Forem: Nori

Serverless Practice: Sending Trello Reminders to Your WhatsApp Using AWS

Nori — Wed, 21 Jan 2026 01:47:04 +0000

By Eliana Pérez
This solution enables you to receive WhatsApp notifications for Trello alerts, specifically for cards with an assigned due date.

Scenario

I needed a way to better organize my personal projects, including preparing for my AWS certification, managing medical appointments, social meetings, and various other tasks. With so many apps to juggle for work and multiple email accounts, I often missed or muted notifications from tools like Google Calendar. As a result, I frequently found myself forgetting important tasks.

Then it hit me: What app do I use every day that truly grabs my attention? The answer was clear—WhatsApp. For me, it’s the central hub for communication. Whenever I need to check something, I open WhatsApp and see all the tasks I still need to complete. After exploring the Trello integrations and power-ups, I found that the WhatsApp-to-Trello power-ups were charging 4 euros per month for each number, which would cost me 88 euros a year. That’s when I decided to create my own solution, practice serverless, and experiment with ways to minimize costs.

This solution uses the following workflow:

Scenario 1: Assign a new due date to a specific card.

The user assigns a due date to a card.
Trello webhooks send a POST request to our callback URL.
The API Gateway receives the request and sends it to our Step Function.
The Step Function filters the event for the 'update card' action and the 'due_date' sub-action.
The Step Function triggers the Lambda function 'Create Event Scheduler'. This Lambda function creates a DynamoDB record with the card information and due date for the WhatsApp notification. It also uses the AWS SDK to create the EventBridge scheduler and stores the scheduler ARN in the DynamoDB.
When the scheduler is triggered, it invokes the Notification WhatsApp lambda function, which uses a WhatsApp template that was previously created. This template invokes the Meta API to send the notification to my WhatsApp number.

Scenario 2: Update the due date for a specific card.

The user updates the due date of a card.
Trello webhooks send a POST request to our callback URL.
The API Gateway receives the request and sends it to our Step Function.
The Step Function filters the event for the 'update card' action and the 'due_date' sub-action.
The Step Function triggers the Lambda function Create Event Scheduler, which checks if a record with a card ID already exists in DynamoDB. If so, only update the record with the new due date.
The DynamoDB table is configured with DynamoDB Streams associated with the Lambda Update Scheduler EventBridge, which is triggered only when the specified attribute 'due_date' is modified. This Lambda updates the scheduler with the new date for the notification.
When the scheduler is triggered, it invokes the Notification WhatsApp lambda function, which uses a WhatsApp template that was previously created and invokes the Meta API to send the notification to my WhatsApp number.

Pre-requirements

Trello Board created and some cards for testing
Whatsapp number to receive notifications
Meta developer account
AWS Account created and Admin Access.

Trello Configuration

To create a Power-Up, click on this link to access the Trello Power-Ups admin panel. On this page click on new.

Power-Up creation

Creating a New Power-Up

When creating a new Power-Up, you'll need to fill in the following fields:

App name: Enter a name for your Power-Up (e.g., "Whatsapp Trello Notifications")
Workspace: Select the workspace where you want to use this Power-Up (e.g., "work tasks")
Email: Enter the email address associated with your Trello account
Support contact: Provide a support email address where users can reach you. You can use the same email as above if preferred
Author: Enter the name of the author or your company name
Iframe connector URL: Leave this field empty since this solution does not use any graphical user interface

Once you've filled in all the required information, click the Create button to proceed with the Power-Up creation.

API Configuration

Once you've created the Power-Up, you will be redirected to the admin page where you can view your new Power-Up. Click on it to proceed with the next configuration steps.

When you are here please key in the API-KEY section.

Securely store your API Key and Secret—these credentials are required to interact with the Trello API. My recomendation use AWS Secret Manager

Webhook Setup

Now that you have the credentials, we need to create a Trello Webhook to receive all events from your Trello dashboard.

One of the requirements to create a webhook is having a callback URL. Trello will send a HEAD request to the endpoint you specify and will wait for a 200 response code to create and activate the webhook.

For more detailed information, please refer to the Trello Official Documentation.

To obtain your Callback URL, follow these steps:

Import an AWS API Gateway
Create an endpoint /events with the HTTP HEAD method and integrate it with a Lambda function that returns a 200 response code.

Go to your AWS Account and select API Gateway, create a new API Gateway and select the import option in the section REST API. Use the following JSON specification:

To obtain your Callback URL, follow these steps:

Go to your AWS Account and navigate to API Gateway
Click on Create API and select REST API
Choose Import from Swagger option
Copy and paste the following JSON specification in the import dialog:
Click on CREATE API

{
  "swagger": "2.0",
  "info": {
    "description": "API created to send WhatsApp reminders for Trello tasks that need to be completed or to trigger reminders",
    "version": "2026-01-01T10:58:10Z",
    "title": "trelloWhatsapp notification"
  },
  "basePath": "/events",
  "schemes": [
    "https"
  ],
  "paths": {
    "/events": {
      "head": {
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "200 response",
            "schema": {
              "$ref": "#/definitions/Empty"
            }
          }
        }
      },
      "post": {
        "consumes": [
          "application/json"
        ],
        "produces": [
          "application/json"
        ],
        "responses": {
          "200": {
            "description": "200 response",
            "schema": {
              "$ref": "#/definitions/Empty"
            }
          }
        }
      }
    }
  },
  "definitions": {
    "Empty": {
      "type": "object",
      "title": "Empty Schema"
    }
  },
  "x-amazon-apigateway-security-policy": "SecurityPolicy_TLS13_1_3_2025_09",
  "x-amazon-apigateway-endpoint-access-mode": "BASIC"
}

Now you need to create a Lambda function that will respond to the HEAD request from Trello with a 200 status code.

Follow these steps:

Go to your AWS Account and navigate to Lambda
Click on Create function
Select Author from scratch
Configure the following:
- Function name: Enter a name for your Lambda function (e.g., lambda-response-head-trello)
- Runtime: Select your preferred runtime language. This example uses Python 3.x, but you can choose any supported language
- Architecture: Select x86_64
Click Create function

Once the function is created, you'll use the default code provided by AWS, which is sufficient for responding to Trello's HEAD request verification.

Now you need to integrate the Lambda function you just created with the API Gateway HEAD endpoint.

