Providing bref layer from a different AWS account

[amacrobert-meq]

Hi! I'm pushing my organization to move our microservices to lambda, using bref since they're written in PHP.

Our compliance director has determined that using the lambda layers provided by bref (such as ${bref:layer.php-74}, which points to arn:aws:lambda:us-east-1:209497400698:layer:php-74:17) is unacceptable, and wants any layers we use to be in our own AWS account.

I know that I can provide my own layers in serverless.yml by giving it a lambda layer arn directly, and I can make those new layers in the aws lambda console.

However, I'm not sure what to use for the layer runtimes. These are just PHP binaries, right? Can I directly download the ones that bref uses somewhere? Or do I need to compile the binaries myself?

Thank you.

[mnapoli]

Hi!

Good news, this is exactly what Bref Enterprise addresses: https://enterprise.bref.sh/services.html
It provides an integrated solution to keep the Bref layers in your account while still staying up to date. It helps with stricter policies like the one you mentioned.

Feel free to get in touch with me at [email protected]

[amacrobert-meq]

Thanks @mnapoli. We are considering the €500/month cost of Bref Enterprise mainly for the consulting/support, but as a small startup every budget decision is contentious. I can justify that expense for consulting, but not for what amounts to a software license, and I'm sure I'll have an easier time doing that if I can get a proof of concept working.

I think I did it here -- it seems to work. Can you tell me if my bootstrap looks right?

docker run -t -d bref/build-php-74
docker cp <container>:/opt .
composer require -dopt bref/bref

then I made a opt/bootstrap for the runtime which looks like this:

#!/opt/bin/php
<?php
require __DIR__ . '/vendor/autoload.php';

$lambdaRuntime = \Bref\Runtime\LambdaRuntime::fromEnvironmentVariable();

do {
    $lambdaRuntime->processNextEvent(function ($event) {
        $handler = include getenv('_HANDLER');
        return $handler($event);
    });
} while (true);

and finally packaged it up:

cd opt
zip -r php-74-runtime.zip bin bref bootstrap vendor

[mnapoli]

Sure I see what you mean, that's interesting feedback. In your example you override the bootstrap file, but why change it? Why not keep the bootstrap provided by bref (/opt/bootstrap)?

[amacrobert-meq]

I'd definitely prefer to use bref's bootstrap instead of the one I kludged together, but I couldn't find it. In the bref/build-php-74 container, there doesn't appear to be a bootstrap in /opt. Am I missing something?

bash-4.2# pwd
/opt
bash-4.2# ls -lAh
total 8.0K
drwxr-xr-x 2 root root 4.0K Dec  2 14:38 bin
drwxr-xr-x 1 root root 4.0K Dec  2 14:38 bref

[mnapoli]

Right, try bref/php-74 instead?

[amacrobert-meq]

Got it, thanks!

I also see there's a super handy Makefile in brefphp/bref/runtime for generating all the layers - way easier than what I was doing!

[amacrobert-meq]

To anyone looking for the easy solution in the future:

git clone https://github.com/brefphp/bref.git bref
cd bref/runtime
# (optional) comment out/remove versions you don't want to generate from Makefile
make

Layer zips will be created in export/.