🚀 技術調査 - AWS Lambda MicroVMs

{
  "imageName": "my-first-microvm-image",
  "imageArn": "arn:aws:lambda:us-east-1:123456789012:microvm-image:my-first-microvm-image",
  "state": "CREATED",
  "imageVersion": "1.0"
}

{
  "microvmId": "mvm-01234567-abcd-ef01-2345-6789abcdef01",
  "state": "PENDING",
  "endpoint": "mvm-01234567-abcd-ef01-2345-6789abcdef01.lambda-microvm.us-east-1.on.aws"
}

{
  "authToken": {
    "X-aws-proxy-auth": "<JWE token string>"
  }
}

{
  "microvmId": "mvm-01234567-abcd-ef01-2345-6789abcdef01",
  "runHookPayload": "tenant-specific-string"
}

aws s3 mb s3://<bucket-name> --region <region>

aws --version
aws lambda-microvms help

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "lambda.amazonaws.com" },
    "Action": ["sts:AssumeRole", "sts:TagSession"]
  }]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::<bucket-name>/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    }
  ]
}

{
  "Effect": "Allow",
  "Action": [
    "ecr:GetAuthorizationToken",
    "ecr:BatchCheckLayerAvailability",
    "ecr:GetDownloadUrlForLayer",
    "ecr:BatchGetImage"
  ],
  "Resource": "*"
}

aws iam create-role \
  --role-name MicroVMBuildRole \
  --assume-role-policy-document file://trust-policy.json

aws iam put-role-policy \
  --role-name MicroVMBuildRole \
  --policy-name MicroVMBuildPolicy \
  --policy-document file://build-policy.json

aws lambda-microvms list-managed-microvm-images

aws lambda-microvms list-managed-microvm-image-versions \
  --image-identifier arn:aws:lambda:<region>:aws:microvm-image:al2023-1

FROM public.ecr.aws/lambda/microvms:al2023-minimal
RUN dnf install -y python3 python3-pip && dnf clean all
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY app.py .
EXPOSE 8080
CMD ["gunicorn", "--bind", "0.0.0.0:8080", "app:app"]

FROM node:24-alpine
WORKDIR /app
COPY app.js .
EXPOSE 8080
CMD ["node", "app.js"]

zip app.zip app.py requirements.txt Dockerfile
aws s3 cp app.zip s3://<bucket-name>/app.zip

aws lambda-microvms create-microvm-image \
  --name <image-name> \
  --code-artifact uri=s3://<bucket-name>/app.zip \
  --base-image-arn arn:aws:lambda:<region>:aws:microvm-image:al2023-1 \
  --build-role-arn arn:aws:iam::<account-id>:role/MicroVMBuildRole \
  --region <region>

aws lambda-microvms create-microvm-image \
  --name my-microvm-image \
  --code-artifact uri=s3://<bucket-name>/app.zip \
  --base-image-arn arn:aws:lambda:<region>:aws:microvm-image:al2023-1 \
  --build-role-arn arn:aws:iam::<account-id>:role/MicroVMBuildRole \
  --hooks 'hookPort=8080,readyTimeoutInSeconds=300,validateTimeoutInSeconds=120'

while true; do
  STATE=$(aws lambda-microvms get-microvm-image \
    --image-identifier arn:aws:lambda:<region>:<account-id>:microvm-image:<image-name> \
    --query 'state' --output text)
  echo "$(date +%H:%M:%S) $STATE"
  [ "$STATE" = "CREATED" ] && break
  sleep 10
done

aws lambda-microvms run-microvm \
  --image-identifier arn:aws:lambda:<region>:<account-id>:microvm-image:<image-name> \
  --ingress-network-connectors "arn:aws:lambda:<region>:aws:network-connector:aws-network-connector:ALL_INGRESS" \
  --egress-network-connectors "arn:aws:lambda:<region>:aws:network-connector:aws-network-connector:INTERNET_EGRESS" \
  --idle-policy '{"autoResumeEnabled":true,"maxIdleDurationSeconds":900,"suspendedDurationSeconds":300}' \
  --maximum-duration-in-seconds 14400 \
  --region <region>

aws lambda-microvms get-microvm \
  --microvm-identifier <microvm-id>

aws lambda-microvms wait microvm-state-running \
  --microvm-identifier <microvm-id>

aws lambda-microvms list-microvms

aws lambda-microvms list-microvms \
  --image-identifier <image-name> \
  --image-version 1.0

aws lambda-microvms create-microvm-auth-token \
  --microvm-identifier <microvm-id> \
  --expiration-in-minutes 30 \
  --allowed-ports '[{"allPorts":{}}]'

