#!/usr/bin/env bash set -euo pipefail # Required env : "${AWS_REGION:?Missing AWS_REGION}" : "${FUNCTION_NAME:?Missing FUNCTION_NAME}" : "${OG_BUCKET:?Missing OG_BUCKET}" : "${ECR_REPO:?Missing ECR_REPO}" export AWS_DEFAULT_REGION="$AWS_REGION" AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) ECR_URI="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com" IMAGE_TAG="${BITBUCKET_COMMIT}" IMAGE_URI="${ECR_URI}/${ECR_REPO}:${IMAGE_TAG}" EXEC_ROLE_NAME="${FUNCTION_NAME}-exec" EXEC_ROLE_ARN="arn:aws:iam::${AWS_ACCOUNT_ID}:role/${EXEC_ROLE_NAME}" echo "Account: ${AWS_ACCOUNT_ID}" echo "Region: ${AWS_REGION}" echo "ECR Repo: ${ECR_REPO}" echo "Image URI: ${IMAGE_URI}" echo "Exec Role ARN: ${EXEC_ROLE_ARN}" # --- Wait until Lambda is ready (no in-progress update) --- wait_lambda_ready() { local phase="${1:-}" echo "Waiting for Lambda ($phase) to be Active/Successful..." for i in {1..60}; do local state status reason state=$(aws lambda get-function-configuration --function-name "$FUNCTION_NAME" --query 'State' --output text 2>/dev/null || echo "UNKNOWN") status=$(aws lambda get-function-configuration --function-name "$FUNCTION_NAME" --query 'LastUpdateStatus' --output text 2>/dev/null || echo "UNKNOWN") reason=$(aws lambda get-function-configuration --function-name "$FUNCTION_NAME" --query 'LastUpdateStatusReason' --output text 2>/dev/null || echo "") echo " State=$state LastUpdateStatus=$status ${reason:+Reason=$reason}" if [ "$state" = "Active" ] && [ "$status" = "Successful" ]; then return 0 fi if [ "$status" = "Failed" ]; then echo "Lambda update failed: $reason" exit 1 fi sleep 5 done echo "Timed out waiting for Lambda to become Active/Successful." exit 1 } # 1) Ensure execution role exists (+ CloudWatch logs) if ! aws iam get-role --role-name "$EXEC_ROLE_NAME" >/dev/null 2>&1; then echo "Creating Lambda execution role: $EXEC_ROLE_NAME" cat > /tmp/trust.json <<'EOF' { "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" }] } EOF aws iam create-role --role-name "$EXEC_ROLE_NAME" --assume-role-policy-document file:///tmp/trust.json >/dev/null aws iam attach-role-policy --role-name "$EXEC_ROLE_NAME" --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole >/dev/null fi # 1a) Upsert inline S3 PutObject cat > /tmp/s3put.json </dev/null || true # 1b) Upsert inline ECR pull (broadened to "*") + auth token cat > /tmp/ecrpull.json <<'EOF' { "Version":"2012-10-17", "Statement":[{ "Effect":"Allow", "Action":[ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:GetDownloadUrlForLayer", "ecr:DescribeImages" ], "Resource":"*" }] } EOF aws iam put-role-policy --role-name "$EXEC_ROLE_NAME" --policy-name "EcrImagePull" --policy-document file:///tmp/ecrpull.json >/dev/null || true cat > /tmp/ecrauth.json <<'EOF' { "Version":"2012-10-17", "Statement":[{ "Effect":"Allow", "Action":["ecr:GetAuthorizationToken"], "Resource":"*" }] } EOF aws iam put-role-policy --role-name "$EXEC_ROLE_NAME" --policy-name "EcrAuthToken" --policy-document file:///tmp/ecrauth.json >/dev/null || true # 1c) If ECR repo is KMS-encrypted with a customer key, grant decrypt ENC_TYPE=$(aws ecr describe-repositories --repository-name "$ECR_REPO" --query "repositories[0].encryptionConfiguration.encryptionType" --output text 2>/dev/null || echo "AES256") KMS_KEY=$(aws ecr describe-repositories --repository-name "$ECR_REPO" --query "repositories[0].encryptionConfiguration.kmsKey" --output text 2>/dev/null || echo "None") if [ "$ENC_TYPE" = "KMS" ] && [ "$KMS_KEY" != "None" ]; then echo "ECR repo uses KMS key: $KMS_KEY — adding