Follow these steps:

Go back to your API Gateway console
Select the HEAD endpoint under /events
Click on Edit integration

In the integration configuration page:
- Select Lambda as the integration type
- Choose the Lambda function you created in the previous step (lambda-response-head-trello)
- Click Save

Once saved, your API Gateway HEAD endpoint is now integrated with your Lambda function. This will allow Trello to verify your webhook callback URL by receiving a 200 response.

Now you need to deploy your API Gateway to get the invoke URL that will be used as your Trello webhook callback URL.

Follow these steps:

In your API Gateway console, click on Deploy API
Configure the deployment:
- Stage: Select Create new stage
- Stage name: Enter a name for your stage (e.g., development)
- Click Deploy

Get Your Callback URL

Once deployed, you need to obtain your invoke URL to use as the Trello webhook callback URL.

Follow these steps:

In your API Gateway console, click on the / (root)
Click on /events
Click on Invoke URL
Copy and save this URL—this is your callback URL that you'll use in the Trello webhook configuration

Your invoke URL will look like this:

https://{api-id}.execute-api.us-east-1.amazonaws.com/development/events

Save this URL as you'll need it in the next step to create the Trello webhook.

To create the webhook and configure your automation, you need to obtain the Trello board ID.

Follow these steps:

Go to your Trello board
Select a card and click on it to open it
Click on the three dots (•••) in the top right corner of the card
Click on Share
Click on Export as JSON
Copy the JSON data and save it

From the exported JSON, you can find:

Board ID: The unique identifier for your Trello board called idBoard save this value we will need it on the next step

Create Trello Webhook using Bruno

Now that you have all the necessary parameters, you'll create the Trello webhook using Bruno (an API client similar to Postman).

Parameters collected:

Callback URL: Your API Gateway invoke URL
API Key: Your Trello API Key
API Token: Your Trello API Token
Model ID: Your Trello board ID

Step 1: Create a Bruno Collection and Environment Variables

Open Bruno
Click on Create Collection and name it trello-whatsapp-notifications
Right-click on the collection and select Settings
Go to the Environments tab
Click on Create Environment and name it development
Add the following environment variables with the values you collected:

{
  "CallbackUrl": "https://{api-id}.execute-api.us-east-1.amazonaws.com/development/events",
  "APIKey": "YOUR_TRELLO_API_KEY",
  "APIToken": "YOUR_TRELLO_API_TOKEN",
  "ModelId": "YOUR_TRELLO_BOARD_ID"
}

Click Save

Step 2: Create Webhook Request in Bruno

In your Bruno collection, click on Create Request
Name it Create Trello Webhook
Set the request method to POST
Enter the following URL:

https://api.trello.com/1/tokens/{{APIToken}}/webhooks/

In the Body tab, select JSON and add:

{
  "key": "{{APIKey}}",
  "callbackURL":  "{{CallbackUrl}}",
  "idModel": "{{ModelId}}",
  "description":  "Trello board events"
}

DynamoDB

DynamoDB is used to store the state of all notifications. This database helps manage the status of notifications and provides the Lambda function that sends WhatsApp notifications with all the necessary information to build the message. The Create Event Scheduler Lambda function is responsible for populating the DynamoDB table.

The primary key for the DynamoDB table is cardID. Here is the DynamoDB table structure:

Attribute	Type	Description
cardID	String (Primary Key)	Unique identifier for the Trello card
card_name	String	Name of the Trello card
board_name	String	Name of the Trello board
list_name	String	Name of the list containing the card
card_url	String	URL link to the Trello card
due_to_date	String	Due date in ISO 8601 format
member_creator	String	Name of the member who created the card
hours_before_due	Number	Hours before due date to send the notification
notification_type	String	Type of notification (e.g., `1_DAY_BEFORE`)
notification_date	String	Calculated date/time when the notification should be sent
schedule_name	String	Name of the EventBridge scheduler
schedule_arn	String	ARN of the EventBridge scheduler
schedule_status	String	Status of the scheduler (e.g., `ENABLED`, `DISABLED`)
notification_sent	Boolean	Whether the notification has been sent
notification_sent_at	String	Timestamp when the notification was sent
timestamp	String	Creation timestamp of the record

Example DynamoDB Item:

{
  "cardID": "6956438536af465e3d40b380",
  "card_name": "Programacion certificacion de terraform",
  "board_name": "working tasks",
  "list_name": "Lista de tareas",
  "card_url": "https://trello.com/c/RscETyKh",
  "due_to_date": "2026-02-02T10:58:00.000Z",
  "member_creator": "Eliana Alejandro Morales Lopez",
  "hours_before_due": 24,
  "notification_type": "1_DAY_BEFORE",
  "notification_date": "2026-02-01T10:58:00+00:00",
  "schedule_name": "trello-reminder-6956438536af465e3d40b380-1769943480",
  "schedule_arn": "arn:aws:scheduler:us-east-1:724772097129:schedule/default/trello-reminder-6956438536af465e3d40b380-1769943480",
  "schedule_status": "ENABLED",
  "notification_sent": true,
  "notification_sent_at": "2026-01-07T14:23:54.799628",
  "timestamp": "2026-01-01T10:59:09.672Z"
}

DynamoDB Streams Configuration

DynamoDB Streams is an AWS service that captures item-level modifications in a DynamoDB table and sends notifications about these changes. In this solution, DynamoDB Streams monitors changes to the due_to_date attribute. When this attribute is updated, DynamoDB Streams triggers the Lambda Update Scheduler EventBridge function.

This Lambda function receives the event from DynamoDB Streams containing the cardId of the modified item. It then:

Retrieves the current scheduler ARN from DynamoDB
Deletes the existing EventBridge scheduler
Creates a new scheduler with the updated due date
Updates the scheduler ARN in the DynamoDB table

This ensures that every time the due date is modified, the notification schedule is automatically updated with the new date.

To configure DynamoDB Streams with your Lambda function:

Go to your DynamoDB table in the AWS console
Click on the Exports and streams tab
Under DynamoDB Streams, click Enable

Select New and old images as the stream specification

AWS Lambda Functions

This solution uses three Lambda functions to handle different parts of the workflow:

Update Scheduler Lambda (DynamoDB Streams)

This Lambda function is triggered by DynamoDB Streams when the due_to_date attribute of a card is updated. It automatically updates the EventBridge scheduler with the new due date.

