Upgrade
This topic provides instructions for upgrading the Upwind components for AWS Lambda. Upwind provides newer versions so you can keep your environment up-to-date. Newer versions can include bug fixes, security enhancements, and other improvements for the Upwind components.
Upgrading the Upwind Cluster Manager
Follow these steps to upgrade the Upwind Cluster Manager via Terraform.
-
Navigate to the directory for your Terraform project in your terminal. This directory contains your current Terraform configuration.
cd /path/to/my-terraform-project -
Open the
main.tffile within this directory. -
Locate the
upwind_integration_aws_ecs_utility_clustermodule block within themain.tffile. Update the source variable to point to the new module source path. For example:module "upwind_integration_aws_ecs_utility_cluster" {
source = "https://get.upwind.io/.../[OLD].tar.gz"
source = "https://get.upwind.io/.../[NEW].tar.gz"
}noteThe URL of the latest module source can be found in the Terraform setup section under Components → Integrations in the Upwind Management Console. All Terraform modules will be migrated to the Terraform Registry in the future, allowing the use of Version Constraints .
-
Before proceeding, ensure the configuration settings are tailored to your environment.
-
Run the following command to initialize Terraform within the project directory:
terraform init -upgrade -
Run the following command to apply the Terraform configuration and update the necessary resources:
terraform apply -
Review the changes that Terraform plans to make and enter
yeswhen prompted to confirm the changes. Terraform will update the necessary infrastructure and resources in your AWS account to upgrade the Upwind components, based on the provided configuration. -
Once the
terraform applycommand has successfully executed, the necessary infrastructure and resources should be upgraded within a few moments.
Verify upgrade success
To verify that the upgrade was successful, run the following command:
aws ecs describe-services \
--cluster [your-cluster-name] \
--services upwind-cluster-manager
Expected output (simplified):
[
{
"serviceName": "upwind-cluster-manager",
"status": "ACTIVE",
"desiredCount": 1,
"runningCount": 1,
"deployments": [
{
"status": "PRIMARY",
"desiredCount": 1,
"runningCount": 1,
"createdAt": "<recent timestamp>",
"rolloutState": "COMPLETED"
}
]
}
]
Upgrading Lambda functions
This section describes how to upgrade the Upwind Lambda Tracer extension in your Lambda functions. The steps differ based on if the Lambda function is deployed as a .zip archive or container.
- .zip archive
- Container
You can use the upwindctl tool to easily upgrade .zip archive Lambda functions.
Install upwindctl
curl -s https://get.upwind.io/upwindctl.sh | sh
To add upwindctl to your PATH, append this line to your shell config:
. "$HOME/.upwindctl/env"
To upgrade upwindctl you can simply re-run the installation command:
curl -s https://get.upwind.io/upwindctl.sh | sh
Upgrade Lambda functions
To configure Lambda functions to communicate with an Upwind Cluster Manager you can provide the --report-to-cluster-manager flag to the lambda list and lambda instrument commands.
The upwindctl lambda list command will show a list of Lambda functions, along with an indication of if they are instrumented, and if they are up to date or not:
upwindctl lambda list
You can also use a filter to only show Lambda functions that have an update available:
upwindctl lambda list --update-available
Upgrading the Upwind Lambda Tracer extension in Lambda functions can be done by simply re-running the upwindctl lambda instrument command.
To upgrade a specific function by name:
upwindctl lambda instrument --function-name my-lambda-function
To operate on multiple Lambda functions you can use the --bulk flag, a confirmation prompt will appear before taking any action.
upwindctl lambda instrument --bulk
To upgrade only functions which are already instrumented and have an update available:
upwindctl lambda instrument --bulk --update-available
Note that the upwindctl tool offers a number of other options, such as filtering functions by VPC ID or tags:
upwindctl lambda instrument --bulk --vpc-id vpc-XXX
upwindctl lambda instrument --bulk --tags Key=some-tag,Values=some-value
To see a list of available configuration options you can run e.g.:
upwindctl lambda instrument -h
Manual instrumentation of Lambda functions
If you prefer to use another method such as Terraform to manage function configurations you can follow these steps:
- Run the following command to get the latest Upwind Lambda Tracer layer ARN:
upwindctl lambda show-latest-versions --aws-region $LAMBDA_FUNCTION_REGION
This will show the ARN of the latest Upwind Lambda Tracer layer, for both amd64 (X86_64) and arm64. Note that the ARNs are region specific, so make sure the region matches the region your Lambda functions reside in. You can use the --aws-region flag to specify a region explicitly.
- Update the layer in the Lambda function configuration, by ARN
- Make sure that the
AWS_LAMBDA_EXEC_WRAPPERenvironment variable is set in the Lambda function configuration:
AWS_LAMBDA_EXEC_WRAPPER=/opt/bin/upwind-tracer.sh
To upgrade the Upwind Lambda Tracer extension in a containerized Lambda function you need to re-build the function's container image, using a new version of the Lambda Tracer image. You can find the latest version in the instrumentation documentation.
Update your Dockerfile
Below is a simple example of a Dockerfile update:
# (a) Add the Upwind Lambda Tracer image as a build stage
FROM public.ecr.aws/upwindsecurity/images/lambda-tracer:<OLD VERSION> AS upwind-lambda-tracer
FROM public.ecr.aws/upwindsecurity/images/lambda-tracer:<NEW VERSION> AS upwind-lambda-tracer
# Use an official AWS Lambda base image, in this example Python 3.12
FROM public.ecr.aws/lambda/python:3.12
# (b) Copy Upwind Lambda Tracer extension into image
COPY /opt /opt
# (c) Set the AWS_LAMBDA_EXEC_WRAPPER environment variable
# This can be done directly in the Dockerfile or via function configuration
ENV AWS_LAMBDA_EXEC_WRAPPER=/opt/bin/upwind-tracer.sh
# The rest is regular Lambda function image build
COPY requirements.txt ${LAMBDA_TASK_ROOT}/
RUN pip install -r requirements.txt
COPY app.py ${LAMBDA_TASK_ROOT}/
CMD [ "app.handler" ]
Build and push image
After building the image it needs to be pushed to a container registry like Amazon ECR.
Update Lambda function configuration
Update the Lambda function configuration to use the new container image.