イメージのビルド待ちなしに AWS Lambda MicroVMs を最新のコードで動かしてみた

const server = http.createServer((req, res) => {
  // /run: 作業ディレクトリを作り直してソースを取得し、コマンドを実行する
  if (req.method === "POST" && req.url === "/run") {
    let body = "";
    req.on("data", (c) => { body += c; });
    req.on("end", async () => {
      const { repository, objectUrl, command } = JSON.parse(body);
      await resetWorkDir();
      // 取得元の指定に応じて、リポジトリまたは Amazon S3 から取得します
      const fetched = repository
        ? await cloneRepository(repository)
        : await fetchObject(objectUrl);
      if (fetched.exitCode !== 0) {
        res.writeHead(200, { "Content-Type": "application/json" });
        res.end(JSON.stringify(fetched));
        return;
      }
      exec(command, { cwd: WORK_DIR, timeout: 600000 }, (error, stdout, stderr) => {
        // タイムアウト時は error.code が "ETIMEDOUT" のような文字列になるため、
        // 数値でない場合も失敗として 1 を返す
        const exitCode = error
          ? (typeof error.code === "number" ? error.code : 1)
          : 0;
        res.writeHead(200, { "Content-Type": "application/json" });
        res.end(JSON.stringify({ exitCode, stdout, stderr }));
      });
    });
    return;
  }
  res.writeHead(200);
  res.end(JSON.stringify({ status: "ok" }));
});
server.listen(8080, () => console.log("listening on 8080"));

{
  "name": "microvm-verify-app",
  "version": "1.0.0",
  "type": "module",
  "private": true
}

// trust-policy.json（AWS Lambda がこのロールを引き受けられるようにする）
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": [
        "sts:AssumeRole",
        "sts:TagSession"
      ]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "arn:aws:s3:::<your-bucket-name>/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    }
  ]
}

aws iam create-role --role-name MicrovmBuildRole \
  --assume-role-policy-document file://trust-policy.json
aws iam put-role-policy --role-name MicrovmBuildRole \
  --policy-name BuildPolicy --policy-document file://build-policy.json

FROM node:24-alpine
WORKDIR /app
RUN apk add --no-cache git
COPY package.json server.js ./
EXPOSE 8080
CMD ["node", "server.js"]

zip -r app.zip . -x 'node_modules/*' -x '.git/*'
aws s3 cp app.zip s3://<your-bucket-name>/app.zip

aws lambda-microvms create-microvm-image \
  --name microvm-verify \
  --code-artifact '{"uri": "s3://<your-bucket-name>/app.zip"}' \
  --base-image-arn arn:aws:lambda:us-east-1:aws:microvm-image:al2023-1 \
  --build-role-arn arn:aws:iam::<account-id>:role/MicrovmBuildRole

{
    "imageArn": "arn:aws:lambda:us-east-1:<account-id>:microvm-image:microvm-verify",
    "name": "microvm-verify",
    "state": "CREATING",
    "baseImageArn": "arn:aws:lambda:us-east-1:aws:microvm-image:al2023-1",
    "baseImageVersion": "1.0",
    "imageVersion": "1.0"
}

aws lambda-microvms run-microvm \
  --image-identifier <imageArn> \
  --idle-policy '{
    "autoResumeEnabled": true,
    "maxIdleDurationSeconds": 900,
    "suspendedDurationSeconds": 300
  }'

{
    "microvmId": "microvm-<uuid>",
    "state": "PENDING",
    "endpoint": "<endpoint-id>.lambda-microvm.us-east-1.on.aws",
    "imageArn": "arn:aws:lambda:us-east-1:<account-id>:microvm-image:microvm-verify",
    "imageVersion": "1.0",
    "egressNetworkConnectors": [
        "arn:aws:lambda:us-east-1:aws:network-connector:aws-network-connector:INTERNET_EGRESS"
    ]
}

aws lambda-microvms get-microvm --microvm-identifier <microvmId> --query 'state'

aws lambda-microvms create-microvm-auth-token \
  --microvm-identifier <microvmId> \
  --expiration-in-minutes 60 \
  --allowed-ports "port=8080"

{
  "authToken": {
    "X-aws-proxy-auth": "<jwe-token>"
  }
}

curl -s "https://<endpoint>/run" \
  -H "X-aws-proxy-auth: <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "repository": "https://github.com/octocat/Hello-World.git",
    "command": "ls -la && git log -1"
  }'

total 16
drwxr-xr-x    3 root     root          4096 Aug 31 06:39 .
drwxr-xr-x    4 root     root          4096 Aug 31 06:39 ..
drwxr-xr-x    7 root     root          4096 Aug 31 06:39 .git
-rw-r--r--    1 root     root            13 Aug 31 06:39 README
commit 7fd1a60b01f91b314f59955a4e4d4e80d8edf11d
Merge: 553c207 7629413
Author: The Octocat <octocat@nowhere.com>
Date:   Tue Mar 6 15:06:50 2012 -0800

    Merge pull request #6 from Spaceghost/patch-1
    
    New line at end of file.

tar czf src.tar.gz -C <project-root>/src .
aws s3 cp src.tar.gz s3://<your-bucket-name>/src.tar.gz
aws s3 presign s3://<your-bucket-name>/src.tar.gz --expires-in 600

curl -s "https://<endpoint>/run" \
  -H "X-aws-proxy-auth: <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "objectUrl": "<presignedUrl>",
    "command": "ls -la && cat index.js"
  }'

total 16
drwxr-xr-x    2 501      dialout       4096 Aug 31 06:40 .
drwxr-xr-x    4 root     root          4096 Aug 31 06:40 ..
-rw-r--r--    1 501      dialout         41 Aug 31 06:40 index.js
-rw-r--r--    1 501      dialout         18 Aug 31 06:40 package.json
console.log("hello from s3 fetch test");

# MicroVM を終了する
aws lambda-microvms terminate-microvm --microvm-identifier <microvmId>

# MicroVM イメージを削除する
aws lambda-microvms delete-microvm-image --image-identifier <imageArn>

# Amazon S3 のオブジェクトとバケットを削除する（バケットが空でないと削除できません）
aws s3 rm s3://<your-bucket-name>/app.zip
aws s3 rm s3://<your-bucket-name>/src.tar.gz
aws s3 rb s3://<your-bucket-name>

# IAM ロールを削除する（先にインラインポリシーを削除します）
aws iam delete-role-policy --role-name MicrovmBuildRole --policy-name BuildPolicy
aws iam delete-role --role-name MicrovmBuildRole