Workflow

Receives an event from DynamoDB Streams containing the modified cardID
Retrieves the current scheduler ARN and old due date from DynamoDB
Deletes the existing EventBridge scheduler
Calculates the new notification date based on the updated due date
Creates a new EventBridge scheduler with the updated date
Updates the DynamoDB record with the new scheduler ARN and schedule name

Environment Variables

The Update Scheduler Lambda function requires the following environment variables to be configured:

Variable	Description
`TABLE_NAME`	The name of your DynamoDB table where card notification records are stored. Used to retrieve and update card information and scheduler details.
`SCHEDULE_ROLE_ARN`	The ARN of the IAM role that EventBridge Scheduler will assume when executing scheduled tasks. This role must have permissions to invoke the WhatsApp Notification Lambda function.
`TARGET_LAMBDA_ARN`	The ARN of the WhatsApp Notification Lambda function that will be invoked by the EventBridge scheduler when the notification time arrives.

How to set environment variables:

Go to your Lambda function in the AWS console
Click on the Configuration tab
Select Environment variables from the left menu
Click on Edit
Click on Add environment variable for each variable
Enter the variable name and its corresponding value
Click Save

IAM Policy

The Update Scheduler Lambda function requires permissions to interact with CloudWatch Logs, EventBridge Scheduler, and DynamoDB services. Attach the following policy to your Lambda execution role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloudWatchLogsPermissions",
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:us-east-1:724772097129:*"
        },
        {
            "Sid": "CloudWatchLogsStreamPermissions",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:us-east-1:724772097129:log-group:/aws/lambda/lambda-update-scheduler-eventbridge:*"
        },
        {
            "Sid": "EventBridgeSchedulerPermissions",
            "Effect": "Allow",
            "Action": [
                "scheduler:CreateSchedule",
                "scheduler:GetSchedule",
                "scheduler:DeleteSchedule",
                "scheduler:UpdateSchedule"
            ],
            "Resource": "arn:aws:scheduler:us-east-1:724772097129:schedule/default/trello-reminder-*"
        },
        {
            "Sid": "DynamoDBPermissions",
            "Effect": "Allow",
            "Action": [
                "dynamodb:GetItem",
                "dynamodb:UpdateItem",
                "dynamodb:Query"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:724772097129:table/TrelloNotificationEvents"
        },
        {
            "Sid": "DynamoDBStreamsPermissions",
            "Effect": "Allow",
            "Action": [
                "dynamodb:GetRecords",
                "dynamodb:GetShardIterator",
                "dynamodb:DescribeStream",
                "dynamodb:ListStreams",
                "dynamodb:ListShards"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:724772097129:table/TrelloNotificationEvents/stream/*"
        },
        {
            "Sid": "PassRoleToScheduler",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::724772097129:role/eventbridgeSchedulerRole",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "scheduler.amazonaws.com"
                }
            }
        }
    ]
}

import json
import boto3
from datetime import datetime, timedelta
import os

# AWS Clients
scheduler_client = boto3.client('scheduler')
dynamodb = boto3.resource('dynamodb')

# Environment Variables
TABLE_NAME = os.environ.get('TABLE_NAME', 'TrelloNotificationEvents')
TARGET_LAMBDA_ARN = os.environ.get('TARGET_LAMBDA_ARN')
SCHEDULE_ROLE_ARN = os.environ.get('SCHEDULE_ROLE_ARN')

def lambda_handler(event, context):
    """
    Triggered by DynamoDB Streams when due_to_date is updated.
    Updates the EventBridge scheduler with the new due date.
    """

    try:
        print(f"📥 Received DynamoDB Streams event: {json.dumps(event)}")

        # Process each DynamoDB stream record
        for record in event.get('Records', []):
            if record['eventName'] != 'MODIFY':
                print(f"⏭️ Skipping non-MODIFY event: {record['eventName']}")
                continue

            # Extract the card ID and new data
            dynamodb_record = record['dynamodb']
            card_id = dynamodb_record['Keys']['cardID']['S']

            # Get new and old image
            new_image = dynamodb_record.get('NewImage', {})
            old_image = dynamodb_record.get('OldImage', {})

            # Check if due_to_date was actually changed
            old_due_date_str = old_image.get('due_to_date', {}).get('S')
            new_due_date_str = new_image.get('due_to_date', {}).get('S')

            if old_due_date_str == new_due_date_str:
                print(f"ℹ️ Due date not changed for card {card_id}, skipping")
                continue

            print(f"🔄 Due date updated for card: {card_id}")
            print(f"   Old due date: {old_due_date_str}")
            print(f"   New due date: {new_due_date_str}")

            # Get the current scheduler information from the new image
            old_schedule_arn = old_image.get('schedule_arn', {}).get('S')
            old_schedule_name = old_image.get('schedule_name', {}).get('S')
            card_name = new_image.get('card_name', {}).get('S', 'Unknown')

            # Step 1: Delete the old schedule
            if old_schedule_name:
                try:
                    print(f"🗑️ Deleting old schedule: {old_schedule_name}")
                    scheduler_client.delete_schedule(
                        Name=old_schedule_name
                    )
                    print(f"✅ Old schedule deleted: {old_schedule_name}")
                except scheduler_client.exceptions.ResourceNotFoundException:
                    print(f"⚠️ Schedule not found: {old_schedule_name}")
                except Exception as e:
                    print(f"⚠️ Error deleting schedule: {str(e)}")

            # Step 2: Parse the new due date
            new_due_date = datetime.fromisoformat(new_due_date_str.replace('Z', '+00:00'))
            now = datetime.now(new_due_date.tzinfo)

            # Calculate time until due date
            time_until_due = new_due_date - now

            print(f"⏰ New due date: {new_due_date.isoformat()}")
            print(f"📊 Time until due: {time_until_due}")

            # Step 3: Determine notification date based on new due date
            if time_until_due <= timedelta(hours=12):
                print(f"⚠️ New due date is less than 12 hours away, schedule not updated")

                # Update DynamoDB to mark schedule as deleted
                table = dynamodb.Table(TABLE_NAME)
                table.update_item(
                    Key={'cardID': card_id},
                    UpdateExpression='SET schedule_status = :status, notification_sent = :sent',
                    ExpressionAttributeValues={
                        ':status': 'CANCELLED',
                        ':sent': True
                    }
                )
                continue

            elif time_until_due <= timedelta(days=1):
                notification_date = new_due_date - timedelta(hours=12)
                notification_type = "12_HOURS_BEFORE"
                hours_before = 12
                print(f"📅 New due date is within 24 hours, scheduling for 12 hours before")

            else:
                notification_date = new_due_date - timedelta(days=1)
                notification_type = "1_DAY_BEFORE"
                hours_before = 24
                print(f"📅 New due date is more than 24 hours away, scheduling for 1 day before")

