AWS Lambda MicroVMs : bastions serverless, sandboxes IA et Cloud9 DIY avec VS Code OSS + EFS

# Créer un network connector VPC pour le bastion (une seule fois)
aws lambda-core create-network-connector \
  --name bastion-vpc-egress \
  --configuration '{
    "VpcEgressConfiguration": {
      "SubnetIds": ["subnet-private-a"],
      "SecurityGroupIds": ["sg-bastion"],
      "NetworkProtocol": "IPv4",
      "AssociatedComputeResourceTypes": ["MicroVm"]
    }
  }' \
  --operator-role arn:aws:iam::123456789012:role/NetworkConnectorOperatorRole

# Lancer un bastion éphémère
aws lambda-microvms run-microvm \
  --image-identifier arn:aws:lambda:eu-west-1:123456789012:microvm-image:bastion-hardened \
  --execution-role-arn arn:aws:iam::123456789012:role/BastionMicroVMRole \
  --ingress-network-connectors "arn:aws:lambda:eu-west-1:aws:network-connector:aws-network-connector:ALL_INGRESS" \
  --egress-network-connectors "arn:aws:lambda:eu-west-1:123456789012:network-connector:bastion-vpc-egress" \
  --idle-policy '{"maxIdleDurationSeconds":1800,"suspendedDurationSeconds":600,"autoResumeEnabled":false}'

┌─────────────────────────────────────────────────────────┐
│                    Développeur (navigateur)             │
│         https://mvm-xxx.lambda-microvm.eu-west-1.on.aws│
│         Header: X-aws-proxy-auth: <token>              │
└──────────────────────────────┬──────────────────────────┘
                               │ HTTPS (port 8080)
                               ▼
┌─────────────────────────────────────────────────────────┐
│              Lambda MicroVM (ARM64 / Graviton)          │
│              Baseline: 4 Go / 2 vCPU                   │
│              Peak: 16 Go / 8 vCPU (burst auto)         │
│                                                         │
│  ┌─────────────────────────────────────────────────┐    │
│  │         OpenVSCode Server (port 8080)           │    │
│  │         Extensions, terminal, LSP               │    │
│  └─────────────────────────────────────────────────┘    │
│                                                         │
│  ┌─────────────────────────────────────────────────┐    │
│  │         /home/developer/workspace               │    │
│  │         (local ou mount EFS optionnel)          │    │
│  └─────────────────────────────────────────────────┘    │
│                                                         │
│  Runtime: Node.js 20, Python 3.12, AWS CLI v2           │
└─────────────────────────────────────────────────────────┘
                               │ (optionnel) NFS via VPC
                               ▼            egress connector
┌─────────────────────────────────────────────────────────┐
│              Amazon EFS (Access Point /dev/workspace)   │
│              Persistance du code entre sessions         │
│              Throughput mode: elastic                   │
└─────────────────────────────────────────────────────────┘

# Créer le filesystem
aws efs create-file-system \
  --performance-mode generalPurpose \
  --throughput-mode elastic \
  --encrypted \
  --tags Key=Name,Value=dev-workspace-efs \
  --region eu-west-1

# Créer un Access Point dédié
aws efs create-access-point \
  --file-system-id fs-0abc123def456 \
  --posix-user Uid=1000,Gid=1000 \
  --root-directory "Path=/dev/workspace,CreationInfo={OwnerUid=1000,OwnerGid=1000,Permissions=755}"

# Créer les mount targets dans les subnets privés
aws efs create-mount-target \
  --file-system-id fs-0abc123def456 \
  --subnet-id subnet-private-a \
  --security-groups sg-efs-access

FROM public.ecr.aws/lambda/microvms:al2023-minimal
USER root

# Outils système de base
RUN dnf install -y \
    nodejs20 npm \
    python3.12 python3.12-pip \
    git wget unzip tar gzip \
    && dnf clean all

# AWS CLI v2
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "awscliv2.zip" \
    && unzip awscliv2.zip && ./aws/install && rm -rf aws awscliv2.zip

# OpenVSCode Server (build ARM64)
ARG OPENVSCODE_VERSION=1.109.5
RUN mkdir -p /opt/vscode \
    && curl -fsSL "https://github.com/gitpod-io/openvscode-server/releases/download/openvscode-server-v${OPENVSCODE_VERSION}/openvscode-server-v${OPENVSCODE_VERSION}-linux-arm64.tar.gz" \
    | tar xz --strip-components=1 -C /opt/vscode

