Serverless Gateway
Akelyess Serverless Gateway is a cloud-native development model that enables you to run the Gateway without having to manage servers.
The Serverless Gateway currently can be used only on AWS based on Lambda functions that handle the routine work of provisioning, maintaining, and scaling the Gateway infrastructure.
Once deployed, the Serverless Gateway responds on-demand through an event-driven execution model and automatically scales up and down as needed. For example, issuing just-in-time access credentials using Akeyless Dynamic Secrets will trigger the Gateway for provisioning and for revoking those credentials once TTL expires.
The following guide will demonstrate how to use a Terraform module to create a Serverless Gateway.
Prerequisites
- Terraform
>=1.0.0
- AWS account.
Gateway Configuration
Clone the Serverless Gateway repository locally:
git clone https://github.com/akeyless-community/akeyless-serverless-gateway.git
Edit the akeyless-serverless-gateway/terraform/AWS/serverless-gateway/lambda_env_vars.tf
file according to the sections below.
Authentication
Set your Gateway with a default Authentication Method to control the level of access your Gateway will have inside your Akeyless account.
The following Authentication Methods are supported for Serverless mode:
When using AWS IAM as the admin_access_id
of the Gateway, make sure to set in addition a list of users that will be able to manage your Gateway configuration using the allowed_access_permissions
variable, for example:
variable "admin_access_id_type" {
description = "Set the Admin Auth Type for the Gateway"
type = string
default = "access_key"
}
variable "admin_access_id" {
description = "Akeyless API Key Auth Access ID"
type = string
default = "<Access ID>"
}
variable "admin_access_key" {
description = "Akeyless Admin Access Key"
default = "<Access Key>"
}
variable "allowed_access_permissions" {
description = "Akeyless allowed_access_permissions"
type = string
default = "[{\"name\": \"\", \"<Access ID>\": \"\", \"permissions\": [\"admin\"]}]"
}
variable "admin_access_id_type" {
description = "Set the Admin Auth Type for the Gateway"
type = string
default = "aws_iam"
}
variable "admin_access_id" {
description = "Akeyless AWS IAM Auth Access ID"
type = string
default = "<Access ID>"
}
variable "allowed_access_permissions" {
description = "Akeyless allowed_access_permissions"
type = string
default = "[{\"name\": \"\", \"<Access ID>\": \"\", \"permissions\": [\"admin\"]}]"
}
Where:
-
admin_access_id_type
: The Auth Method type for the Gateway eitheraccess_key
oraws_iam
. -
admin_access_id
: The Access ID of the Default AWS_IAM / API Key Auth Method , can manage all Gateway components and add additional Access Permissions** -
admin_access_key
: TheAccess_Key
of theadmin_access_id
. Relevant only whenadmin_access_id_type
isaccess_key
. -
allowed_access_permissions
: A list of allowed Access IDs, to delegate permissions users will have on your Gateway components. Required whenadmin_access_id_type
isaws_iam
. For example, can be used with API Key or SAML, etc.
Customer Fragment
To work with Zero-Knowledge edit the customer_fragments
variable as follows:
variable "customer_fragments"{
type = map(any)
sensitive = true
description = ""
default = {
"customer_fragments": [
{
"id": "<Customer Fragment ID>",
"value": "<Value>",
"description": "My Serverless Fragment",
"name": "ServerLessFragment"
}
]
}
}
Installation
To install the module, run the following commands:
terraform init
terraform apply
Upon successful installation of the Serverless Gateway, the following output will be generated:
Outputs:
akeyless_serverless_gateway_url = "https://uh4i3r4.execute-api.<region>.amazonaws.com/default/console"
aws_api_gateway_rest_api = "arn:aws:apigateway:<region>::/restapis/uh4i3r4"
aws_lambda_function = "arn:aws:lambda:<region>:<aws-acct-id>:function:<your-serverless-gateway>"
repository_url = "<aws-acct-id>.dkr.ecr.<region>.amazonaws.com/<your>-serverless-gateway-repo-for-lambda"
Note: If the Gateway settings need to be updated after installation, edit the relevant values in the terraform files and run terraform apply
.
Initial Gateway Configuration
To configure your Akeyless Gateway:
- On your browser, navigate to the URL in the first output above labeled:
akeyless_serverless_gateway_url
. - Enter your credentials to log in.
Gateway URL
The default value of the
akeyless_serverless_gateway_url
ends with/default/console
which will route you to Akeyless Gateway Console (Port18888
).To connect to Akeyless Gateway Configuration Manager (Port
8000
) use:/default/config
For more information in regards to the Serverless Gateway, refer to the Serverless Gateway repository
Note: After installing the Serverless Gateway, it becomes accessible as a Lambda Function within your AWS account. This enables you to access comprehensive information, monitor its performance, and gain a complete overview of its functionality, while it's possible to edit the Gateway directly from the Lambda function, any changes made will be overwritten during the next terraform apply
command.
AWS Configuration
While the lammbda_env_vars.tf
file contains the basic configuration required for deploying the Serverless Gateway, You can also configure the variables.tf
file to match your AWS account needs. Below are examples of configurable settings:
-
aws_profile
- Set the AWS Profile for authentication, the default value isdefault
-
region
- Set the AWS region, the default value isus-east-2
-
api_gw_name
Set the name of the gateway in AWS, default value:akeyless-serverless-gateway-api-gateway
-
lambda_func_name
Set the name of the lambda function in AWS, the default value isakeyless-serverless-gateway
Find more information about the available terraform configuration files.
Upgrading the Gateway
The Serverless Gateway version can be updated to different versions based on your preferences, follow these steps to update the Gateway:
- Enter the Serverless Gateway repo in GitHub
- Go to Lambda Docker Image Configuration > Selecting a Different Version
- View available versions
- In
varialbes.tf
file, change the fieldimage-tag
to the version you desire - Run
terraform apply
The Serverless Gateway will boot with the version you chose.
Limitations
Unavailable services:
Kubernetes / LDAP Authentication, Caching, Automatic Migration, Event on status changes, TLS Configuration.
Unsupported actions from the console:
-
Getting Dynamic Secret credentials - While it is possible to create a Dynamic Secret from the console using the Serverless Gateway, the Dynamic Secret's credentials need to be fetched from the Gateway itself.
-
Rotate Password - While it is possible to create a Rotated Secret from the console using the Serverless Gateway, the password can be rotated from the Gateway itself.
Updated about 2 months ago