            # Verify notification date is not in the past
            if notification_date <= now:
                print(f"⚠️ New notification date is in the past: {notification_date}")

                table = dynamodb.Table(TABLE_NAME)
                table.update_item(
                    Key={'cardID': card_id},
                    UpdateExpression='SET schedule_status = :status, notification_sent = :sent',
                    ExpressionAttributeValues={
                        ':status': 'CANCELLED',
                        ':sent': True
                    }
                )
                continue

            # Step 4: Create a new schedule
            new_schedule_name = f"trello-reminder-{card_id}-{int(notification_date.timestamp())}"
            schedule_expression = notification_date.strftime('at(%Y-%m-%dT%H:%M:%S)')

            target_payload = {
                'cardID': card_id
            }

            try:
                print(f"📅 Creating new schedule: {new_schedule_name}")

                new_schedule_response = scheduler_client.create_schedule(
                    Name=new_schedule_name,
                    Description=f"Updated reminder for Trello card: {card_name} ({notification_type})",
                    ScheduleExpression=schedule_expression,
                    ScheduleExpressionTimezone='UTC',
                    FlexibleTimeWindow={
                        'Mode': 'OFF'
                    },
                    Target={
                        'Arn': TARGET_LAMBDA_ARN,
                        'RoleArn': SCHEDULE_ROLE_ARN,
                        'Input': json.dumps(target_payload)
                    },
                    State='ENABLED'
                )

                new_schedule_arn = new_schedule_response.get('ScheduleArn')

                print(f"✅ New schedule created: {new_schedule_name}")
                print(f"📍 New schedule ARN: {new_schedule_arn}")

                # Step 5: Update DynamoDB with the new scheduler information
                table = dynamodb.Table(TABLE_NAME)

                table.update_item(
                    Key={'cardID': card_id},
                    UpdateExpression='SET schedule_name = :sname, schedule_arn = :sarn, schedule_status = :status, notification_date = :ndate, notification_type = :ntype, hours_before_due = :hours, due_to_date = :duedate',
                    ExpressionAttributeValues={
                        ':sname': new_schedule_name,
                        ':sarn': new_schedule_arn,
                        ':status': 'ENABLED',
                        ':ndate': notification_date.isoformat(),
                        ':ntype': notification_type,
                        ':hours': hours_before,
                        ':duedate': new_due_date_str
                    }
                )

                print(f"✅ DynamoDB updated with new schedule: {card_id}")

            except scheduler_client.exceptions.ConflictException as e:
                print(f"⚠️ Schedule already exists: {str(e)}")
                return {
                    'statusCode': 409,
                    'body': json.dumps({
                        'error': 'Schedule already exists',
                        'message': str(e)
                    })
                }

        return {
            'statusCode': 200,
            'body': json.dumps({
                'message': 'Schedules updated successfully',
                'processedRecords': len(event.get('Records', []))
            })
        }

    except Exception as e:
        print(f"❌ Error processing DynamoDB Streams event: {str(e)}")
        import traceback
        traceback.print_exc()

        return {
            'statusCode': 500,
            'body': json.dumps({
                'error': str(e)
            })
        }

#### Associate lambda with the DynamoDB Streams

Go to your Lambda Update Scheduler EventBridge function
Click on Configuration → Triggers
Click Add trigger and select DynamoDB
Select your DynamoDB table and stream
Click Add

2. Create Event Scheduler Lambda

This Lambda function processes incoming events from the Trello webhook. It uses the cardId as the primary key to check if a notification already exists in DynamoDB.

Workflow:

Receives the JSON payload from the Trello webhook
Checks if a record with the cardId already exists in DynamoDB
If the notification doesn't exist:
- Creates a new EventBridge scheduler with the card's due date
- Stores the scheduler ARN in DynamoDB
If the notification already exists:
- Updates the due_to_date attribute in the DynamoDB record (which triggers DynamoDB Streams)

Environment variables:
The Create Event Scheduler Lambda function requires the following environment variables to be configured:

Variable	Description
`SCHEDULE_ROLE_ARN`	The ARN of the IAM role that EventBridge Scheduler will assume when executing scheduled tasks. This role must have permissions to invoke the WhatsApp Notification Lambda function.
`TABLE_NAME`	The name of your DynamoDB table where card notification records are stored. This is used to store and retrieve card information along with scheduler details.
`TARGET_LAMBDA_ARN`	The ARN of the WhatsApp Notification Lambda function that will be invoked by the EventBridge scheduler when the notification time arrives.

Required IAM permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloudWatchLogsPermissions",
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:us-east-1:724772097129:*"
        },
        {
            "Sid": "CloudWatchLogsStreamPermissions",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:us-east-1:724772097129:log-group:/aws/lambda/lambda-create-record-notification-trello:*"
        },
        {
            "Sid": "EventBridgeSchedulerPermissions",
            "Effect": "Allow",
            "Action": [
                "scheduler:CreateSchedule",
                "scheduler:GetSchedule",
                "scheduler:DeleteSchedule"
            ],
            "Resource": "arn:aws:scheduler:us-east-1:724772097129:schedule/default/trello-reminder-*"
        },
        {
            "Sid": "DynamoDBPermissions",
            "Effect": "Allow",
            "Action": [
                "dynamodb:PutItem",
                "dynamodb:GetItem",
                "dynamodb:Query",
                "dynamodb:UpdateItem"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:724772097129:table/TrelloNotificationEvents"
        },
        {
            "Sid": "PassRoleToScheduler",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::724772097129:role/eventbridgeSchedulerRole",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "scheduler.amazonaws.com"
                }
            }
        }
    ]
}

Create Event Scheduler Lambda Code

Here is the complete code for the Create Event Scheduler Lambda function:

import json
import boto3
from datetime import datetime, timedelta
import os

# AWS Clients
scheduler_client = boto3.client('scheduler')
dynamodb = boto3.resource('dynamodb')

# Environment Variables
TABLE_NAME = os.environ.get('TABLE_NAME', 'TrelloNotificationEvents')
TARGET_LAMBDA_ARN = os.environ.get('TARGET_LAMBDA_ARN')  # ARN of the Lambda that will send notifications
SCHEDULE_ROLE_ARN = os.environ.get('SCHEDULE_ROLE_ARN')  # Role for EventBridge Scheduler

def lambda_handler(event, context):
    """
    Receives a Trello event and creates a schedule in EventBridge
    to execute 1 day before the due date (or 12 hours if due date is very soon)
    """

    try:
        # Extract data from the event
        action = event.get('action', {})
        card_data = action.get('data', {}).get('card', {})

        card_id = card_data.get('id')
        card_name = card_data.get('name')
        due_date_str = card_data.get('due')

        if not card_id or not due_date_str:
            return {
                'statusCode': 400,
                'body': json.dumps('Missing cardID or due date')
            }

        print(f"🔍 Processing card: {card_name} (ID: {card_id})")