# Créer l'utilisateur développeur avec workspace local
RUN useradd -m -u 1000 -s /bin/bash developer \
    && mkdir -p /home/developer/workspace \
    && mkdir -p /home/developer/.openvscode-server/data/Machine \
    && chown -R developer:developer /home/developer

# Pré-configurer pour désactiver le workspace trust (évite le reload loop)
RUN echo '{"security.workspace.trust.enabled": false}' \
    > /home/developer/.openvscode-server/data/Machine/settings.json \
    && chown developer:developer /home/developer/.openvscode-server/data/Machine/settings.json

# Script d'entrypoint
COPY entrypoint.sh /opt/entrypoint.sh
RUN chmod +x /opt/entrypoint.sh

# Extensions VS Code pré-installées
RUN su - developer -c "/opt/vscode/bin/openvscode-server \
    --install-extension ms-python.python \
    --install-extension dbaeumer.vscode-eslint \
    --install-extension esbenp.prettier-vscode \
    --install-extension amazonwebservices.aws-toolkit-vscode"

EXPOSE 8080

WORKDIR /home/developer/workspace

CMD ["/opt/entrypoint.sh"]

#!/bin/bash
# entrypoint.sh — Lance OpenVSCode Server

set -e

# Lancer OpenVSCode Server en tant que developer
exec su - developer -c "/opt/vscode/bin/openvscode-server \
    --host 0.0.0.0 \
    --port 8080 \
    --without-connection-token \
    --default-folder /home/developer/workspace"

#!/bin/bash
# entrypoint.sh — Version avec montage EFS

set -e

EFS_DNS="${EFS_FILE_SYSTEM_ID}.efs.${AWS_REGION}.amazonaws.com"
MOUNT_POINT="/home/developer/workspace"

# Monter EFS (nécessite nfs-utils dans le Dockerfile + additionalOsCapabilities)
if ! mountpoint -q "$MOUNT_POINT"; then
    mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 \
        "${EFS_DNS}:/" "$MOUNT_POINT"
    chown developer:developer "$MOUNT_POINT"
fi

# Lancer OpenVSCode Server en tant que developer
exec su - developer -c "/opt/vscode/bin/openvscode-server \
    --host 0.0.0.0 \
    --port 8080 \
    --without-connection-token \
    --default-folder /home/developer/workspace"

aws lambda-microvms create-microvm-image \
  --name vscode-dev-environment \
  --code-artifact uri=s3://my-microvm-artifacts/vscode-microvm.zip \
  --base-image-arn arn:aws:lambda:eu-west-1:aws:microvm-image:al2023-1 \
  --build-role-arn arn:aws:iam::123456789012:role/MicroVMBuildRole \
  --environment-variables '{"EFS_FILE_SYSTEM_ID":"fs-0abc123def456"}' \
  --additional-os-capabilities '["ALL"]'

# Packager le code source
zip -r vscode-microvm.zip Dockerfile entrypoint.sh

# Uploader sur S3
aws s3 cp vscode-microvm.zip s3://my-microvm-artifacts/vscode-microvm.zip

# Créer l'image MicroVM
aws lambda-microvms create-microvm-image \
  --name vscode-dev-environment \
  --code-artifact uri=s3://my-microvm-artifacts/vscode-microvm.zip \
  --base-image-arn arn:aws:lambda:eu-west-1:aws:microvm-image:al2023-1 \
  --build-role-arn arn:aws:iam::123456789012:role/MicroVMBuildRole \
  --environment-variables '{"EFS_FILE_SYSTEM_ID":"fs-0abc123def456"}'

# Vérifier l'état du build
aws lambda-microvms get-microvm-image \
  --image-identifier vscode-dev-environment

# Créer un network connector VPC pour accéder à EFS (une seule fois)
aws lambda-core create-network-connector \
  --name dev-vpc-egress \
  --configuration '{
    "VpcEgressConfiguration": {
      "SubnetIds": ["subnet-private-a"],
      "SecurityGroupIds": ["sg-dev-microvm"],
      "NetworkProtocol": "IPv4",
      "AssociatedComputeResourceTypes": ["MicroVm"]
    }
  }' \
  --operator-role arn:aws:iam::123456789012:role/NetworkConnectorOperatorRole