TOKEN=$(aws lambda-microvms create-microvm-auth-token \
  --microvm-identifier <microvm-id> \
  --expiration-in-minutes 30 \
  --allowed-ports '[{"port":8080}]' \
  --query 'authToken."X-aws-proxy-auth"' \
  --output text)

curl "https://<microvm-id>.lambda-microvm.<region>.on.aws/" \
  -H "X-aws-proxy-auth: <TOKEN>" \
  -H "X-aws-proxy-port: 8080"

import boto3
import requests

client = boto3.client("lambda-microvms")

run_resp = client.run_microvm(
    imageIdentifier="arn:aws:lambda:us-east-1:123456789012:microvm-image:my-image",
    idlePolicy={
        "autoResumeEnabled": True,
        "maxIdleDurationSeconds": 900,
        "suspendedDurationSeconds": 300
    }
)
microvm_id = run_resp["microvmId"]
endpoint = run_resp["endpoint"]

# RUNNING 状態になるまでポーリング待機 (boto3 waiter 名は公式未確認のため明示ポーリング)
import time
while True:
    state = client.get_microvm(microvmIdentifier=microvm_id)["state"]
    if state == "RUNNING":
        break
    if state in {"TERMINATING", "TERMINATED"}:
        raise RuntimeError(f"MicroVM failed to reach RUNNING: state={state}")
    time.sleep(2)

token_resp = client.create_microvm_auth_token(
    microvmIdentifier=microvm_id,
    expirationInMinutes=30,
    allowedPorts=[{"allPorts": {}}]
)
token = token_resp["authToken"]["X-aws-proxy-auth"]

resp = requests.get(
    f"https://{endpoint}/health",
    headers={"X-aws-proxy-auth": token}
)
print(resp.status_code, resp.json())

import {
  LambdaMicrovmsClient,
  RunMicrovmCommand,
  CreateMicrovmAuthTokenCommand
} from "@aws-sdk/client-lambda-microvms";

const client = new LambdaMicrovmsClient({});

const { microvmId, endpoint } = await client.send(new RunMicrovmCommand({
  imageIdentifier: "arn:aws:lambda:us-east-1:123456789012:microvm-image:my-image",
  idlePolicy: {
    autoResumeEnabled: true,
    maxIdleDurationSeconds: 900,
    suspendedDurationSeconds: 300
  }
}));

const { authToken } = await client.send(new CreateMicrovmAuthTokenCommand({
  microvmIdentifier: microvmId,
  expirationInMinutes: 30,
  allowedPorts: [{ allPorts: {} }]
}));

const resp = await fetch(`https://${endpoint}/health`, {
  headers: { "X-aws-proxy-auth": authToken["X-aws-proxy-auth"] }
});
console.log(await resp.json());

const protocols = [
  "lambda-microvms",
  `lambda-microvms.authentication.<TOKEN>`,
  "lambda-microvms.port.9000"
];
const ws = new WebSocket(`wss://<microvm-endpoint>/path`, protocols);

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CreateENI",
      "Effect": "Allow",
      "Action": "ec2:CreateNetworkInterface",
      "Resource": [
        "arn:aws:ec2:*:*:network-interface/*",
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:security-group/*"
      ]
    },
    {
      "Sid": "TagENI",
      "Effect": "Allow",
      "Action": "ec2:CreateTags",
      "Resource": "arn:aws:ec2:*:*:network-interface/*",
      "Condition": {
        "StringEquals": {
          "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com"
        }
      }
    }
  ]
}

aws lambda-core create-network-connector \
  --name my-vpc-connector \
  --configuration '{
    "VpcEgressConfiguration": {
      "SubnetIds": ["<subnet-id>"],
      "SecurityGroupIds": ["<sg-id>"],
      "NetworkProtocol": "IPv4",
      "AssociatedComputeResourceTypes": ["MicroVm"]
    }
  }' \
  --operator-role arn:aws:iam::<account-id>:role/NetworkConnectorOperatorRole

aws lambda-microvms run-microvm \
  --image-identifier arn:aws:lambda:<region>:<account-id>:microvm-image:<image-name> \
  --egress-network-connectors <connector-arn> \
  --idle-policy '{"maxIdleDurationSeconds":900,"suspendedDurationSeconds":1800,"autoResumeEnabled":false}'

aws lambda-microvms update-microvm-image \
  --image-identifier arn:aws:lambda:<region>:<account-id>:microvm-image:<image-name> \
  --code-artifact uri=s3://<bucket-name>/app-v2.zip \
  --base-image-arn arn:aws:lambda:<region>:aws:microvm-image:al2023-1 \
  --build-role-arn arn:aws:iam::<account-id>:role/MicroVMBuildRole \
  --description "v2 アプリケーションコードに更新"

