Building Serverless Functions

# Install Serverless Framework globally
npm install -g serverless

# Configure AWS credentials (one-time setup)
aws configure
# Enter: AWS Access Key ID, Secret, Region (e.g. us-east-1), Output format (json)

# Create a new serverless project
serverless create --template aws-nodejs --path my-service
cd my-service
npm init -y

service: my-api-service

provider:
  name: aws
  runtime: nodejs20.x
  region: us-east-1
  memorySize: 256       # MB — increase for CPU-heavy tasks
  timeout: 10           # seconds — max 900 for Lambda
  environment:
    DB_HOST: ${env:DB_HOST}
    JWT_SECRET: ${env:JWT_SECRET}
    NODE_ENV: ${opt:stage, 'dev'}
  iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - dynamodb:GetItem
            - dynamodb:PutItem
            - dynamodb:UpdateItem
            - dynamodb:DeleteItem
            - dynamodb:Query
          Resource:
            - arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/Users
            - arn:aws:dynamodb:${aws:region}:${aws:accountId}:table/Users/index/*

functions:
  getUser:
    handler: src/users/get.handler
    events:
      - httpApi:
          path: /users/{id}
          method: GET

  createUser:
    handler: src/users/create.handler
    events:
      - httpApi:
          path: /users
          method: POST

  processQueue:
    handler: src/queue/processor.handler
    events:
      - sqs:
          arn: arn:aws:sqs:us-east-1:123456789:my-queue
          batchSize: 10

  scheduledTask:
    handler: src/tasks/cleanup.handler
    events:
      - schedule:
          rate: rate(1 hour)
          enabled: true

plugins:
  - serverless-offline           # local development
  - serverless-dotenv-plugin     # .env support

const { DynamoDBClient } = require('@aws-sdk/client-dynamodb');
const { DynamoDBDocumentClient, GetCommand } = require('@aws-sdk/lib-dynamodb');

// Initialize outside the handler — reused across warm invocations
const client = new DynamoDBClient({ region: process.env.AWS_REGION });
const docClient = DynamoDBDocumentClient.from(client);

const headers = {
  'Content-Type': 'application/json',
  'Access-Control-Allow-Origin': '*',
};

exports.handler = async (event, context) => {
  // Tell Lambda not to wait for empty event loop
  context.callbackWaitsForEmptyEventLoop = false;

  try {
    const { id } = event.pathParameters;

    if (!id) {
      return {
        statusCode: 400,
        headers,
        body: JSON.stringify({ error: 'User ID is required' }),
      };
    }

    const result = await docClient.send(new GetCommand({
      TableName: 'Users',
      Key: { userId: id },
    }));

    if (!result.Item) {
      return {
        statusCode: 404,
        headers,
        body: JSON.stringify({ error: 'User not found' }),
      };
    }

    return {
      statusCode: 200,
      headers,
      body: JSON.stringify(result.Item),
    };
  } catch (error) {
    console.error('GetUser error:', error);
    return {
      statusCode: 500,
      headers,
      body: JSON.stringify({ error: 'Internal server error' }),
    };
  }
};

# Deploy to dev stage
serverless deploy --stage dev

# Deploy to production
serverless deploy --stage prod

# Deploy only a single function (faster for iteration)
serverless deploy function --function getUser

# Test locally with serverless-offline
serverless offline start

# View logs for a function
serverless logs --function getUser --tail

# Remove all resources
serverless remove --stage dev

const { DynamoDBDocumentClient, PutCommand } = require('@aws-sdk/lib-dynamodb');
const { DynamoDBClient } = require('@aws-sdk/client-dynamodb');
const { randomUUID } = require('crypto');

const docClient = DynamoDBDocumentClient.from(new DynamoDBClient({}));

exports.handler = async (event) => {
  const body = JSON.parse(event.body || '{}');

  // Validate input
  if (!body.email || !body.name) {
    return {
      statusCode: 422,
      body: JSON.stringify({ error: 'email and name are required' }),
    };
  }

  const user = {
    userId: randomUUID(),
    email: body.email.toLowerCase().trim(),
    name: body.name.trim(),
    createdAt: new Date().toISOString(),
    updatedAt: new Date().toISOString(),
  };

  await docClient.send(new PutCommand({
    TableName: 'Users',
    Item: user,
    ConditionExpression: 'attribute_not_exists(email)',  // prevent duplicates
  }));

  return {
    statusCode: 201,
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(user),
  };
};

const { S3Client, GetObjectCommand, PutObjectCommand } = require('@aws-sdk/client-s3');
const sharp = require('sharp');   // image processing (Lambda layer or bundled)

const s3 = new S3Client({});
const SIZES = [{ w: 400, suffix: 'thumb' }, { w: 1200, suffix: 'large' }];

exports.handler = async (event) => {
  for (const record of event.Records) {
    const bucket = record.s3.bucket.name;
    const key = decodeURIComponent(record.s3.object.key.replace(/\+/g, ' '));