        # Parse the due date
        due_date = datetime.fromisoformat(due_date_str.replace('Z', '+00:00'))

        # Get the current time
        now = datetime.now(due_date.tzinfo)

        # Calculate the time difference between now and due date
        time_until_due = due_date - now

        print(f"⏰ Due date: {due_date.isoformat()}")
        print(f"📊 Time until due: {time_until_due}")

        # Determine when to send the notification
        if time_until_due <= timedelta(hours=12):
            # If due date is less than 12 hours away, don't schedule anything
            print(f"⚠️ Due date is less than 12 hours away, notification not scheduled")
            return {
                'statusCode': 200,
                'body': json.dumps({
                    'message': 'Due date is too soon (< 12 hours), notification not scheduled',
                    'cardID': card_id,
                    'dueDate': due_date_str,
                    'hoursUntilDue': time_until_due.total_seconds() / 3600
                })
            }
        elif time_until_due <= timedelta(days=1):
            # If due date is less than 24 hours but more than 12, schedule for 12 hours before
            notification_date = due_date - timedelta(hours=12)
            notification_type = "12_HOURS_BEFORE"
            print(f"📅 Due date is within 24 hours, scheduling for 12 hours before")
        else:
            # If due date is more than 24 hours away, schedule for 1 day before
            notification_date = due_date - timedelta(days=1)
            notification_type = "1_DAY_BEFORE"
            print(f"📅 Due date is more than 24 hours away, scheduling for 1 day before")

        # Verify that the notification date is not in the past
        if notification_date <= now:
            print(f"⚠️ Notification date is in the past: {notification_date}")
            return {
                'statusCode': 200,
                'body': json.dumps({
                    'message': 'Calculated notification date is in the past',
                    'cardID': card_id,
                    'notificationDate': notification_date.isoformat(),
                    'currentTime': now.isoformat()
                })
            }

        # Calculate time until notification
        time_until_notification = notification_date - now
        hours_until_notification = time_until_notification.total_seconds() / 3600

        print(f"⏰ Notification scheduled for: {notification_date.isoformat()}")
        print(f"⏳ Time until notification: {hours_until_notification:.2f} hours")

        # Create a unique name for the schedule
        schedule_name = f"trello-reminder-{card_id}-{int(notification_date.timestamp())}"

        # Date format for EventBridge Scheduler (at expression)
        schedule_expression = notification_date.strftime('at(%Y-%m-%dT%H:%M:%S)')

        # Payload to be sent to the notification Lambda
        target_payload = {
            'cardID': card_id
        }

        # 1️⃣ FIRST: Create the schedule in EventBridge
        print(f"📅 Creating schedule: {schedule_name}")

        schedule_response = scheduler_client.create_schedule(
            Name=schedule_name,
            Description=f"Reminder for Trello card: {card_name} ({notification_type})",
            ScheduleExpression=schedule_expression,
            ScheduleExpressionTimezone='UTC',
            FlexibleTimeWindow={
                'Mode': 'OFF'
            },
            Target={
                'Arn': TARGET_LAMBDA_ARN,
                'RoleArn': SCHEDULE_ROLE_ARN,
                'Input': json.dumps(target_payload)
            },
            State='ENABLED'
        )

        # Get the ARN of the created schedule
        schedule_arn = schedule_response.get('ScheduleArn')

        print(f"✅ Schedule created: {schedule_name}")
        print(f"📍 Schedule ARN: {schedule_arn}")

        # 2️⃣ THEN: Save to DynamoDB with the schedule_arn
        table = dynamodb.Table(TABLE_NAME)
        timestamp = action.get('date')

        # Build the card URL
        card_short_link = card_data.get('shortLink')
        card_url = f"https://trello.com/c/{card_short_link}" if card_short_link else ""

        dynamodb_item = {
            'cardID': card_id,
            'timestamp': timestamp,
            'card_name': card_name,
            'card_url': card_url,
            'due_to_date': due_date_str,
            'notification_date': notification_date.isoformat(),
            'notification_type': notification_type,
            'hours_before_due': 12 if notification_type == "12_HOURS_BEFORE" else 24,
            'board_name': action.get('data', {}).get('board', {}).get('name', ''),
            'list_name': action.get('data', {}).get('list', {}).get('name', ''),
            'member_creator': action.get('memberCreator', {}).get('fullName', ''),
            'schedule_name': schedule_name,
            'schedule_arn': schedule_arn,
            'schedule_status': 'ENABLED'
        }

        table.put_item(Item=dynamodb_item)

        print(f"✅ Saved to DynamoDB: {card_id}")
        print(f"🎯 Payload for notification: {target_payload}")

        return {
            'statusCode': 200,
            'body': json.dumps({
                'message': 'Schedule created and saved successfully',
                'scheduleName': schedule_name,
                'scheduleArn': schedule_arn,
                'notificationDate': notification_date.isoformat(),
                'notificationType': notification_type,
                'hoursBeforeDue': 12 if notification_type == "12_HOURS_BEFORE" else 24,
                'hoursUntilNotification': round(hours_until_notification, 2),
                'cardID': card_id,
                'cardName': card_name,
                'dueDate': due_date_str
            })
        }

    except scheduler_client.exceptions.ConflictException as e:
        # If the schedule already exists
        print(f"⚠️ Schedule already exists: {str(e)}")
        return {
            'statusCode': 409,
            'body': json.dumps({
                'error': 'Schedule already exists',
                'message': str(e)
            })
        }

    except Exception as e:
        print(f"❌ Error: {str(e)}")
        import traceback
        traceback.print_exc()

        return {
            'statusCode': 500,
            'body': json.dumps({
                'error': str(e),
                'cardID': card_id if 'card_id' in locals() else None
            })
        }

3. WhatsApp Notification Lambda

This Lambda function is invoked by the EventBridge scheduler when the due date is one day before. It retrieves the card information from DynamoDB and sends a WhatsApp notification using the Meta WhatsApp API.