# Lancer la MicroVM avec politique d'idle intelligente
aws lambda-microvms run-microvm \
  --image-identifier arn:aws:lambda:eu-west-1:123456789012:microvm-image:vscode-dev-environment \
  --execution-role-arn arn:aws:iam::123456789012:role/DevMicroVMRole \
  --ingress-network-connectors "arn:aws:lambda:eu-west-1:aws:network-connector:aws-network-connector:ALL_INGRESS" \
  --egress-network-connectors "arn:aws:lambda:eu-west-1:123456789012:network-connector:dev-vpc-egress" \
  --idle-policy '{"maxIdleDurationSeconds":3600,"suspendedDurationSeconds":1800,"autoResumeEnabled":true}' \
  --maximum-duration-in-seconds 28800

{
  "microvmId": "mvm-01234567-abcd-ef01-2345-6789abcdef01",
  "state": "PENDING",
  "endpoint": "mvm-01234567-abcd-ef01-2345-6789abcdef01.lambda-microvm.eu-west-1.on.aws"
}

# Générer un token valide 8h (durée max de la session)
aws lambda-microvms create-microvm-auth-token \
  --microvm-identifier mvm-01234567-abcd-ef01-2345-6789abcdef01 \
  --expiration-in-minutes 480 \
  --allowed-ports '[{"port":8080}]'

# Accéder à l'IDE dans le navigateur :
# https://mvm-01234567-abcd-ef01-2345-6789abcdef01.lambda-microvm.eu-west-1.on.aws
# Header requis : X-aws-proxy-auth: <token>

{
  "Comment": "Provision dev environment on demand",
  "StartAt": "RunMicroVM",
  "States": {
    "RunMicroVM": {
      "Type": "Task",
      "Resource": "arn:aws:states:::aws-sdk:lambdamicrovms:runMicrovm",
      "Parameters": {
        "ImageIdentifier": "arn:aws:lambda:eu-west-1:123456789012:microvm-image:vscode-dev-environment",
        "ExecutionRoleArn": "arn:aws:iam::123456789012:role/DevMicroVMRole",
        "IngressNetworkConnectors": ["arn:aws:lambda:eu-west-1:aws:network-connector:aws-network-connector:ALL_INGRESS"],
        "EgressNetworkConnectors": ["arn:aws:lambda:eu-west-1:123456789012:network-connector:dev-vpc-egress"],
        "IdlePolicy": {
          "MaxIdleDurationSeconds": 3600,
          "SuspendedDurationSeconds": 1800,
          "AutoResumeEnabled": true
        },
        "MaximumDurationInSeconds": 28800
      },
      "ResultPath": "$.microvm",
      "Next": "NotifyDeveloper"
    },
    "NotifyDeveloper": {
      "Type": "Task",
      "Resource": "arn:aws:states:::sns:publish",
      "Parameters": {
        "TopicArn": "arn:aws:sns:eu-west-1:123456789012:dev-notifications",
        "Message.$": "States.Format('Votre IDE est prêt : {}', $.microvm.Endpoint)"
      },
      "End": true
    }
  }
}

// proxy.mjs — Proxy local d'authentification Lambda MicroVM
import http from "node:http";
import https from "node:https";
import { execSync } from "node:child_process";

const MICROVM_ID = process.env.MICROVM_ID;
const MICROVM_ENDPOINT = process.env.MICROVM_ENDPOINT;
const REGION = process.env.AWS_REGION || "eu-west-1";
const LOCAL_PORT = parseInt(process.env.PORT || "8080", 10);
const TOKEN_EXPIRATION_MINUTES = parseInt(process.env.TOKEN_EXPIRATION || "60", 10);

let authToken = null;
let tokenExpiresAt = 0;

function refreshToken() {
  const cmd = `aws lambda-microvms create-microvm-auth-token \
    --microvm-identifier ${MICROVM_ID} \
    --expiration-in-minutes ${TOKEN_EXPIRATION_MINUTES} \
    --allowed-ports '[{"allPorts":{}}]' \
    --region ${REGION} --output json`;
  const result = JSON.parse(execSync(cmd, { encoding: "utf-8" }));
  authToken = result.authToken["X-aws-proxy-auth"];
  tokenExpiresAt = Date.now() + (TOKEN_EXPIRATION_MINUTES - 5) * 60_000;
}

