template.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: AWS Lambda Power Tuning resources.

Metadata:
  AWS::ServerlessRepo::Application:
    Name: aws-lambda-power-tuning
    Description: AWS Lambda Power Tuning is an open-source tool that can help you visualize and fine-tune the memory/power configuration of Lambda functions. It runs in your AWS account - powered by AWS Step Functions - and it supports multiple optimization strategies.
    Author: Alex Casalboni
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE.txt
    ReadmeUrl: README-SAR.md
    Labels: ['lambda', 'power', 'state-machine', 'step-functions', 'optimization']
    HomePageUrl: https://github.com/alexcasalboni/aws-lambda-power-tuning
    SemanticVersion: 4.2.0
    SourceCodeUrl: https://github.com/alexcasalboni/aws-lambda-power-tuning

Parameters: 
  PowerValues: 
    Type: List<Number>
    Default: 128,256,512,1024,1536,3008
    Description: Default RAM values, used only if not provided as execution input (comma-separated).
  visualizationURL:
    Type: String
    Default: https://lambda-power-tuning.show/
    Description: Stats visualization URL
  lambdaResource:
    Type: String
    Default: '*'
    Description: AWS Lambda resource (or prefix) to be used for IAM policies
  totalExecutionTimeout:
    Type: Number
    Default: 300
    MinValue: 10
    MaxValue: 900
    Description: Maximum invocation timeout (in seconds) for the Executor step, after which you get a States.Timeout error
  permissionsBoundary:
    Type: String
    Default: ''
    Description: The ARN of a permissions boundary to use for all functions' execution role.
  payloadS3Bucket:
    Type: String
    Default: ''
    Description: S3 bucket name used for large payloads (optional), included in IAM policy if not an empty string
  payloadS3Key:
    Type: String
    Default: '*'
    Description: S3 object key used for large payloads (optional), included in IAM policy if bucket is not an empty string (all objects are readable by default)

Conditions:
  UsePermissionsBoundary: !Not [!Equals [!Ref permissionsBoundary, '']]
  S3BucketProvided: !Not [!Equals [!Ref payloadS3Bucket, '']]

Globals:
  Function:
    Runtime: nodejs14.x
    MemorySize: 128
    Timeout: !Ref totalExecutionTimeout
    PermissionsBoundary: !If [UsePermissionsBoundary, !Ref permissionsBoundary, !Ref AWS::NoValue]
    Environment:
      Variables:
        defaultPowerValues: !Join [ ",", !Ref PowerValues ]
        minRAM: '128'
        baseCosts: '{"x86_64": {"ap-east-1":2.9e-9,"af-south-1":2.8e-9,"me-south-1":2.6e-9,"eu-south-1":2.4e-9,"ap-northeast-3":2.7e-9,"default":2.1e-9}, "arm64": {"default":1.7e-9}}'
        sfCosts: '{"default": 0.000025,"us-gov-west-1": 0.00003,"ap-northeast-2": 0.0000271,"eu-south-1": 0.00002625,"af-south-1": 0.00002975,"us-west-1": 0.0000279,"eu-west-3": 0.0000297,"ap-east-1": 0.0000275,"me-south-1": 0.0000275,"ap-south-1": 0.0000285,"us-gov-east-1": 0.00003,"sa-east-1": 0.0000375}'
        visualizationURL: !Ref visualizationURL

Resources:

  SDKlayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: AWS-SDK-v2_989_0
      Description: AWS SDK 2.989.0
      ContentUri: ./layer-sdk
      CompatibleRuntimes:
        - nodejs14.x
      LicenseInfo: 'Available under the MIT-0 license.'
      RetentionPolicy: Retain
    Metadata:
      BuildMethod: nodejs14.x

  initializer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: initializer.handler
      Layers:
        - !Ref SDKlayer
      Policies:
        - AWSLambdaBasicExecutionRole # Only logs
        - Version: '2012-10-17' # allow Lambda actions
          Statement:
            - Effect: Allow
              Action:
                - lambda:GetAlias
                - lambda:GetFunctionConfiguration
                - lambda:PublishVersion
                - lambda:UpdateFunctionConfiguration
                - lambda:CreateAlias
                - lambda:UpdateAlias
              Resource: !Ref lambdaResource

  executor:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: executor.handler
      Layers:
        - !Ref SDKlayer
      Policies:
        - AWSLambdaBasicExecutionRole # only logs
        - Version: '2012-10-17' # allow Lambda actions
          Statement:
            - Effect: Allow
              Action:
                - lambda:InvokeFunction
                - lambda:GetFunctionConfiguration
              Resource: !Ref lambdaResource
        - !If
          - S3BucketProvided # if S3 bucket is provided
          - !Ref payloadS3Policy # allow read-only access to S3
          - !Ref AWS::NoValue

