AWS API Gateway Integration

{"requestId":"$context.requestId","httpMethod":"$context.httpMethod","path":"$context.path","resourcePath":"$context.resourcePath","status":"$context.status","responseLength":"$context.responseLength","responseLatency":"$context.responseLatency","apiKey":"$context.identity.apiKey","caller":"$context.identity.caller","sourceIp":"$context.identity.sourceIp","userAgent":"$context.identity.userAgent","apiId":"$context.apiId","stage":"$context.stage"}

# Clone the SDK distribution repo and enter the AWS Lambda folder
git clone https://github.com/aforoai/SDKs.git
cd SDKs/aforo-gateway-plugins/aws-lambda

# Build and deploy with SAM (template.yaml is in this folder)
sam build
sam deploy --guided \
  --parameter-overrides \
    AforoEndpoint=https://api.aforo.ai/v1/ingest/batch \
    AforoApiKey="$AFORO_API_KEY" \
    AforoTenantId="$AFORO_TENANT_ID" \
    ApiGatewayLogGroupName=/aws/apigateway/aforo-access-logs

const https = require('https');
const zlib = require('zlib');
const { SecretsManagerClient, GetSecretValueCommand } = require('@aws-sdk/client-secrets-manager');

const sm = new SecretsManagerClient({ region: process.env.AWS_REGION });

// Cache the Aforo API key for the lifetime of the Lambda execution context
let cachedApiKey = null;

async function getAforoApiKey() {
  if (cachedApiKey) return cachedApiKey;
  const resp = await sm.send(new GetSecretValueCommand({ SecretId: 'aforo/api-key' }));
  cachedApiKey = JSON.parse(resp.SecretString).apiKey;
  return cachedApiKey;
}

exports.handler = async (event) => {
  // Decode and decompress the CloudWatch Logs payload
  const payload = Buffer.from(event.awslogs.data, 'base64');
  const decompressed = zlib.gunzipSync(payload).toString('utf8');
  const logData = JSON.parse(decompressed);

  const apiKey = await getAforoApiKey();
  const usageEvents = [];

  for (const logEvent of logData.logEvents) {
    const parsed = parseApiGatewayLog(logEvent.message);
    if (!parsed) continue;

    usageEvents.push({
      customerId: parsed.customerId,       // resolved from the API key / consumer
      metricName: 'api_calls',             // a billable unit defined in your dashboard
      quantity: 1,
      occurredAt: new Date(logEvent.timestamp).toISOString(),
      metadata: {
        method: parsed.method,
        path: parsed.path,
        statusCode: parsed.status,
        latencyMs: parsed.latency,
        requestId: parsed.requestId,
      },
    });
  }

  if (usageEvents.length === 0) return { statusCode: 200, body: 'no events' };

  // Batch POST to Aforo ingest
  await ingestEvents(apiKey, usageEvents);
  return { statusCode: 200, body: `ingested ${usageEvents.length} events` };
};

function parseApiGatewayLog(message) {
  // API Gateway execution log format:
  // Method: GET, Resource: /search, Stage: prod, ...
  const methodMatch = message.match(/Method: (\w+)/);
  const resourceMatch = message.match(/Resource: ([^,]+)/);
  const statusMatch = message.match(/Status: (\d+)/);
  const latencyMatch = message.match(/Integration latency: (\d+)/);
  const customerMatch = message.match(/Api-Key: ([^,\s]+)/);
  const requestIdMatch = message.match(/RequestId: ([a-f0-9-]+)/);

  if (!methodMatch || !customerMatch) return null;

  return {
    method: methodMatch[1],
    path: resourceMatch?.[1]?.trim() ?? '/',
    status: parseInt(statusMatch?.[1] ?? '200'),
    latency: parseInt(latencyMatch?.[1] ?? '0'),
    customerId: customerMatch[1],
    requestId: requestIdMatch?.[1] ?? '',
  };
}

async function ingestEvents(apiKey, events) {
  return new Promise((resolve, reject) => {
    const body = JSON.stringify({ events });
    const options = {
      hostname: 'api.aforo.ai',
      path: '/v1/ingest/batch',
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-API-Key': apiKey,
        'Content-Length': Buffer.byteLength(body),
        'X-Idempotency-Key': require('crypto').randomUUID(),
      },
    };

    const req = https.request(options, (res) => {
      res.on('data', () => {});
      res.on('end', resolve);
    });
    req.on('error', reject);
    req.write(body);
    req.end();
  });
}