    // Skip already-processed images (avoid infinite loop!)
    if (key.includes('/processed/')) continue;

    const { Body } = await s3.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
    const imageBuffer = Buffer.from(await Body.transformToByteArray());

    await Promise.all(SIZES.map(async ({ w, suffix }) => {
      const resized = await sharp(imageBuffer)
        .resize(w, null, { withoutEnlargement: true })
        .webp({ quality: 85 })
        .toBuffer();

      const outputKey = key.replace('uploads/', `processed/${suffix}/`)
        .replace(/\.[^.]+$/, '.webp');

      await s3.send(new PutObjectCommand({
        Bucket: bucket,
        Key: outputKey,
        Body: resized,
        ContentType: 'image/webp',
        CacheControl: 'max-age=31536000',
      }));
    }));

    console.log(`Processed ${key} → ${SIZES.length} variants`);
  }
};

const { SESClient, SendEmailCommand } = require('@aws-sdk/client-ses');

const ses = new SESClient({ region: 'us-east-1' });

exports.handler = async (event) => {
  // Lambda delivers up to batchSize messages at once
  const results = await Promise.allSettled(
    event.Records.map(record => processMessage(JSON.parse(record.body)))
  );

  // Return failed message IDs so Lambda can retry them
  const failures = results
    .map((result, i) => ({ result, record: event.Records[i] }))
    .filter(({ result }) => result.status === 'rejected')
    .map(({ record }) => ({ itemIdentifier: record.messageId }));

  return { batchItemFailures: failures };
};

async function processMessage(message) {
  const { to, subject, body } = message;

  await ses.send(new SendEmailCommand({
    Source: 'noreply@example.com',
    Destination: { ToAddresses: [to] },
    Message: {
      Subject: { Data: subject },
      Body: { Html: { Data: body } },
    },
  }));

  console.log(`Email sent to ${to}`);
}

provider:
  name: aws
  runtime: nodejs20.x
  # Remove global IAM — use per-function roles instead

functions:
  getUser:
    handler: src/users/get.handler
    role: GetUserRole   # custom role with minimal permissions
    events:
      - httpApi:
          path: /users/{id}
          method: GET

  processImages:
    handler: src/images/resize.handler
    role: ImageProcessorRole

resources:
  Resources:
    # Read-only DynamoDB access for getUser
    GetUserRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service: lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: GetUserPolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - dynamodb:GetItem
                  Resource:
                    - arn:aws:dynamodb:us-east-1:*:table/Users

    # S3 read + write for image processor
    ImageProcessorRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service: lambda.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: ImageProcessorPolicy
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - logs:CreateLogGroup
                    - logs:CreateLogStream
                    - logs:PutLogEvents
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - s3:GetObject
                    - s3:PutObject
                  Resource: arn:aws:s3:::my-image-bucket/*

import type { NextApiRequest, NextApiResponse } from 'next';
import { db } from '@/lib/database';

type User = {
  id: string;
  name: string;
  email: string;
};

type ErrorResponse = {
  error: string;
};

export default async function handler(
  req: NextApiRequest,
  res: NextApiResponse<User | ErrorResponse>
) {
  const { id } = req.query;

  if (req.method !== 'GET') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  try {
    const user = await db.user.findUnique({
      where: { id: String(id) },
      select: { id: true, name: true, email: true },
    });

    if (!user) {
      return res.status(404).json({ error: 'User not found' });
    }

    // Cache for 60s at edge, stale-while-revalidate for 5 minutes
    res.setHeader('Cache-Control', 's-maxage=60, stale-while-revalidate=300');
    return res.status(200).json(user);
  } catch (error) {
    console.error('Database error:', error);
    return res.status(500).json({ error: 'Internal server error' });
  }
}

import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

// Runs at the edge — before any serverless function
export function middleware(request: NextRequest) {
  const token = request.cookies.get('auth-token')?.value;

  // Protect /dashboard routes
  if (request.nextUrl.pathname.startsWith('/dashboard')) {
    if (!token) {
      return NextResponse.redirect(new URL('/login', request.url));
    }
  }

  // Geolocation-based routing
  const country = request.geo?.country || 'US';
  if (country === 'GB') {
    return NextResponse.rewrite(new URL('/uk' + request.nextUrl.pathname, request.url));
  }

  return NextResponse.next();
}

export const config = {
  matcher: ['/dashboard/:path*', '/((?!api|_next/static|favicon.ico).*)'],
};

// tests/users/get.test.js
const { handler } = require('../../src/users/get');

// Mock AWS SDK
jest.mock('@aws-sdk/client-dynamodb');
jest.mock('@aws-sdk/lib-dynamodb', () => ({
  DynamoDBDocumentClient: {
    from: jest.fn(() => ({ send: jest.fn() })),
  },
  GetCommand: jest.fn(),
}));

const { DynamoDBDocumentClient } = require('@aws-sdk/lib-dynamodb');

describe('GET /users/:id', () => {
  let mockSend;

  beforeEach(() => {
    mockSend = jest.fn();
    DynamoDBDocumentClient.from.mockReturnValue({ send: mockSend });
  });

  it('returns 200 with user data', async () => {
    mockSend.mockResolvedValue({
      Item: { userId: '123', name: 'Alice', email: 'alice@example.com' },
    });

    const event = { pathParameters: { id: '123' } };
    const context = { callbackWaitsForEmptyEventLoop: false };

    const response = await handler(event, context);

    expect(response.statusCode).toBe(200);
    expect(JSON.parse(response.body).name).toBe('Alice');
  });

  it('returns 404 when user not found', async () => {
    mockSend.mockResolvedValue({ Item: undefined });

    const event = { pathParameters: { id: 'nonexistent' } };
    const response = await handler(event, {});

    expect(response.statusCode).toBe(404);
  });

  it('returns 400 when id is missing', async () => {
    const event = { pathParameters: {} };
    const response = await handler(event, {});

    expect(response.statusCode).toBe(400);
  });
});