  payloadS3Policy:
    Condition: S3BucketProvided
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Lambda Power Tunning - S3 Read Only for large payloads
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - s3:ListBucket # this is needed only to detect 404 errors correctly
              - s3:GetObject
            Resource:
              - !Sub arn:${AWS::Partition}:s3:::${payloadS3Bucket}
              - !Sub arn:${AWS::Partition}:s3:::${payloadS3Bucket}/${payloadS3Key} # payloadS3Key is * by default

  cleaner:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: cleaner.handler
      Layers:
        - !Ref SDKlayer
      Policies:
        - AWSLambdaBasicExecutionRole # only logs
        - Version: '2012-10-17' # allow Lambda actions
          Statement:
            - Effect: Allow
              Action:
                - lambda:GetAlias
                - lambda:DeleteAlias
                - lambda:DeleteFunction  # only by version/qualifier
              Resource: !Ref lambdaResource

  analyzer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: analyzer.handler
      Timeout: 10
      Policies:
        - AWSLambdaBasicExecutionRole # only logs

  optimizer:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: lambda
      Handler: optimizer.handler
      Layers:
        - !Ref SDKlayer
      Policies:
        - AWSLambdaBasicExecutionRole # only logs
        - Version: '2012-10-17' # allow Lambda actions
          Statement:
            - Effect: Allow
              Action:
                - lambda:GetAlias
                - lambda:PublishVersion
                - lambda:UpdateFunctionConfiguration
                - lambda:CreateAlias
                - lambda:UpdateAlias
              Resource: !Ref lambdaResource

  statemachineRole:
    Type: AWS::IAM::Role
    Properties:
      PermissionsBoundary: !If [UsePermissionsBoundary, !Ref permissionsBoundary, !Ref AWS::NoValue]
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: !Sub states.${AWS::Region}.amazonaws.com
            Action: sts:AssumeRole

  powerTuningStateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      RoleArn: !GetAtt statemachineRole.Arn
      DefinitionString:
        !Sub
          - '
            {
              "Comment": "AWS Lambda Power Tuning state machine",
              "StartAt": "Initializer",
              "States": {
                  "Initializer": {
                      "Type": "Task",
                      "Resource": "${initializerArn}",
                      "Next": "Branching",
                      "ResultPath": "$.powerValues",
                      "TimeoutSeconds": ${totalExecutionTimeout},
                      "Catch": [{
                        "ErrorEquals": [ "States.ALL" ],
                        "Next": "CleanUpOnError",
                        "ResultPath": "$.error"
                      }]
                  },
                  "Branching": {
                      "Type": "Map",
                      "Next": "Cleaner",
                      "ItemsPath": "$.powerValues",
                      "ResultPath": "$.stats",
                      "Parameters": {
                        "input.$": "$",
                        "value.$": "$$.Map.Item.Value"
                      },
                      "MaxConcurrency": 0,
                      "Catch": [{
                        "ErrorEquals": ["States.ALL"],
                        "Next": "CleanUpOnError",
                        "ResultPath": "$.error"
                      }],
                      "Iterator": {
                          "StartAt": "Executor",
                          "States": {
                              "Executor": {
                                  "Type": "Task",
                                  "Resource": "${executorArn}",
                                  "End": true,
                                  "TimeoutSeconds": ${totalExecutionTimeout},
                                  "Retry": [{
                                      "ErrorEquals": ["States.ALL"],
                                      "IntervalSeconds": 3,
                                      "MaxAttempts": 2
                                  }]
                              }
                          }
                      }
                  },
                  "Cleaner": {
                      "Type": "Task",
                      "Next": "Analyzer",
                      "ResultPath": null,
                      "TimeoutSeconds": ${totalExecutionTimeout},
                      "Resource": "${cleanerArn}"
                  },
                  "Analyzer": {
                      "Type": "Task",
                      "Resource": "${analyzerArn}",
                      "ResultPath": "$.analysis",
                      "TimeoutSeconds": 10,
                      "Next": "Optimizer"
                  },
                  "Optimizer": {
                      "Type": "Task",
                      "Resource": "${optimizerArn}",
                      "ResultPath": null,
                      "OutputPath": "$.analysis",
                      "TimeoutSeconds": ${totalExecutionTimeout},
                      "End": true
                  },
                  "CleanUpOnError": {
                      "Type": "Task",
                      "ResultPath": null,
                      "OutputPath": null,
                      "Resource": "${cleanerArn}",
                      "TimeoutSeconds": ${totalExecutionTimeout},
                      "End": true
                  }
              }
          }'
          - initializerArn: !GetAtt initializer.Arn
            executorArn: !GetAtt executor.Arn
            cleanerArn: !GetAtt cleaner.Arn
            analyzerArn: !GetAtt analyzer.Arn
            optimizerArn: !GetAtt optimizer.Arn
            totalExecutionTimeout: !Ref totalExecutionTimeout

Outputs:
  StateMachineARN:
    Value: !Ref powerTuningStateMachine