# Enable execution logging on the stage (required if not already set)
aws apigateway update-stage \
  --rest-api-id YOUR_API_ID \
  --stage-name prod \
  --patch-operations \
    op=replace,path=/accessLogSettings/destinationArn,value=arn:aws:logs:REGION:ACCOUNT:log-group:API-GW-Execution-Logs_YOUR_API_ID/prod \
    op=replace,path=/*/*/logging/loglevel,value=INFO \
    op=replace,path=/*/*/logging/dataTrace,value=true

# Note the log group name — it follows this pattern:
echo "Log group: API-Gateway-Execution-Logs_YOUR_API_ID/prod"

# Get the Lambda ARN from the previous deploy step
LAMBDA_ARN=$(aws lambda get-function --function-name aforo-metering-aws   --query 'Configuration.FunctionArn' --output text)

# Add permission for CloudWatch to invoke the Lambda
aws lambda add-permission \
  --function-name aforo-metering-aws \
  --statement-id cloudwatch-subscription \
  --action lambda:InvokeFunction \
  --principal logs.amazonaws.com \
  --source-arn arn:aws:logs:REGION:ACCOUNT:log-group:API-Gateway-Execution-Logs_YOUR_API_ID/prod:*

# Create the subscription filter
aws logs put-subscription-filter \
  --log-group-name "API-Gateway-Execution-Logs_YOUR_API_ID/prod" \
  --filter-name "aforo-metering" \
  --filter-pattern "[method, resource, stage, status, latency, integrationStatus, ...]" \
  --destination-arn "$LAMBDA_ARN"

sam deploy \
  --parameter-overrides \
    StatusOutcomes="404=SUCCESS,429=ERROR"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudWatchLogs",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/aforo-metering-aws:*"
    },
    {
      "Sid": "SecretsManagerReadAforoKey",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT:secret:aforo/api-key-*"
    },
    {
      "Sid": "XRayTracing",
      "Effect": "Allow",
      "Action": [
        "xray:PutTraceSegments",
        "xray:PutTelemetryRecords"
      ],
      "Resource": "*"
    }
  ]
}

# Create the trust policy for Lambda
cat > trust-policy.json <<'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "lambda.amazonaws.com" },
    "Action": "sts:AssumeRole"
  }]
}
EOF

# Create the role
aws iam create-role \
  --role-name aforo-metering-lambda-role \
  --assume-role-policy-document file://trust-policy.json

# Attach the custom policy
aws iam put-role-policy \
  --role-name aforo-metering-lambda-role \
  --policy-name aforo-metering-permissions \
  --policy-document file://aforo-metering-lambda-policy.json

# Store the Aforo API key in Secrets Manager
aws secretsmanager create-secret \
  --name "aforo/api-key" \
  --secret-string '{"apiKey":"sk_live_your_key_here"}'

# Get the role ARN
ROLE_ARN=$(aws iam get-role --role-name aforo-metering-lambda-role   --query 'Role.Arn' --output text)

# Create the Lambda function
aws lambda create-function \
  --function-name aforo-metering-aws \
  --runtime nodejs20.x \
  --handler index.handler \
  --role "$ROLE_ARN" \
  --zip-file fileb://aforo-metering.zip \
  --timeout 30 \
  --memory-size 256 \
  --environment Variables="{AWS_REGION=$(aws configure get region)}" \
  --tracing-config Mode=Active

# Verify function is active
aws lambda get-function-configuration \
  --function-name aforo-metering-aws \
  --query '{State: State, Runtime: Runtime, MemorySize: MemorySize}'

# Make a request through your API Gateway stage
curl -v "https://YOUR_API_ID.execute-api.REGION.amazonaws.com/prod/your-endpoint" \
  -H "X-Tenant-Id: test_tenant_123" \
  -H "Authorization: Bearer your_customer_api_key"

# Check Lambda logs for successful event forwarding
aws logs tail /aws/lambda/aforo-metering-aws --follow --format short

# Expected log output:
# ingested 1 events
# POST https://api.aforo.ai/v1/ingest/batch → 200 OK

# Then confirm it arrived: in Aforo, open Intelligence → Usage Ingestion.
# The event shows up once the plugin has sent it (batching plugins flush every few seconds).