Package: newrelic-lambda-cli
newrelic-lambda-cliA CLI to install the New Relic AWS Lambda integration and layers.Table of ContentsFeaturesRuntimes SupportedRequirementsRecommendationsInstallationUsageAWS Lambda IntegrationAWS Lambda LayersAWS Lambda FunctionsNewRelic Log SubscriptionDockerContributingCode StyleRunning TestsTroubleshootingFeaturesInstalls the New Relic AWS Lambda integration onto your AWS accountInstalls and configures a New Relic AWS Lambda layer onto your AWS Lambda functionsAutomatically selects the correct New Relic layer for your function's runtime and regionWraps your AWS Lambda functions without requiring a code changeSupports Go, Java, .NET, Node.js and Python AWS Lambda runtimesEasily uninstall the AWS Lambda layer with a single commandRuntimes Supporteddotnetcore3.1java8.al2java11java17nodejs16.xnodejs18.xnodejs20.xprovidedprovided.al2python3.7python3.8python3.9python3.10python3.11python3.12Note:Automatic handler wrapping is only supported for Node.js, Python and Java. For other runtimes,
manual function wrapping is required using the runtime specific New Relic agent.RequirementsPython >= 3.3 <= 3.12Retrieve yourNew relic Account IDandUser API KeyRecommendationsInstall theAWS CLIand configure your environment withaws configureInstallationpip3installnewrelic-lambda-cliOr clone this repo and run:python3setup.pyinstallTo update the CLI, run:pip3 install --upgrade newrelic-lambda-cliUsageAWS Lambda IntegrationInstall IntegrationIn order to instrument your AWS Lambda functions using New Relic you must first install
the New Relic AWS Lambda integration and the log ingestion function in the AWS region
in which your Lambda functions are located. If you have Lambda functions located in multiple
regions you can run the command multiple times specifying the AWS regions with--aws-region <your aws region here>. This command only needs to be run once per AWS
region. By default this command will look for a default AWS profile configured via the AWS CLI.newrelic-lambdaintegrationsinstall\--nr-account-id<accountid>\--nr-api-key<apikey>OptionRequired?Description--nr-account-idor-aYesTheNew Relic Account IDfor this integration. Can also use theNEW_RELIC_ACCOUNT_IDenvironment variable.--nr-api-keyor-kYesYourNew Relic User API Key. Can also use theNEW_RELIC_API_KEYenvironment variable.--linked-account-nameor-nNoA label for the New Relic Linked Account. This is how this integration will appear in New Relic. Defaults to "New Relic Lambda Integration - ".--enable-logsor-eNoEnables forwarding logs to New Relic Logging. This is disabled by default. Make sure you runnewrelic-lambda subscriptions install --function ... --filter-pattern ""afterwards.--memory-sizeor-mNoMemory size (in MiB) for the New Relic log ingestion function. Default to 128MB.--nr-regionNoThe New Relic region to use for the integration. Can use theNEW_RELIC_REGIONenvironment variable. Can be eithereuorus. Defaults tous.--timeoutor-tNoTimeout (in seconds) for the New Relic log ingestion function. Defaults to 30 seconds.--role-nameNoRole name for the ingestion function. If you prefer to create and manage an IAM role for the function to assume out of band, do so and specify that role's name here. This avoids needing CAPABILITY_IAM.--integration-arnNoSpecify an existing AWS IAM role to use for the New Relic Lambda integration instead of creating one.--aws-profileor-pNoThe AWS profile to use for this command. Can also useAWS_PROFILE. Will also checkAWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEYenvironment variables if not using AWS CLI.--aws-regionor-rNoThe AWS region for the integration. Can useAWS_DEFAULT_REGIONenvironment variable. Defaults to AWS session region.--aws-role-policyNoSpecify an alternative IAM role policy ARN for this integration.--disable-license-key-secretNoDon't create a managed secret for your account's New Relic License Key--tag <key> <value>NoSets tags on the CloudFormation Stacks this CLI creates. Can be used multiple times, example:--tag key1 value1 --tag key2 value2.--stacknameNoThe AWS Cloudformation stack name which contains the newrelic-log-ingestion lambda function. If no value is provided, the command searches for the NewRelicLogIngestion stackUninstall Integrationnewrelic-lambdaintegrationsuninstallOptionRequired?Description--aws-profileor-pNoThe AWS profile to use for this command. Can also useAWS_PROFILE. Will also checkAWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEYenvironment variables if not using AWS CLI.