decrypt permission to exec role" cat > /tmp/ecrkms.json </dev/null || true fi # Give IAM a moment to propagate sleep 10 # Diagnostics (optional): simulate exec-role permissions for ECR pull echo "Simulating exec role permissions for ECR pull..." aws iam simulate-principal-policy --policy-source-arn "$EXEC_ROLE_ARN" --action-names ecr:BatchGetImage ecr:GetDownloadUrlForLayer ecr:BatchCheckLayerAvailability ecr:DescribeImages ecr:GetAuthorizationToken --resource-arns "arn:aws:ecr:${AWS_REGION}:${AWS_ACCOUNT_ID}:repository/${ECR_REPO}" "*" --query "EvaluationResults[].{Action:EvalActionName,Decision:EvalDecision}" --output table || true # --- helper: check image via AWS (preferred) or Docker (fallback) check_image() { echo "Checking image presence in ECR (describe-images)..." if aws ecr describe-images --repository-name "$ECR_REPO" --image-ids imageTag="$IMAGE_TAG" >/dev/null 2>&1; then return 0 fi echo "describe-images failed; trying 'docker manifest inspect'..." if docker manifest inspect "$IMAGE_URI" >/dev/null 2>&1; then return 0 fi echo "Last aws ecr describe-images error:" >&2 aws ecr describe-images --repository-name "$ECR_REPO" --image-ids imageTag="$IMAGE_TAG" || true return 1 } # 1.5) Wait until the image tag is visible (or docker can see it) echo "Waiting for image ${IMAGE_URI} to be available..." for i in {1..12}; do if check_image; then echo "Image is available." break fi echo "Not yet available, retrying in 5s... ($i/12)" sleep 5 if [ "$i" -eq 12 ]; then echo "Image ${IMAGE_URI} not available after 60s"; exit 1 fi done # 2) Create or update the function (container image) if aws lambda get-function --function-name "$FUNCTION_NAME" >/dev/null 2>&1; then echo "Updating Lambda code: $FUNCTION_NAME" aws lambda update-function-code --function-name "$FUNCTION_NAME" --image-uri "$IMAGE_URI" >/dev/null # Wait for async code update to finish before config change wait_lambda_ready "after code update" echo "Updating configuration (memory/timeout/env/ephemeral storage)" aws lambda update-function-configuration --function-name "$FUNCTION_NAME" --memory-size 2048 --timeout 60 --environment "Variables={OG_BUCKET=${OG_BUCKET}}" --ephemeral-storage "Size=1024" >/dev/null # Wait again so subsequent steps don’t race wait_lambda_ready "after config update" else echo "Creating Lambda function: $FUNCTION_NAME" aws lambda create-function --function-name "$FUNCTION_NAME" --package-type Image --code "ImageUri=${IMAGE_URI}" --role "$EXEC_ROLE_ARN" --memory-size 2048 --timeout 60 --environment "Variables={OG_BUCKET=${OG_BUCKET}}" --architectures x86_64 --ephemeral-storage "Size=1024" >/dev/null # New functions spend time in Pending/Active — wait it out wait_lambda_ready "after create" fi # 3) Function URL (public). Lock down later if needed. wait_lambda_ready "before function URL" if ! aws lambda get-function-url-config --function-name "$FUNCTION_NAME" >/dev/null 2>&1; then echo "Creating Function URL" aws lambda create-function-url-config --function-name "$FUNCTION_NAME" --auth-type NONE --cors "AllowOrigins=['*'],AllowMethods=['*'],AllowHeaders=['*']" >/dev/null aws lambda add-permission --function-name "$FUNCTION_NAME" --statement-id "FunctionURLAllowPublic" --action "lambda:InvokeFunctionUrl" --principal "*" --function-url-auth-type "NONE" >/dev/null else echo "Function URL already exists" fi LAMBDA_URL=$(aws lambda get-function-url-config --function-name "$FUNCTION_NAME" --query FunctionUrl --output text) echo "Deployed: ${FUNCTION_NAME}" echo "Image: ${IMAGE_URI}" echo "URL: ${LAMBDA_URL}"