aws lambda-microvms update-microvm-image-version \
  --image-identifier <image-name> \
  --image-version 1.0 \
  --state INACTIVE

aws lambda-microvms delete-microvm-image \
  --image-identifier arn:aws:lambda:<region>:<account-id>:microvm-image:<image-name>

aws lambda-microvms terminate-microvm \
  --microvm-identifier <microvm-id>

aws lambda-microvms delete-microvm-image \
  --image-identifier arn:aws:lambda:<region>:<account-id>:microvm-image:<image-name>

aws s3 rm s3://<bucket-name> --recursive
aws s3 rb s3://<bucket-name>

aws iam delete-role-policy \
  --role-name MicroVMBuildRole \
  --policy-name MicroVMBuildPolicy
aws iam delete-role --role-name MicroVMBuildRole

aws lambda-microvms suspend-microvm \
  --microvm-identifier <microvm-id>

aws lambda-microvms resume-microvm \
  --microvm-identifier <microvm-id>

aws lambda-microvms terminate-microvm \
  --microvm-identifier <microvm-id>

aws logs tail /aws/lambda/microvms/my-microvm-image --follow

from aws_xray_sdk.core import xray_recorder, patch_all
from aws_xray_sdk.ext.flask.middleware import XRayMiddleware

patch_all()  # boto3 / requests / sqlalchemy 等を自動計装
app = Flask(__name__)
xray_recorder.configure(service="my-microvm-app", sampling=True)
XRayMiddleware(app, xray_recorder)

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["xray:PutTraceSegments", "xray:PutTelemetryRecords"],
    "Resource": "*"
  }]
}

aws lambda-microvms update-microvm-image \
  --image-identifier <image-arn> \
  --base-image-arn arn:aws:lambda:<region>:aws:microvm-image:al2023-1 \
  --build-role-arn <build-role-arn>

月間ストレージ料金 = snapshotSizeGB × $0.08 × (suspend 時間/月 ÷ 730h)

例: 2.5 GB の snapshot × $0.08 × (240h/730h) = 約 $0.066 / MicroVM

aws lambda-microvms run-microvm \
  --image-identifier <image-arn> \
  --run-hook-payload '{"tenantId":"tenant-abc","sessionToken":"..."}' \
  --idle-policy '{"autoResumeEnabled":true,"maxIdleDurationSeconds":300,"suspendedDurationSeconds":900}'

@app.post("/aws/lambda-microvms/runtime/v1/validate")
async def validate():
    await process_mock_request()
    return {"status": "ok"}

name: Deploy MicroVM Image
on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
          aws-region: us-east-1

      - name: Package and upload artifacts
        run: |
          zip -r artifact.zip Dockerfile app/
          aws s3 cp artifact.zip s3://my-bucket/deployments/app-${{ github.sha }}.zip

      - name: Update MicroVM image
        run: |
          aws lambda-microvms update-microvm-image \
            --image-identifier arn:aws:lambda:us-east-1:123456789012:microvm-image:my-sandbox \
            --code-artifact uri=s3://my-bucket/deployments/app-${{ github.sha }}.zip \
            --base-image-arn arn:aws:lambda:us-east-1:aws:microvm-image:al2023-1 \
            --build-role-arn arn:aws:iam::123456789012:role/MicrovmBuildRole \
            --description "Deploy ${{ github.sha }}"

      - name: Wait for build completion
        run: |
          aws lambda-microvms wait microvm-image-version-successful \
            --image-identifier arn:aws:lambda:us-east-1:123456789012:microvm-image:my-sandbox

version: 0.2
phases:
  pre_build:
    commands:
      - zip -r artifact.zip Dockerfile app/
      - aws s3 cp artifact.zip s3://$ARTIFACT_BUCKET/app-$CODEBUILD_RESOLVED_SOURCE_VERSION.zip
  build:
    commands:
      - aws lambda-microvms update-microvm-image
          --image-identifier $IMAGE_ARN
          --code-artifact uri=s3://$ARTIFACT_BUCKET/app-$CODEBUILD_RESOLVED_SOURCE_VERSION.zip
          --base-image-arn $BASE_IMAGE_ARN
          --build-role-arn $BUILD_ROLE_ARN

aws cloudtrail start-query \
  --query-statement "SELECT eventName, userIdentity.arn, requestParameters FROM <event-data-store-id> WHERE eventSource = 'lambda-microvms.amazonaws.com' AND eventTime > '2026-06-22T00:00:00Z'"

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=lambda-microvms.amazonaws.com