{"id":2012,"date":"2016-10-24T12:57:43","date_gmt":"2016-10-24T19:57:43","guid":{"rendered":"http:\/\/briantroy.com\/?p=2012"},"modified":"2025-01-03T04:44:00","modified_gmt":"2025-01-03T04:44:00","slug":"series-part-3-serverless-architecture-a-practical-implementation-serverless-rest-api","status":"publish","type":"post","link":"https:\/\/blogarchive.briantroy.com\/index.php\/2016\/10\/24\/series-part-3-serverless-architecture-a-practical-implementation-serverless-rest-api\/","title":{"rendered":"Series – Part 3: Serverless Architecture – a practical implementation: Serverless REST API"},"content":{"rendered":"

In part two of this series<\/a> I discussed creating a serverless data collection and processing fabric for an IoT deployment. To recap, we’ve now reviewed the local devices and controller\/gateway pattern for the security cameras deployed. We’ve also discussed the Amazon Web Services infrastructure deployed to collect, process and catalog the data generated by the security cameras.<\/p>\n

In this post we will cover the creation of a serverless REST API.<\/p>\n

<\/p>\n

The image below provides an overview of the serverless web application that will be implemented using this REST API:<\/p>\n

\"serverless-app-arch-001\"
Serverless Web Application & REST API<\/figcaption><\/figure>\n

Serverless REST API Creation<\/h2>\n

In the previous post we discussed getting our security videos and images to S3 and processing them via a Lambda function to generate a metadata catalog of the videos in DynamoDB. Now we can create a serverless REST API over the top of the data.<\/p>\n

Creating a Lamdba Function for REST Services<\/h3>\n

As with the Lambda function created in part 2 of the series the first step is to create an IAM role enabling the access required. In order to do that we need to discuss the basic capabilities of the REST API Lambda function.<\/p>\n

    \n
  1. Read the latest security videos – regardless of camera.<\/li>\n
  2. Read the latest security videos for a particular camera.<\/li>\n
  3. Generate singed URLs for the videos in S3 to allow playback.<\/li>\n
  4. Log information to CloudWatch<\/li>\n<\/ol>\n

    The first step is to create a new role – I called mine\u00a0securityMicroserviceRole.\u00a0<\/em>Once the role is created you can create and assign each of the following policies.<\/p>\n

    For all of the policies below you’ll want to replace the “Resource” ARN info with the ARN for your DynamoDB table or S3 Bucket.<\/p>\n

    Policy #1: Get the latest security videos<\/h4>\n
    {\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"GetOnSecurityAlarmVideos\",\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"dynamodb:GetItem\",\n                \"dynamodb:BatchGetItem\",\n                \"dynamodb:Query\"\n            ],\n            \"Resource\": \"arn:aws:dynamodb:!!Your ARN Info!!:table\/security_video_timeline\"\n        }\n    ]\n}\n<\/pre>\n
    \u00a0Policy #2: Get the latest security videos by camera<\/h4>\n
    {\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"GetOnSecurityAlarmVideos\",\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"dynamodb:GetItem\",\n                \"dynamodb:BatchGetItem\",\n                \"dynamodb:Query\"\n            ],\n            \"Resource\": \"arn:aws:dynamodb:!!Your ARN Info!!:table\/security_alarm_videos\"\n        }\n    ]\n}\n<\/pre>\n
    Policy #3: Generate singed URLs for videos in S3 allowing playback<\/h4>\n
    {\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"s3:Get*\",\n        \"s3:List*\"\n      ],\n      \"Resource\": \"arn:aws:s3:!!Your ARN Info!!\/*\"\n    }\n  ]\n}\n<\/pre>\n
    Policy #4: Log information to CloudWatch<\/h4>\n
    {\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": \"logs:CreateLogGroup\",\n            \"Resource\": \"arn:aws:logs:!!Your ARN Info!!:*\"\n        },\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\n                \"logs:CreateLogStream\",\n                \"logs:PutLogEvents\"\n            ],\n            \"Resource\": [\n                \"arn:aws:logs:!!Your ARN Info!!:log-group:\/aws\/lambda\/last5Videos:*\"\n            ]\n        }\n    ]\n}\n<\/pre>\n
    Now we can create the Lambda function that will provide our REST API services.<\/p>\n
    Lambda Function Creation<\/h4>\n
    The process is similar to what we did in part 2 of the series – but in this case we want our Lambda function to be triggered by the AWS API Gateway, not S3. Once again we will select the Blank Template.<\/p>\n
    In the “Configure Triggers” section we will select API Gateway:<\/p>\n
    \"screenshot-2016-10-21-14-33-32\"
    Lambda Function Trigger<\/figcaption><\/figure>\n
    You can use the default “Deployment stage” and\u00a0AWS IAM\u00a0<\/em>in “Security”.<\/p>\n
    In the “Configure Function” section we will name our function and select the Python runtime:<\/p>\n
    \"screenshot-2016-10-21-14-35-51\"
    Lambda Function Info<\/figcaption><\/figure>\n
    Similar to in part 2 you will cut and paste the Lambda Function code found in GitHub here into the code box.<\/a><\/p>\n
    In the “Lambda function handler and role” section we will select\u00a0Choose an existing role<\/em> and then select the role created earlier in this post.<\/p>\n
    In the advanced settings I would advise giving your function more execution time – 12 to 14 seconds should be sufficient for testing\/debugging. In our case (serverless) we do not need our Lambda function to connect to any EC2 instances. If you do require that select the VPC those instances reside in.<\/p>\n
    Hit “Next” and “Create Function” and you have created the REST API Lambda Function.<\/p>\n
    Repeat these same Lambda Function Creation steps for the getCameraNames Lambda function found in the GitHub repository here<\/a>.<\/strong><\/p>\n
    For the moment we will skip testing the Lambda function and move on to configuring API Gateway to field API requests and invoke our function.<\/p>\n
    Configuring API Gateway for REST API Lambda Function<\/h3>\n
    Before we start configuring our API it is worth an overview of the resources (API capabilities) we will expose:<\/p>\n
    GET \/cameras<\/h4>\n
    The \/cameras resource will return a list of the camera names. This is done by walking the S3 bucket and finding all the camera names (see part 2 of the series for details). It is implemented by the following code in the Lambda Function getCameraNames<\/a>:<\/p>\n
    \"\"\" Gets the current list of cameras by parsing the s3 bucket objects. \"\"\"\ndef lambda_handler(event, context):\n    \"\"\" Lambda Hander \"\"\"\n    import boto3\n\n    s3_client = boto3.client('s3')\n    items = s3_client.list_objects(Bucket='security-alarms', Prefix='patrolcams\/', Delimiter='\/')\n\n    out_list = []\n    for obj in items.get('CommonPrefixes', []):\n        camera = obj.get('Prefix')\n        camera = camera.replace('patrolcams\/', '')\n        camera = camera.replace('\/', '')\n        out_list.append(camera)\n        # end for\n\n    return out_list\n<\/pre>\n
    GET \/lastfive<\/h4>\n
    The \/lastfive resource will return the last 5 (or any other configured number of) security videos regardless of camera name in order from newest to oldest. This method will also support optional GET parameters for:<\/p>\n