Workflow

Receives the cardID from the EventBridge scheduler
Retrieves the card information from DynamoDB using the cardID
Fetches WhatsApp credentials from AWS Parameter Store (Phone ID, API Token, and recipient phone number)
Formats the due date into a readable format (DD/MM/YYYY HH:MM)
Constructs the WhatsApp message using the trello_notification template with dynamic parameters
Sends the WhatsApp message via Meta WhatsApp API
Updates the DynamoDB record to mark the notification as sent with the current timestamp
Returns a success response with the message details

Environment Variables

The WhatsApp Notification Lambda function requires the following environment variables to be configured:

Variable	Description
`TABLE_NAME`	The name of your DynamoDB table where card notification records are stored. Used to retrieve card information and update the notification status.
`WHATSAPP_PHONE_ID_PARAMETER`	The AWS Parameter Store key name for the WhatsApp Phone ID (e.g., `/whatsappApiNumberId`). This ID is required to send messages via the Meta WhatsApp API.
`WHATSAPP_TOKEN_PARAMETER`	The AWS Parameter Store key name for the WhatsApp API Token (e.g., `/whatsappToken`). This is the authentication token for the Meta WhatsApp API.
`RECIPIENT_PHONE_PARAMETER`	The AWS Parameter Store key name for the recipient phone number (e.g., `/WhatsAppNumberEliana`). This is the phone number that will receive the WhatsApp notifications in international format.

IAM Policy

The WhatsApp Notification Lambda function requires permissions to interact with CloudWatch Logs, DynamoDB, and AWS Systems Manager Parameter Store. Attach the following combined policy to your Lambda execution role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloudWatchLogsPermissions",
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:us-east-1:724772097129:*"
        },
        {
            "Sid": "CloudWatchLogsStreamPermissions",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:us-east-1:724772097129:log-group:/aws/lambda/lambda-whatsapp-notification:*"
        },
        {
            "Sid": "DynamoDBAccess",
            "Effect": "Allow",
            "Action": [
                "dynamodb:GetItem",
                "dynamodb:UpdateItem"
            ],
            "Resource": "arn:aws:dynamodb:us-east-1:724772097129:table/TrelloNotificationEvents"
        },
        {
            "Sid": "SSMParameterAccess",
            "Effect": "Allow",
            "Action": [
                "ssm:GetParameter"
            ],
            "Resource": [
                "arn:aws:ssm:us-east-1:724772097129:parameter/whatsappApiNumberId",
                "arn:aws:ssm:us-east-1:724772097129:parameter/whatsappToken",
                "arn:aws:ssm:us-east-1:724772097129:parameter/WhatsAppNumberEliana"
            ]
        }
    ]
}

import json
import boto3
import os
import requests
from datetime import datetime
from botocore.exceptions import ClientError

# AWS Clients
dynamodb = boto3.resource('dynamodb')
ssm_client = boto3.client('ssm')

# Environment Variables
TABLE_NAME = os.environ.get('TABLE_NAME')
WHATSAPP_PHONE_ID_PARAMETER = os.environ.get('WHATSAPP_PHONE_ID_PARAMETER')
WHATSAPP_TOKEN_PARAMETER = os.environ.get('WHATSAPP_TOKEN_PARAMETER')
RECIPIENT_PHONE_PARAMETER = os.environ.get('RECIPIENT_PHONE_PARAMETER')

def get_parameter(parameter_name):
    """
    Retrieves a parameter from AWS Parameter Store
    """
    try:
        response = ssm_client.get_parameter(
            Name=parameter_name,
            WithDecryption=False
        )
        return response['Parameter']['Value']
    except ClientError as e:
        print(f"❌ Error getting parameter {parameter_name} from Parameter Store: {str(e)}")
        raise

def get_whatsapp_phone_id():
    """
    Gets the WhatsApp Phone ID from Parameter Store
    """
    try:
        return get_parameter(WHATSAPP_PHONE_ID_PARAMETER)
    except ClientError:
        print(f"⚠️ Using default WHATSAPP_PHONE_ID: 926715197193624")
        return '926715197193624'

def get_recipient_phone():
    """
    Gets the recipient phone number from Parameter Store
    """
    try:
        return get_parameter(RECIPIENT_PHONE_PARAMETER)
    except ClientError:
        print(f"⚠️ Using default RECIPIENT_PHONE: 573123234567")
        return '573123234567'

def get_whatsapp_token():
    """
    Gets the WhatsApp API token from Parameter Store
    """
    try: 
        return get_parameter(WHATSAPP_TOKEN_PARAMETER)
    except ClientError as e: 
        print(f"❌ Error getting token from Parameter Store: {str(e)}")
        raise

def format_date(date_str):
    """
    Formats ISO date to readable Spanish format
    Example: 2026-02-02T10:58:00.000Z -> 02/02/2026 a las 10:58
    """
    try:
        date_obj = datetime.fromisoformat(date_str.replace('Z', '+00:00'))
        return date_obj.strftime('%d/%m/%Y a las %H:%M')
    except Exception as e: 
        print(f"⚠️ Error formatting date: {str(e)}")
        return date_str

def send_whatsapp_message(token, phone_number, card_name, board_name, list_name, due_date, card_url, whatsapp_phone_id):
    """
    Sends a WhatsApp message using the trello_notification template with dynamic parameters
    """
    url = f"https://graph.facebook.com/v23.0/{whatsapp_phone_id}/messages"

    headers = {
        'Authorization': f'Bearer {token}',
        'Content-Type': 'application/json'
    }

    payload = {
        "messaging_product": "whatsapp",
        "to": phone_number,
        "type": "template",
        "template": {
            "name": "trello_notification",
            "language": {
                "code": "es_CO"
            },
            "components": [
                {
                    "type": "header",
                    "parameters": [
                        {"type": "text", "text": "Recordatorio de Trello"}
                    ]
                },
                {
                    "type": "body",
                    "parameters": [
                        {"type": "text", "text": card_name},
                        {"type": "text", "text": board_name},
                        {"type": "text", "text": list_name},
                        {"type": "text", "text": due_date},
                        {"type": "text", "text": card_url}
                    ]
                }
            ]
        }
    }

    try:
        print(f"📤 Sending WhatsApp message to {phone_number}")
        print(f"📤 Payload: {json.dumps(payload)}")
        response = requests.post(url, headers=headers, json=payload, timeout=10)
        print(f"📥 Response status: {response.status_code}")
        print(f"📥 Response body: {response.text}")
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:
        print(f"❌ Error sending WhatsApp message: {str(e)}")
        if hasattr(e, 'response') and e.response is not None:
            print(f"Response: {e.response.text}")
        raise

def lambda_handler(event, context):
    """
    Receives the cardID from the scheduler, queries DynamoDB, and sends a WhatsApp notification
    """

    try:
        print(f"📥 Received event: {json.dumps(event)}")

