that concludes our walkthrough. In this walkthrough. We set up a function in aws lambda, along with an im user and policy for invoking that function.

A

Then we configured kong gateway to listen for requests on a specific path and then using the aws lambda plugin for kong, remotely invoke our lambda function when invoking that function. Kong sends on the original requests, headers, query, parameters and body. Thank you for joining us.