function getToken() {
  if (!authToken || Date.now() >= tokenExpiresAt) refreshToken();
  return authToken;
}

function getEndpoint() {
  if (MICROVM_ENDPOINT) return MICROVM_ENDPOINT;
  const cmd = `aws lambda-microvms get-microvm --microvm-identifier ${MICROVM_ID} --region ${REGION} --output json`;
  return JSON.parse(execSync(cmd, { encoding: "utf-8" })).endpoint;
}

const endpoint = getEndpoint();

// Forward HTTP
async function handleRequest(req, res) {
  const chunks = [];
  for await (const chunk of req) chunks.push(chunk);
  const body = Buffer.concat(chunks);

  const headers = { ...req.headers, host: endpoint, "x-aws-proxy-auth": getToken() };
  delete headers.connection;

  const proxyReq = https.request(
    { hostname: endpoint, port: 443, path: req.url, method: req.method, headers },
    (proxyRes) => {
      res.writeHead(proxyRes.statusCode, proxyRes.headers);
      proxyRes.pipe(res);
    }
  );
  proxyReq.on("error", () => { res.writeHead(502); res.end("Bad Gateway"); });
  if (body.length) proxyReq.write(body);
  proxyReq.end();
}

// Forward WebSocket upgrades
function handleUpgrade(req, socket, head) {
  const token = getToken();
  const headers = { ...req.headers, host: endpoint, connection: "Upgrade", upgrade: "websocket" };

  // Injecter le token via subprotocols WebSocket
  const existing = headers["sec-websocket-protocol"]?.split(",").map((p) => p.trim()) || [];
  headers["sec-websocket-protocol"] = [
    "lambda-microvms",
    `lambda-microvms.authentication.${token}`,
    "lambda-microvms.port.8080",
    ...existing,
  ].join(", ");
  headers["x-aws-proxy-auth"] = token;

  const proxyReq = https.request({ hostname: endpoint, port: 443, path: req.url, method: "GET", headers });

  proxyReq.on("upgrade", (proxyRes, proxySocket, proxyHead) => {
    // Filtrer les subprotocols lambda-microvms de la réponse
    let responseHead = "HTTP/1.1 101 Switching Protocols\r\n";
    for (const [key, value] of Object.entries(proxyRes.headers)) {
      if (key.toLowerCase() === "sec-websocket-protocol") {
        const filtered = value.split(",").map((p) => p.trim()).filter((p) => !p.startsWith("lambda-microvms"));
        if (filtered.length) responseHead += `${key}: ${filtered.join(", ")}\r\n`;
        continue;
      }
      responseHead += `${key}: ${value}\r\n`;
    }
    responseHead += "\r\n";
    socket.write(responseHead);
    if (proxyHead.length) socket.write(proxyHead);
    proxySocket.pipe(socket);
    socket.pipe(proxySocket);
    proxySocket.on("error", () => socket.destroy());
    socket.on("error", () => proxySocket.destroy());
  });

  proxyReq.on("response", (proxyRes) => {
    let resp = `HTTP/1.1 ${proxyRes.statusCode} ${proxyRes.statusMessage}\r\n`;
    for (const [k, v] of Object.entries(proxyRes.headers)) resp += `${k}: ${v}\r\n`;
    resp += "\r\n";
    socket.write(resp);
    proxyRes.pipe(socket);
  });

  proxyReq.on("error", () => socket.destroy());
  proxyReq.end();
}

const server = http.createServer(handleRequest);
server.on("upgrade", handleUpgrade);
server.listen(LOCAL_PORT, () => {
  console.log(`MicroVM proxy → http://localhost:${LOCAL_PORT} → https://${endpoint}`);
});

# Lancer le proxy
MICROVM_ID=mvm-01234567-abcd-ef01-2345-6789abcdef01 \
MICROVM_ENDPOINT=mvm-01234567-abcd-ef01-2345-6789abcdef01.lambda-microvm.eu-west-1.on.aws \
  node proxy.mjs

# Ouvrir VS Code dans le navigateur
open http://localhost:8080