{"id":24835748,"url":"https://github.com/tobilg/aws-lambda-api-call-recorder","last_synced_at":"2025-10-14T10:30:28.790Z","repository":{"id":57188288,"uuid":"295113103","full_name":"tobilg/aws-lambda-api-call-recorder","owner":"tobilg","description":"A recorder of AWS API calls for Lambda functions","archived":false,"fork":false,"pushed_at":"2020-09-15T06:57:34.000Z","size":23,"stargazers_count":15,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-09-24T05:27:45.218Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tobilg.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-09-13T08:52:46.000Z","updated_at":"2025-02-22T06:09:26.000Z","dependencies_parsed_at":"2022-08-28T13:00:42.101Z","dependency_job_id":null,"html_url":"https://github.com/tobilg/aws-lambda-api-call-recorder","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tobilg/aws-lambda-api-call-recorder","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tobilg%2Faws-lambda-api-call-recorder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tobilg%2Faws-lambda-api-call-recorder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tobilg%2Faws-lambda-api-call-recorder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tobilg%2Faws-lambda-api-call-recorder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tobilg","download_url":"https://codeload.github.com/tobilg/aws-lambda-api-call-recorder/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tobilg%2Faws-lambda-api-call-recorder/sbom","scorecard":{"id":890906,"data":{"date":"2025-08-11","repo":{"name":"github.com/tobilg/aws-lambda-api-call-recorder","commit":"083e8a879758227f7395dcc8a9dd4d6e974afe58"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":2.5,"checks":[{"name":"Code-Review","score":0,"reason":"Found 0/8 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"SAST","score":0,"reason":"no SAST tool detected","details":["Warn: no pull requests merged into dev branch"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":-1,"reason":"no dependencies found","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":6,"reason":"4 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-rrc9-gqf8-8rwg","Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc","Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9","Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-24T11:48:09.270Z","repository_id":57188288,"created_at":"2025-08-24T11:48:09.270Z","updated_at":"2025-08-24T11:48:09.270Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279018780,"owners_count":26086452,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-14T02:00:06.444Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-31T04:51:34.774Z","updated_at":"2025-10-14T10:30:28.509Z","avatar_url":"https://github.com/tobilg.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-lambda-api-call-recorder\nClient and infrastructure for the recording of AWS API calls in Node-based Lambda functions, leveraging AWS Client Side Monitoring.\n\n## Why does this project exist?\n\nMainly curiosity. But also because AWS CloudTrail doesn't record all API calls, thus it's possible to gather more insights how your Lambda functions behave.\n\nAlso, it's possible to determine the latencies of the API calls of different AWS services.\n\n## Client\n\nTo be able to use the client library, you need to have the backend installed in the AWS account you want to record the AWS SDK API calls. Please see the appropriate backend section in this README.\n\n### Installation\n\nTo install the client library, just do the following:\n\n```bash\n$ npm i --save aws-lambda-api-call-recorder\n```\n\n### Usage\n\nTo use the client library, you can wrap you handler function with `ApiCallRecorder`:\n\n```javascript\nconst AWS = require('aws-sdk');\nconst ApiCallRecorder = require('aws-lambda-api-call-recorder');\n\nconst sts = new AWS.STS();\n\nconst handler = async (event, context) =\u003e {\n  console.log(event);\n  console.log(context);\n  const callerIdentity = await sts.getCallerIdentity({}).promise();\n  console.log(callerIdentity);\n  return {\n    statusCode: 200,\n    headers: {\n      'Content-Type': 'application/json'\n    },\n    body: JSON.stringify({\n      ok: true\n    })\n  };\n}\n\nexports.handler = ApiCallRecorder(handler);\n```\n\nAlso, you will have to set the following environment variables to enable the detailled AWS SDK API