Access AWS Lambda with a service account

Install kgateway by using Helm. Choose the [data plane gateway proxy](

/docs/2.0.x/about/proxies#supported) that you want to use, such as kgateway for API ingress or agentgateway for AI use cases.


helm upgrade -i --namespace kgateway-system --version v2.0.4
kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway</code></pre></div><div class="hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0">
  <button
    class="hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50"
    title="Copy code"
  >
    <div class="copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4"></div>
    <div class="success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4"></div>
  </button>
</div>
</div>
<ol start="4">
<li>
<p>Make sure that <code>kgateway</code> is running.</p>
<div class="hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code">

<div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-sh" data-lang="sh"><span class="line"><span class="cl">kubectl get pods -n kgateway-system</span></span></code></pre></div></div><div class="hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0">
  <button
    class="hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50"
    title="Copy code"
  >
    <div class="copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4"></div>
    <div class="success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4"></div>
  </button>
</div>
</div>
<p>Example output:</p>
<div class="hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code">

<div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-console" data-lang="console"><span class="line"><span class="cl"><span class="go">NAME                        READY   STATUS    RESTARTS   AGE
</span></span></span><span class="line"><span class="cl"><span class="go">kgateway-5495d98459-46dpk   1/1     Running   0          19s
</span></span></span></code></pre></div></div><div class="hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0">
  <button
    class="hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50"
    title="Copy code"
  >
    <div class="copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4"></div>
    <div class="success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4"></div>
  </button>
</div>
</div>
</li>
</ol>


## Annotate the gateway proxy service account {#annotate}

1. Create a GatewayParameters resource to specify the `eks.amazonaws.com/role-arn` IRSA annotation for the gateway proxy service account.
   ```yaml
   kubectl apply -f- <<EOF
   apiVersion: gateway.kgateway.dev/v1alpha1
   kind: GatewayParameters
   metadata:
     name: http-lambda
     namespace: kgateway-system
   spec:
     kube:
       serviceAccount:
         extraAnnotations:
           eks.amazonaws.com/role-arn: arn:aws:iam::${AWS_ACCOUNT_ID}:role/lambda-role
   EOF

  
    

    

  




Update the http Gateway resource to add a reference to the http-lambda GatewayParameters.


kubectl apply -f- <<EOF
kind: Gateway
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: http
  namespace: kgateway-system
  annotations:
spec:
  gatewayClassName: kgateway
  infrastructure:
    parametersRef:
      name: http-lambda
      group: gateway.kgateway.dev
      kind: GatewayParameters        
  listeners:
  - protocol: HTTP
    port: 8080
    name: http
    allowedRoutes:
      namespaces:
        from: All
EOF

  
    

    

  




Check the status of the gateway to make sure that your configuration is accepted. Note that in the output, a NoConflicts status of False indicates that the gateway is accepted and does not conflict with other gateway configuration.


kubectl get gateway http -n kgateway-system -o yaml

  
    

    

  




Verify that the http service account has the eks.amazonaws.com/role-arn: arn:aws:iam::${AWS_ACCOUNT_ID}:role/lambda-role annotation.


kubectl describe serviceaccount http -n kgateway-system

  
    

    

  




Create a Lambda function
    
Create an AWS Lambda function to test kgateway routing.


Log in to the AWS console and navigate to the Lambda page.


Click the Create Function button.


Name the function echo and click Create function.


Replace the default contents of index.mjs with the following Node.js function, which returns a response body that contains exactly what was sent to the function in the request body.


export const handler = async(event) => {
    const response = {
        statusCode: 200,
        body: `Response from AWS Lambda. Here's the request you just sent me: ${JSON.stringify(event)}`
    };
    return response;
};

  
    

    

  




Click Deploy.


Set up routing to your function
    
Create Backend and HTTPRoute resources to route requests to the Lambda function.


Create a Backend resource that references the AWS region, ID of the account that contains the IAM role, and echo function that you created.


kubectl apply -f - <<EOF
apiVersion: gateway.kgateway.dev/v1alpha1
kind: Backend
metadata:
  name: lambda
  namespace: kgateway-system
spec:
  type: AWS
  aws:
    region: ${AWS_LAMBDA_REGION}
    accountId: "${AWS_ACCOUNT_ID}"
    lambda:
      functionName: echo
EOF

  
    

    

  




Create an HTTPRoute resource that references the lambda Backend.


kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: lambda
  namespace: kgateway-system
spec:
  parentRefs:
    - name: http
      namespace: kgateway-system
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /echo
    backendRefs:
    - name: lambda
      namespace: kgateway-system
      group: gateway.kgateway.dev
      kind: Backend
EOF

  
    

    

  




Get the external address of the gateway and save it in an environment variable.

  
Cloud Provider LoadBalancerPort-forward for local testing


   

export INGRESS_GW_ADDRESS=$(kubectl get svc -n kgateway-system http -o jsonpath="{.status.loadBalancer.ingress[0]['hostname','ip']}")
echo $INGRESS_GW_ADDRESS   

  
 

 

  



   

kubectl port-forward deployment/http -n kgateway-system 8080:8080

  
 

 

  



   



Confirm that kgateway correctly routes requests to Lambda by sending a curl request to the echo function. Note that the first request might take a few seconds to process, because the AWS Security Token Service (STS) credential request must be performed first. However, after the credentials are cached, subsequent requests are processed more quickly.

  
Cloud Provider LoadBalancerPort-forward for local testing


   

curl $INGRESS_GW_ADDRESS:8080/echo -d '{"key1":"value1", "key2":"value2"}' -X POST

  
 

 

  



   

curl localhost:8080/echo -d '{"key1":"value1", "key2":"value2"}' -X POST

  
 

 

  



   
Example response:


{"statusCode":200,"body":"Response from AWS Lambda. Here's the request you just sent me: {\"key1\":\"value1\",\"key2\":\"value2\"}"}% 

  
    

    

  




At this point, kgateway is routing directly to the echo Lambda function using an IRSA!
Cleanup
    
You can remove the resources that you created in this guide.
Resources for the echo function
    


Delete the lambda HTTPRoute and lambda Backend.


kubectl delete HTTPRoute lambda -n kgateway-system
kubectl delete Backend lambda -n kgateway-system

  
    

    

  




Use the AWS Lambda console to delete the echo test function.


IRSA authorization (optional)
    
If you no longer need to access Lambda functions from kgateway:


Delete the GatewayParameters resources.


kubectl delete GatewayParameters http-lambda -n kgateway-system

  
    

    

  




Remove the reference to the http-lambda GatewayParameters from the http Gateway.


kubectl apply -f- <<EOF
kind: Gateway
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: http
  namespace: kgateway-system
spec:
  gatewayClassName: kgateway
  listeners:
  - protocol: HTTP
    port: 8080
    name: http
    allowedRoutes:
      namespaces:
        from: All
EOF

  
    

    

  




Delete the pod identity webhook.


kubectl delete deploy pod-identity-webhook

  
    

    

  




Remove cert-manager.


kubectl delete -f cert-manager.yaml -n cert-manager
kubectl delete ns cert-manager

  
    

    

  




Delete the AWS IAM resources that you created.


aws iam detach-role-policy --role-name lambda-role --policy-arn=arn:aws:iam::${AWS_ACCOUNT_ID}:policy/lambda-policy
aws iam delete-role --role-name lambda-role
aws iam delete-policy --policy-arn=arn:aws:iam::${AWS_ACCOUNT_ID}:policy/lambda-policy