Infra as GitHub Actions - AWS Serverless Function for nodejs

In the last post we talked about the need to simplify infra while also moving it back to the application repo

As I started to work on the next infra as GitHub actions, which was a secured website with authentication@edge. It became clear that AWS lambda was a fundamental building block in the journey

Introducing actions-aws-function-node 🎉
Now with very few dependencies, you can provision your node backend in literally a minute 🏎️

Getting started

Let's start with familiar code

// src/index.js exports.handler = async (event, context) => { return { "statusCode": 200, "headers": { "Content-Type": "*/*" }, "body": "hello world" } } 

Add the workflow

# .github/workflows/on-push-main.yml name: demo on: push: branches: - main jobs: deploy: environment: name: main url: ${{ steps.backend.outputs.url }} permissions: id-token: write runs-on: ubuntu-latest steps: - name: Check out repo uses: actions/checkout@v4 - uses: aws-actions/configure-aws-credentials@v4 with: aws-region: us-east-1 role-to-assume: ${{ secrets.ROLE_ARN }} role-session-name: ${{ github.actor }} - uses: alonch/actions-aws-backend-setup@main with: instance: sample - uses: alonch/actions-aws-function-node@main with: name: actions-aws-function-node-sample entrypoint-file: index.js entrypoint-function: handler artifacts: src allow-public-access: true 

Add the secret ROLE_ARN with access to AWS and that's it, after pushing to main you have a GitHub deployment with you backend running 🎉
You can clone this sample from Github too
Of course, there are a lot more options

Permissions

You can allow access to services by just adding the resource name and the access, either read or write

For example:

 - uses: alonch/actions-aws-function-node@main with: name: actions-aws-function-node-demo entrypoint-file: index.js entrypoint-function: handler artifacts: src allow-public-access: true permissions: | s3: read dynamodb: write 

This configuration will attach AmazonS3ReadOnly and AmazonDynamoDBFullAccess managed policies to the function's role

Environment Variables

Similar to permissions, you can attach function variables as follow:

 - uses: alonch/actions-aws-function-node@main with: name: actions-aws-function-node-demo entrypoint-file: index.js entrypoint-function: handler artifacts: src allow-public-access: true env: | DD_ENV: production DD_SERVICE: demo DD_VERSION: ${{ github.sha }} 

The rest of the options are standard attributes like memory, timeout or selecting ARM architecture

The best part is that it takes a minute to provision it and even less time to destroy 👏

I’m excited about the future developments and improvements that can be made to this workflow. If you have any feedback, questions, or suggestions, feel free to leave a comment below or reach out directly. Let’s continue this journey of simplifying infrastructure together!

Thank you for reading, and happy coding!