        # Extract cardID from the event
        card_id = event.get('cardID')

        if not card_id: 
            print("❌ Missing cardID in payload")
            return {
                'statusCode': 400,
                'body': json.dumps({'error': 'Missing cardID in payload'})
            }

        print(f"🔍 Getting item with cardID: {card_id}")

        # Get the record from DynamoDB
        table = dynamodb.Table(TABLE_NAME)

        response = table.get_item(
            Key={'cardID': card_id}
        )

        if 'Item' not in response:
            print(f"⚠️ Card not found in database: {card_id}")
            return {
                'statusCode': 404,
                'body': json.dumps({'error': 'Card not found in database'})
            }

        # Get card data
        card_data = response['Item']

        card_name = card_data.get('card_name', 'Sin nombre')
        due_date_str = card_data.get('due_to_date', '')
        card_url = card_data.get('card_url', '')
        board_name = card_data.get('board_name', '')
        list_name = card_data.get('list_name', '')

        print(f"📋 Card found: {card_name}")
        print(f"📅 Due date: {due_date_str}")
        print(f"🔗 URL: {card_url}")

        # Format the due date
        due_date_formatted = format_date(due_date_str)

        # Get parameters from Parameter Store
        print("🔐 Getting parameters from Parameter Store...")
        whatsapp_phone_id = get_whatsapp_phone_id()
        recipient_phone = get_recipient_phone()
        token = get_whatsapp_token()

        # Send WhatsApp message with individual parameters
        print(f"📤 Sending message to {recipient_phone}...")
        result = send_whatsapp_message(
            token, 
            recipient_phone, 
            card_name,
            board_name,
            list_name,
            due_date_formatted,
            card_url,
            whatsapp_phone_id
        )

        print(f"✅ Message sent successfully: {result}")

        # Update DynamoDB record to mark notification as sent
        table.update_item(
            Key={'cardID': card_id},
            UpdateExpression='SET notification_sent = :val, notification_sent_at = :date',
            ExpressionAttributeValues={
                ':val': True,
                ':date': datetime.utcnow().isoformat()
            }
        )

        print(f"✅ DynamoDB updated with notification status for cardID: {card_id}")

        return {
            'statusCode': 200,
            'body': json.dumps({
                'message': 'Notification sent successfully',
                'cardID': card_id,
                'recipientPhone': recipient_phone,
                'result': result
            })
        }

    except Exception as e:
        print(f"❌ Error in lambda_handler: {str(e)}")
        import traceback
        traceback.print_exc()

        return {
            'statusCode': 500,
            'body': json.dumps({'error': str(e)})
        }

WhatsApp API Configuration

Create and Verify Meta Business Account

To use the WhatsApp API, you need to create and verify a Meta Business Account. This account will allow you to access the WhatsApp Cloud API and manage your WhatsApp Business integration.

Step 1: Access Meta Business Platform

Go to the Meta Business Platform Login
If you don't have a Meta account, click on Create Account
Enter your email address and create a secure password
Click Create Account

Step 2: Set Up Your Business Account

After logging in, you'll be prompted to create a Meta Business Account
Fill in the following information:
- Business Account Name: Enter a name for your business (e.g., "Trello WhatsApp Notifications")
- Your Name: Enter your full name
- Business Email: Use a business email address
- Business Phone Number: Enter your phone number
- Country: Select your country
Click Create Account

Step 3: Verify Your Business Information

Once your account is created, go to Settings → Business Information
Complete the following verification steps:
- Verify your email address: Check your email inbox for a verification link from Meta and click it
- Add a phone number: Enter and verify your phone number
- Upload business documents (if required):
  - Government-issued ID
  - Business registration documents
  - Proof of address
Click Submit for Review once all information is complete

Step 4: Wait for Approval

Meta will review your information (usually takes 24-48 hours)
You'll receive an email notification once your account is verified
Once approved, your business account will be fully active

Step 5: Access the Developer Platform

After verification, go to Meta Developers
Log in with your Meta Business Account credentials
Click on My Apps in the top menu
Click Create App to create a new app for WhatsApp integration

Step 6: Create a New App

Create a Meta App for WhatsApp Integration

Follow these steps to create a Meta App that will be used for WhatsApp Cloud API integration.

Step 1: App Details

In the App Details section, fill in the following information:
- Email: Enter a valid email address associated with your Meta Business Account
- App Name: Enter a name for your app (e.g., "Trello WhatsApp Notifications")
Click Next

Step 2: Select Use Case

In the Use Cases section, you'll see different options for what you want to do with your app
Select Connect with customers through WhatsApp
This option allows you to use the WhatsApp Cloud API to send messages
Click Next

Step 3: Select Business Portfolio

In the Business section, select your business portfolio
This is the Meta Business Account you created and verified in the previous steps
Make sure to select the correct portfolio associated with your business
Click Next

Step 4: Check Requirements

In the Requirements section, Meta will display any requirements you need to fulfill
Review each requirement carefully:
- Business Account Verification: Make sure your business account is verified
- Phone Number: Ensure you have a valid phone number registered
- Other Requirements: Complete any additional requirements listed
If all requirements are met, you can proceed directly to the next step
If there are unmet requirements, complete them first
Click Next once all requirements are satisfied

Step 5: Summary and Complete Setup

In the Summary section, you'll see a review of all the information you provided:
- App Name
- Use Case
- Business Portfolio
- Requirements Status
Review all the details to ensure they are correct
Click Go to Dashboard to complete the app creation and access your app dashboard

Configure Use Case for WhatsApp Integration

Now that you've created your Meta App, you need to configure the WhatsApp use case to enable the WhatsApp Cloud API integration.

Step 1: Access Your App

Go to Meta Developers
Click on My Apps in the top menu
Select the app you just created (e.g., "Trello WhatsApp Notifications")
You'll be taken to your app dashboard

Step 2: Navigate to Use Cases

In your app dashboard, look for the Use Cases section in the left sidebar
Click on Use Cases
You'll see a list of available use cases for your app

Step 3: Add a New Use Case

Click on Add Use Case button
A list of available use cases will appear

Step 4: Select WhatsApp Use Case

From the list of available use cases, find and select Connect with customers through WhatsApp
This use case enables you to send messages to your customers via WhatsApp using the Cloud API
Click Add to add this use case to your app

Step 4: Create System User and Generate Permanent Access Token

Go to this link Click here to access your Meta Business Settings

You need to create a permanent access token to use in the WhatsApp Business platform. This token will be used to authenticate API requests to send WhatsApp messages.