--aws-regionor-rNoThe AWS region for the integration. Can useAWS_DEFAULT_REGIONenvironment variable. Defaults to AWS session region.--forceor-fNoForces uninstall non-interactively--nr-account-idor-aNoTheNew Relic Account IDfor the integration. Only required if also uninstalling the New Relic AWS Lambda integration. Can also use theNEW_RELIC_ACCOUNT_IDenvironment variable.--stacknameNoThe AWS Cloudformation stack name which contains the newrelic-log-ingestion lambda function. If no value is provided, the command searches for the NewRelicLogIngestion stackUpdate IntegrationUpdates the New Relic log ingestion function to the latest version. Existing ingestion function parameters will
retain their values, unless you specify different values on the command line. By default, installs the license key
secret, if it is missing.newrelic-lambdaintegrationsupdate\--nr-account-id<accountid>\--nr-api-key<apikey>OptionRequired?Description--nr-account-idor-aYesTheNew Relic Account IDfor the integration. Only required if changing the account to which the logs are sent. Can also use theNEW_RELIC_ACCOUNT_IDenvironment variable.--nr-api-keyor-kYesYourNew Relic User API Key. Can also use theNEW_RELIC_API_KEYenvironment variable. Only required if changing the account to which the logs are sent.--disable-logsor-dNoDisables forwarding logs to New Relic Logging. Make sure you runnewrelic-lambda subscriptions install --function ...afterwards.--enable-logsor-eNoEnables forwarding logs to New Relic Logging. Make sure you runnewrelic-lambda subscriptions install --function ... --filter-pattern ""afterwards.--memory-sizeor-mNoMemory size (in MiB) for the New Relic log ingestion function.--nr-regionNoThe New Relic region to use for the integration. Can use theNEW_RELIC_REGIONenvironment variable. Can be eithereuorus. Defaults tous.--timeoutor-tNoTimeout (in seconds) for the New Relic log ingestion function.--role-nameNoRole name for the ingestion function. If you prefer to create and manage an IAM role for the function to assume out of band, do so and specify that role's name here. This avoids needing CAPABILITY_IAM.--aws-profileor-pNoThe AWS profile to use for this command. Can also useAWS_PROFILE. Will also checkAWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEYenvironment variables if not using AWS CLI.--aws-regionor-rNoThe AWS region for the integration. Can useAWS_DEFAULT_REGIONenvironment variable. Defaults to AWS session region.--disable-license-key-secretNoDisable automatic creation of the license key secret on update. The secret is not created if it exists.--tag <key> <value>NoSets tags on the CloudFormation Stacks this CLI creates. Can be used multiple times, example:--tag key1 value1 --tag key2 value2.--stacknameNoThe AWS Cloudformation stack name which contains the newrelic-log-ingestion lambda function. If no value is provided, the command searches for the NewRelicLogIngestion stackAWS Lambda LayersInstall Layernewrelic-lambdalayersinstall\--function<nameorarn>\--nr-account-id<newrelicaccountid>OptionRequired?Description--functionor-fYesThe AWS Lambda function name or ARN in which to add a layer. Can provide multiple--functionarguments. Will also acceptall,installedandnot-installedsimilar tonewrelic-lambda functions list.--nr-account-idor-aYesTheNew Relic Account IDthis function should use. Can also use theNEW_RELIC_ACCOUNT_IDenvironment variable.--excludeor-eNoA function name to exclude while installing layers. Can provide multiple--excludearguments. Only checked whenall,installedandnot-installedare used. Seenewrelic-lambda functions listfor function names.--layer-arnor-lNoSpecify a specific layer version ARN to use. This is auto detected by default.--upgradeor-uNoPermit upgrade to the latest layer version for this region and runtime.--disable-extensionNoDisable theNew Relic Lambda Extension.--enable-extension-function-logsNoEnable forwarding logs via theNew Relic Lambda Extension. Disabled by default.--aws-profileor-pNoThe AWS profile to use for this command. Can also useAWS_PROFILE. Will also checkAWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEYenvironment variables if not using AWS CLI.--aws-regionor-rNoThe AWS region this function is located. Can useAWS_DEFAULT_REGIONenvironment variable. Defaults to AWS session region.--nr-api-keyor-kNoYourNew Relic User API Key. Can also use theNEW_RELIC_API_KEYenvironment variable. Only used if--enable-extensionis set and there is no New Relic license key in AWS Secrets Manager.