Lambda MicroVMs に対応した Step Functions の SDK 統合を試してみた

import datetime
import os
import socket
from http.server import BaseHTTPRequestHandler, HTTPServer

LISTEN_PORT = 8080
BOOT_AT = datetime.datetime.now(datetime.timezone.utc)

def log(line):
    now = datetime.datetime.now(datetime.timezone.utc).isoformat()
    print(f"[{now}] {line}", flush=True)

class TimeHandler(BaseHTTPRequestHandler):
    server_version = "microvm-clock/1.0"

    def do_GET(self):
        now = datetime.datetime.now(datetime.timezone.utc)
        body = (
            "MicroVM clock\n"
            f"now_utc: {now.isoformat()}\n"
            f"epoch: {now.timestamp():.3f}\n"
            f"booted_utc: {BOOT_AT.isoformat()}\n"
            f"uptime_seconds: {(now - BOOT_AT).total_seconds():.1f}\n"
            f"hostname: {socket.gethostname()}\n"
        ).encode()
        self.send_response(200)
        self.send_header("Content-Type", "text/plain; charset=utf-8")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)
        log(
            f"ACCESS port={self.server.server_address[1]} "
            f"client={self.client_address[0]} "
            f'"{self.requestline}" 200 {len(body)} '
            f'ua="{self.headers.get("User-Agent", "-")}" '
            f'host="{self.headers.get("Host", "-")}" '
            f'xff="{self.headers.get("X-Forwarded-For", "-")}"'
        )

    def log_message(self, fmt, *args):
        pass  # アクセスログは do_GET 側で構造化して出力する

def serve(port):
    try:
        httpd = HTTPServer(("0.0.0.0", port), TimeHandler)
    except Exception as e:
        log(f"LISTEN_FAILED port={port} error={e}")
        return
    log(f"LISTENING port={port}")
    httpd.serve_forever()

if __name__ == "__main__":
    log(f"BOOT env_port={os.environ.get('PORT', '-')}")
    serve(LISTEN_PORT)

FROM public.ecr.aws/amazonlinux/amazonlinux:2023

RUN dnf install -y python3 && dnf clean all
COPY app.py /app/app.py
WORKDIR /app

EXPOSE 8080
CMD ["python3", "-u", "/app/app.py"]

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "lambda.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
      "Resource": "arn:aws:logs:ap-northeast-1:<ACCOUNT_ID>:log-group:/aws/lambda-microvms/*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::<BUCKET>/*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "states.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "lambda:RunMicrovm",
        "lambda:TerminateMicrovm",
        "lambda:CreateMicrovmAuthToken"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/microvm-3min-site-execution"
    }
  ]
}

{
  "Comment": "MicroVM を起動して 3 分だけ公開し、3 分後に停止する (JSONata / SDK 統合のみ)",
  "QueryLanguage": "JSONata",
  "StartAt": "RunMicrovm",
  "States": {
    "RunMicrovm": {
      "Type": "Task",
      "Resource": "arn:aws:states:::aws-sdk:lambdamicrovms:runMicrovm",
      "Arguments": {
        "ImageIdentifier": "{% $states.input.imageArn %}",
        "ImageVersion": "{% $states.input.imageVersion %}",
        "ExecutionRoleArn": "{% $states.input.executionRoleArn %}",
        "MaximumDurationInSeconds": 900,
        "Logging": {
          "CloudWatch": {
            "LogGroup": "/aws/lambda-microvms/microvm-3min-site",
            "LogStream": "{% 'sfn-' & $states.context.Execution.Name %}"
          }
        }
      },
      "Assign": {
        "microvmId": "{% $states.result.MicrovmId %}",
        "endpoint": "{% $states.result.Endpoint %}",
        "stopAt": "{% $fromMillis($toMillis($now()) + 180000) %}"
      },
      "Next": "CreateAuthToken"
    },
    "CreateAuthToken": {
      "Type": "Task",
      "Resource": "arn:aws:states:::aws-sdk:lambdamicrovms:createMicrovmAuthToken",
      "Arguments": {
        "MicrovmIdentifier": "{% $microvmId %}",
        "ExpirationInMinutes": 3,
        "AllowedPorts": [
          {
            "Port": 8080
          }
        ]
      },
      "Assign": {
        "siteUrl": "{% 'https://' & $endpoint %}",
        "authToken": "{% $states.result.AuthToken.`X-aws-proxy-auth` %}"
      },
      "Next": "ServeFor3Minutes"
    },
    "ServeFor3Minutes": {
      "Type": "Wait",
      "Timestamp": "{% $stopAt %}",
      "Next": "TerminateMicrovm"
    },
    "TerminateMicrovm": {
      "Type": "Task",
      "Resource": "arn:aws:states:::aws-sdk:lambdamicrovms:terminateMicrovm",
      "Arguments": {
        "MicrovmIdentifier": "{% $microvmId %}"
      },
      "Next": "Done"
    },
    "Done": {
      "Type": "Pass",
      "Output": {
        "microvmId": "{% $microvmId %}",
        "url": "{% $siteUrl %}",
        "servedUntil": "{% $stopAt %}"
      },
      "End": true
    }
  }
}

aws lambda-microvms list-microvms
aws lambda-microvms terminate-microvm --microvm-identifier <MICROVM_ID>

aws stepfunctions delete-state-machine --state-machine-arn <STATE_MACHINE_ARN>
aws lambda-microvms delete-microvm-image --image-identifier <IMAGE_ARN>
aws iam delete-role-policy --role-name <ROLE> --policy-name <NAME>
aws iam delete-role --role-name <ROLE>
aws s3 rm s3://<BUCKET>/image.zip
aws s3api delete-bucket --bucket <BUCKET>
aws logs delete-log-group --log-group-name /aws/lambda-microvms/microvm-3min-site