Call recording:\n\n* `AWS_CSM_ENABLED`: This environment variable should be set to `true` \n* Either `NODE_ENV` needs to be set to `development`, or, in case you want `production`, you can additionally set `API_CALL_RECORDER_IS_ACTIVATED` to `true`\n* `API_CALL_RECORDER_DELIVERY_STREAM_NAME` needs to be set to the name of the Kinesis DeliveryStream. In case you use the Serverless framework and already installed the backend, you should be able to use the backed stack's output for this: `${cf:api-call-recorder-backend-${self:provider.stage}.ApiCallRecorderDeliveryStreamName}`\n\nAlso, make sure that the IAM execution role of your Lambda function has the following permissions to write to the Kinesis Firehose DeliveryStream (this assumes you already have deployed the backend, and the stage is the same as of your Lambda function):\n\n```yaml\n- Effect: Allow\n  Action:\n    - firehose:PutRecordBatch\n  Resource: '${cf:api-call-recorder-backend-${self:provider.stage}.ApiCallRecorderDeliveryStreamArn}'\n```\n\n**Hints**:  \n* Running production workloads with the `APICallRecorder` enabled is not advise, because it will add latency (and hence, costs)\n* The `APICallRecorder` will **NOT** log the final upload of the recorded events to the Firehose DeliveryStream\n\n### How it works\n\nThe client will wrap the Node Lambda function handler, start a UDP server on `localhost` on port `31000`, so that it can receive the published messages of the [AWS Client Side Monitoring](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/metrics.html) (CSM). Once the wrapped handler functions completes, the UDP server will be kept running another 25ms to make sure all API calls can be recorded. After it's shut down, the API calls will be pushed to a Kinesis Firehose DeliveryStream, which will batch the events to gzipped files in S3. \n\nThose files in S3 are then made queryable in Athena by an appropriate Glue Table definition.\n\n## Backend\n\nThe backend needs to be deployed before you can record the API calls.\n\n### Installation\n\nPlease clone the git repo:\n\n```bash\n$ git clone git@github.com:tobilg/aws-lambda-api-call-recorder.git\n```\n\nThen, change to the backend folder:\n\n```bash\n$ cd backend\n```\n\nThe deployment of the backend requires the presence of the [Serverless framework](https://www.serverless.com) on the machine from where the backend should be deployed. Also, you'll need to have your AWS credentials setup accordingly. \n\nIf it's present, you can use a single command to deploy the backend:\n\n```bash\n$ sls deploy\n```\n\n### Query the API call logs\n\nTo query the API call logs, you can use Athena. Please go to the Athena service in the AWS Console, and select the appropriate database from the selection (`api_calls_$STAGE`). Once you've done that, you should see the table `calls` on the left-hand side.\n\nExample query to get the most use API calls filtered by a specific Lambda function:\n\n```sql\nSELECT\n    service,\n    api,\n    avg(latency) as avg_latency,\n    count(*) as call_cnt\nFROM\n    api_calls_dev.calls\nWHERE\n    functionname = 'api-call-recorder-example-dev-test' -- Example\nAND\n    type = 'ApiCall'\nGROUP BY\n    service,\n    api\n```\n\n**Hint:**  \nIf you don't see any data, make sure to run the following SQL command to update the table partitions:\n\n```sql\nMSCK REPAIR TABLE api_calls_dev.calls\n```\n\n## Example project\n\nPlease clone the git repo if you haven't done so already:\n\n```bash\n$ git clone git@github.com:tobilg/aws-lambda-api-call-recorder.git\n```\n\nThen, change to the backend folder:\n\n```bash\n$ cd example\n```\n\nThe deployment of the example stack requires the presence of the [Serverless framework](https://www.serverless.com) on the machine from where the backend should be deployed. Also, you'll need to have your AWS credentials setup accordingly. \n\nIf it's present, you can use a single command to deploy the example stack:\n\n```bash\n$ sls deploy\n```\n\nThe example for a wrapped AWS Lambda function handler can be found at [functions/test.js](example/functions/test.js).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftobilg%2Faws-lambda-api-call-recorder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftobilg%2Faws-lambda-api-call-recorder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftobilg%2Faws-lambda-api-call-recorder/lists"}