Project: Gloo (Orchestration & Management / API Gateway)
File: filter.proto.sk.md

title: "filter.proto" weight: 5 <!-- Code generated by solo-kit. DO NOT EDIT. --> AWS Lambda contains the configuration necessary to perform transform regular http calls to AWS Lambda invocations. ```yaml "name": string "qualifier": string "async": bool "emptyBodyOverride": .google.protobuf.StringValue "unwrapAsAlb": bool "transformerConfig": .solo.io.envoy.config.core.v3.TypedExtensionConfig "requestTransformerConfig": .solo.io.envoy.config.core.v3.TypedExtensionConfig ``` | Field | Type | Description | | -- | - | -- | | `name` | `string` | The name of the function. | | `qualifier` | `string` | The qualifier of the function (defaults to $LATEST if not specified). | | `async` | `bool` | Invocation type - async or regular. | | `emptyBodyOverride` | | Optional default body if the body is empty. By default on default body is used if the body empty, and an empty body will be sent upstream. | | `unwrapAsAlb` | `bool` | Deprecated. Use transformer_config to specify an AWS Lambda response transformer instead. Unwrap responses as AWS ALB does. Expects json lambda responses to construct response. Intended to ease migration when previously using alb to invoke Lambdas. When set on a route the filter will not stream data on the encoding step. For further information see below link for the expected format when true. https://docs.aws.amazon.com/elasticloadbalancing/latest/application/lambda-functions.html Defaults to false. | | `transformerConfig` | | transformer configuration used to process response data cannot be configured simultaneously with unwrapasalb. | | `requestTransformerConfig` | | This is a transformer config, as defined in api.envoy.config.filter.http.transformation.v2 used to process request data. | ```yaml "host": string "region": string "accessKey": string "secretKey": string "sessionToken": string "roleArn": string "disableRoleChaining": bool ``` | Field | Type | Description | | -- | - | -- | | `host` | `string` | The host header for AWS this cluster. | | `region` | `string` | The region for this cluster. | | `accessKey` | `string` | The access_key for AWS this cluster. | | `secretKey` | `string` | The secret_key for AWS this cluster. | | `sessionToken` | `string` | The session_token for AWS this cluster. | | `roleArn` | `string` | The role_arn to use when generating credentials for the mounted projected SA token. | | `disableRoleChaining` | `bool` | Optional override to disable role chaining;. | ```yaml "useDefaultCredentials": .google.protobuf.BoolValue "serviceAccountCredentials": .envoy.config.filter.http.aws_lambda.v2.AWSLambdaConfig.ServiceAccountCredentials "propagateOriginalRouting": bool "credentialRefreshDelay": .google.protobuf.Duration ``` | Field | Type | Description | | -- | - | -- | | `useDefaultCredentials` | | Use AWS default credentials chain to get

This will search environment variables, ECS metadata and instance metadata to get the credentials. credentials will be rotated automatically. If credentials are provided on the cluster (using the AWSLambdaProtocolExtension), it will override these credentials. This defaults to false, but may change in the future to true. Only one of `useDefaultCredentials` or `serviceAccountCredentials` can be set. | | `serviceAccountCredentials` | | Use projected service account token, and role arn to create temporary credentials with which to authenticate lambda requests. This functionality is meant to work along side EKS service account to IAM binding functionality as outlined here: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html If the following environment values are not present, this option cannot be used. 1. AWSWEBIDENTITYTOKENFILE 2. AWSROLEARN If they are not specified envoy will NACK the config update, which will show up in the logs when running OS Gloo. When running Gloo enterprise it will be reflected in the prometheus stat: "glooe.solo.io/xds/nack" The role arn may also be specified in the `AWSLambdaProtocolExtension` on the cluster level, to override the environment variable. Only one of `serviceAccountCredentials` or `useDefaultCredentials` can be set. | | `propagateOriginalRouting` | `bool` | Send downstream path and method as `x-envoy-original-path` and `x-envoy-original-method` headers on the request to AWS lambda. Defaults to false. | | `credentialRefreshDelay` | | Sets cadence for refreshing credentials for Service Account. Does nothing if Service account is not set. Does not affect the default filewatch for service account only augments it. Defaults to not refreshing on time period. Suggested is 15 minutes. | In order to specify the aws sts endpoint, both the cluster and uri must be set. This is due to an envoy limitation which cannot infer the host or path from the cluster, and therefore must be explicitly specified via the uri ```yaml "cluster": string "uri": string "timeout": .google.protobuf.Duration "region": string ``` | Field | Type | Description | | -- | - | -- | | `cluster` | `string` | The name of the envoy cluster which represents the desired aws sts endpoint. | | `uri` | `string` | The full uri of the aws sts endpoint. | | `timeout` | | timeout for the request. | | `region` | `string` | Region for the sts endpoint. Defaults to us-east-1. | ```yaml ``` | Field | Type | Description | | -- | - | -- | <!-- Start of HubSpot Embed Code --> <script type="text/javascript" id="hs-script-loader" async defer src="//js.hs-scripts.com/5130874.js"></script> <!-- End of HubSpot Embed Code -->