Architecture Patterns · AWS Lambda Web Functions · aws/agent-toolkit-for-aws · Skills Docs

Architecture Patterns · AWS Lambda Web Functions · aws/agent-toolkit-for-aws · Skills Docs

// index.js
import express from 'express';
import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
import { DynamoDBDocumentClient, GetCommand, PutCommand } from '@aws-sdk/lib-dynamodb';

const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
const app = express();
app.use(express.json({ limit: '10mb' }));

app.get('/items/:id', async (req, res) => {
  const { Item } = await client.send(new GetCommand({
    TableName: 'Items', Key: { id: req.params.id }
  }));
  Item ? res.json(Item) : res.status(404).json({ error: 'not found' });
});

const [HOST, PORT] = (process.env.AWS_LAMBDA_HTTP_ENDPOINT || '0.0.0.0:3000').split(':');
app.listen(PORT, HOST);

// index.js
import express from 'express';

const app = express();

function renderPage(req) {
  // Build HTML per request. Escape any user-controlled values you interpolate.
  return `<!DOCTYPE html>
<html>
  <head><title>SSR on Lambda Web Functions</title></head>
  <body>
    <h1>Hello from server-side rendering</h1>
    <p>Rendered at ${new Date().toISOString()} for path ${req.path}</p>
  </body>
</html>`;
}

app.get('/', (req, res) => {
  res.set('Content-Type', 'text/html; charset=utf-8').send(renderPage(req));
});

const [HOST, PORT] = (process.env.AWS_LAMBDA_HTTP_ENDPOINT || '0.0.0.0:3000').split(':');
app.listen(PORT, HOST);

app.get('/stream', (req, res) => {
  res.setHeader('Content-Type', 'text/event-stream');
  res.setHeader('Cache-Control', 'no-cache');
  res.setHeader('Connection', 'keep-alive');
  res.flushHeaders();

  const interval = setInterval(() => {
    res.write(`data: ${JSON.stringify({ time: Date.now() })}\n\n`);
  }, 1000);

  req.on('close', () => clearInterval(interval));
});

import crypto from 'node:crypto';

// Load the signing secret once at module level, from Secrets Manager.
const secret = await getSigningSecret();

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto.createHmac('sha256', secret).update(req.body).digest('hex');
  const provided = (req.get('X-Hub-Signature-256') ?? '').replace('sha256=', '');

  // Length check first: timingSafeEqual throws on a length mismatch.
  const valid = provided.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(provided));
  if (!valid) return res.status(401).json({ error: 'invalid signature' });

  res.json({ accepted: true });
  // Defer the parse into the promise chain. Called directly as an argument it would
  // evaluate synchronously, so a malformed body would throw where .catch cannot see it,
  // after the response was already committed.
  Promise.resolve()
    .then(() => processWebhookAsync(JSON.parse(req.body)))
    .catch(console.error);
});