--nr-regionNoThe New Relic region to use for the integration. Can use theNEW_RELIC_REGIONenvironment variable. Can be eithereuorus. Defaults tous. Only used if--enable-extensionis set and there is no New Relic license key in AWS Secrets Manager.--java_handler_methodor-jNoFor java runtimes only to specify an aws implementation method. Defaults to RequestHandler. Optional inputs are: handleRequest, handleStreamsRequest--java_handler_method handleStreamsRequest.Uninstall Layernewrelic-lambdalayersuninstall--function<nameorarn>OptionRequired?Description--functionor-fYesThe AWS Lambda function name or ARN in which to remove a layer. Can provide multiple--functionarguments. Will also acceptall,installedandnot-installedsimilar tonewrelic-lambda functions list.--excludeor-eNoA function name to exclude while uninstalling layers. Can provide multiple--excludearguments. Only checked whenall,installedandnot-installedare used. Seenewrelic-lambda functions listfor function names.--layer-arnor-lNoSpecify a specific layer version ARN to remove. This is auto detected by default.--aws-profileor-pNoThe AWS profile to use for this command. Can also useAWS_PROFILE. Will also checkAWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEYenvironment variables if not using AWS CLI.--aws-regionor-rNoThe AWS region this function is located. Can useAWS_DEFAULT_REGIONenvironment variable. Defaults to AWS session region.AWS Lambda FunctionsList Functionsnewrelic-lambdafunctionslistList functions with layer installed:newrelic-lambdafunctionslist--filterinstalledOptionRequired?Description--filteror-fNoFilter to be applied to list of functions. Options areall,installedandnot-installed. Defaults toall.--outputor-oNoSpecify the desired output format. Supportstableandtext. Defaults totable.--aws-profileor-pNoThe AWS profile to use for this command. Can also useAWS_PROFILE. Will also checkAWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEYenvironment variables if not using AWS CLI.--aws-regionor-rNoThe AWS region to use for this command. Can useAWS_DEFAULT_REGIONenvironment variable. Defaults to AWS session region.NewRelic Log SubscriptionInstall Log Subscriptionnewrelic-lambdasubscriptionsinstall--function<nameorarn>OptionRequired?Description--functionor-fYesThe AWS Lambda function name or ARN in which to add a log subscription. Can provide multiple--functionarguments. Will also acceptall,installedandnot-installedsimilar tonewrelic-lambda functions list.--stacknameNoThe AWS Cloudformation stack name which contains the newrelic-log-ingestion lambda function. If no value is provided, the command searches for the NewRelicLogIngestion stack--excludeor-eNoA function name to exclude while installing subscriptions. Can provide multiple--excludearguments. Only checked whenall,installedandnot-installedare used. Seenewrelic-lambda functions listfor function names.--filter-patternNoSpecify a custom log subscription filter pattern. To collect all logs use--filter-pattern "".--aws-profileor-pNoThe AWS profile to use for this command. Can also useAWS_PROFILE. Will also checkAWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEYenvironment variables if not using AWS CLI.--aws-regionor-rNoThe AWS region this function is located. Can useAWS_DEFAULT_REGIONenvironment variable. Defaults to AWS session region.Uninstall Log Subscriptionnewrelic-lambdasubscriptionsuninstall--function<nameorarn>OptionRequired?Description--functionor-fYesThe AWS Lambda function name or ARN in which to remove a log subscription. Can provide multiple--functionarguments. Will also acceptall,installedandnot-installedsimilar tonewrelic-lambda functions list.--stacknameNoThe AWS Cloudformation stack name which contains the newrelic-log-ingestion lambda function. If no value is provided, the command searches for the NewRelicLogIngestion stack--excludeor-eNoA function name to exclude while uninstalling subscriptions. Can provide multiple--excludearguments. Only checked whenall,installedandnot-installedare used. Seenewrelic-lambda functions listfor function names.--aws-profileor-pNoThe AWS profile to use for this command. Can also useAWS_PROFILE. Will also checkAWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEYenvironment variables if not using AWS CLI.--aws-regionor-rNoThe AWS region this function is located. Can useAWS_DEFAULT_REGIONenvironment variable. Defaults to AWS session region.DockerNow, you can run newrelic-lambda-cli as a container.dockerbuild-tnewrelic-lambda-cli.
dockerrun-eAWS_PROFILE=your_profile-v$HOME/.aws:/home/newrelic-lambda-cli/.awsnewrelic-lambda-clifunctionslistContributingWe welcome code contributions (in the form of pull requests) from our user community. Before submitting a pull request please reviewthese guidelines.Following these helps us efficiently review and incorporate your contribution and avoid breaking your code with future changes to the agent.Code styleWe use theblackcode formatter.pipinstallblackWe recommend using it withpre-commit:pipinstallpre-commit
pre-commitinstallUsing these together will auto format your git commits.Running Testspythonsetup.pytestTroubleshootingUpgrade the CLI: A good first step, as we push updates frequently.pip3 install --upgrade newrelic-lambda-cliUnrecognizedClientException:(UnrecognizedClientException) when calling the GetFunction operation: The security token included in the request is invalid.If you see this error, it means that specifying the region is necessary, and you need to supply the--aws-regionflag to your command.Unable to locate credentials:Function: None, Region: None, Error: Failed to set up lambda integration: 'Unable to locate credentials. You can configure credentials by running "aws configure".'The AWS profile may not be properly configured; review documentation toConfigure your AWS Profile(make sure the default region is set!).If there are multiple AWS profiles and the correct one is not specified, you can runexport AWS_DEFAULT_PROFILE=MY_OTHER_PROFILEto set the environment variable to the proper profile.SimulatePrincipalPolicy:botocore.errorfactory.InvalidInputException: An error occurred (InvalidInput) when calling the SimulatePrincipalPolicy operation: Invalid Entity Arn: arn:aws:sts::123456789012:assumed-role/u-admin/botocore-session-0987654321 does not clearly define entity type and name.Some AWS accounts can have permission to operate on resources without having access to SimulatePrincipalPolicy.
If this is the case, supply the--no-aws-permissions-checkflag to your command.Error adding new region to integration:Linking New Relic account to AWS account Traceback (most recent call last):   ...   File "/Users/USER/PYTHONPATH/lib/python3.8/site-packages/newrelic_lambda_cli/gql.py", line 131, in link_account     return res["cloudLinkAccount"]["linkedAccounts"][0] IndexError: list index out of rangeThis error can happen if you have an existing AWS integration, and are runningnewrelic-lambda integrations installwith a different--linked-account-name(for instance, to add a new region to the integration). The linked account name can be whatever you want it to be, but needs to be consistent with the previously linked AWS account.AWS Secrets Manager Secret Name ConflictThis CLI manages a AWS Secrets Manager secret with the nameNEW_RELIC_LICENSE_KEY. If
you run into a CloudFormation error reporting that this secret already exists, make
sure that you delete any existing secrets and try again. Keep in mind, by default in the
AWS console when you delete a secret from AWS Secrets Manager that it will not delete
the secret permanently for several days. You will need to perform a "force delete without
recovery" when deleting the secret to avoid this naming conflict.