Step 1: Navigate to System Users

Go to Business Settings in your Meta Business Account
In the left sidebar, click on System Users
You'll see a list of existing system users (if any)

Step 2: Create a New System User

Click on the Add + button in the top right corner
A dialog will appear asking for system user details
Fill in the following information:
- System User Name: Enter a name for your system user (e.g., "Trello WhatsApp Bot")
- System User Role: Select Admin
Click Create System User

Step 3: Assign Assets to the System User

Select the system user you just created
Click on Assign Assets button
You'll be taken to the asset assignment page

Step 4: Assign Your App

In the Apps section:
- Select your WhatsApp app (e.g., "Trello WhatsApp Notifications")
- Enable Manage app with Full Control permissions
Click Assign Assets

Step 5: Assign Your WhatsApp Business Account

In the WhatsApp Business Accounts section:
- Select your WhatsApp Business Account
- Enable Manage WhatsApp Business Accounts with Full Control permissions
Click Assign Assets

Step 6: Generate Access Token

Go back to the system user you created
Click on Generate Token button
A dialog will appear with token generation options
Select your app

Set the token expiration (choose Never for a permanent token)

Select the following scopes (permissions) for your token:
- ✅ business_management: Allows management of your business account
- ✅ whatsapp_business_messaging: Allows sending WhatsApp messages
- ✅ whatsapp_business_management: Allows management of WhatsApp Business Account

Click Generate Token

Step 7: Copy and Secure Your Token

Copy the generated token from the dialog
Important: Save this token in a secure location immediately
Store it in AWS Parameter Store as you'll need it for the Lambda function
Never share this token publicly or commit it to version control

Security Best Practices:

⚠️ Secure Storage: Always store your token in AWS Parameter Store or AWS Secrets Manager with encryption enabled

⚠️ Token Expiration: Consider setting an expiration date for your token and rotating it periodically

⚠️ Access Control: Restrict who has access to this token. Never expose it in logs or error messages

⚠️ Revocation: If your token is compromised, immediately revoke it and generate a new one

Step 8: Store Token in AWS Parameter Store

Once you have your access token, store it securely in AWS Parameter Store:

Go to AWS Systems Manager → Parameter Store
Click Create parameter
Fill in the following details:
- Name: /whatsappToken
- Type: SecureString (for encryption)
- Value: Paste your access token here
Click Create parameter

This token will be used by the WhatsApp Notification Lambda function to authenticate API requests to the Meta WhatsApp API.

Token Validation

To verify your token is working correctly, you can test it by making a simple API request:

curl -X GET "https://graph.facebook.com/v18.0/me?fields=name,email&access_token=YOUR_ACCESS_TOKEN"

If successful, you'll receive a JSON response with your business account information.

Create WhatsApp Message Template

You need to create a WhatsApp message template that will be used to send Trello notifications. This template must be approved by Meta before you can use it to send messages.

Step 1: Access Message Templates

Click here to access the WhatsApp Message Templates manager
You'll see a list of your existing message templates (if any)
Click on Create Template button to create a new template

Step 2: Select Template Category

In the Category section, select Utility
Utility templates are used for transactional messages like notifications, reminders, and alerts
This is the appropriate category for Trello notification reminders
Click Next

Step 3: Name Your Template and Select Language

Fill in the template details:
- Template Name: Enter a name for your template (e.g., trello_notification)
- Language: Select your preferred language (e.g., Spanish - es_CO, English - en_US)
The template name should be descriptive and in lowercase with underscores
Click Next

Step 4: Create Template Body with Variables

Now you'll create the message body that will be sent to users. This template will include 5 dynamic variables that will be replaced with actual Trello card information.

Variables:

{{1}} - Task name (tarea)
{{2}} - Board name (tablero)
{{3}} - List name (lista)
{{4}} - Due date (vence)
{{5}} - Card URL (url)

In the Message Body section, enter the following template text:

🎯 *Trello Reminder Notification*

Task: {{1}}
Board: {{2}}
List: {{3}}
Due Date: {{4}}

View Task: {{5}}

Please complete this task on time!

Example with Sample Values:

For Meta's review process, provide example values:

Task: "Complete project documentation"
Board: "Working Tasks"
List: "In Progress"
Due Date: "02/02/2026 at 10:58 AM"
Card URL: "https://trello.com/c/RscETyKh"

The final message will look like:

🎯 *Trello Reminder Notification*

Task: Complete project documentation
Board: Working Tasks
List: In Progress
Due Date: 02/02/2026 at 10:58 AM

View Task: https://trello.com/c/RscETyKh

Please complete this task on time!

Click Next to continue

Step 6: Review and Submit for Approval

Review all template details:
- Template Name: trello_notification
- Category: Utility
- Language: Your selected language
- Body with variables
- Header (if added)
- Footer (if added)
Make sure all the information is correct
Click Submit for Review to send your template to Meta for approval

Important Notes About Template Approval

⏱️ Approval Time: Meta's review process typically takes 24-48 hours, but can take up to 2 days in some cases

📋 Review Criteria: Meta will review your template to ensure it:

Complies with WhatsApp's messaging policies
Doesn't contain prohibited content
Uses appropriate language for the category
Follows WhatsApp's brand guidelines

✅ Approval Status: You'll receive a notification when your template is approved. You can also check the status in the Message Templates manager

Step 5: Get WhatsApp Phone Number ID

Meta provides a test phone number for your WhatsApp Business Account. You need to retrieve the Phone Number ID and store it securely in AWS Parameter Store.

Step 1: Navigate to Phone Numbers Section

Go to your WhatsApp Business Account dashboard
In the left sidebar, click on Phone Numbers
You'll see the test phone number that Meta provides for your account
It will be displayed in a format like: +1 (XXX) XXX-XXXX or similar

Step 2: Select Your WhatsApp Test Phone Number

Click on the phone number to view its details
A panel will open showing the phone number configuration and information
Look for the Phone Number ID field in the details panel
This is the unique identifier you need to store in AWS Parameter Store

Step 3: Copy the Phone Number ID

In the phone number details, locate the Phone Number ID field
This is a numeric ID (e.g., 926715197193624)
Click on the copy icon next to the Phone Number ID or manually select and copy it
Save this value temporarily as you'll need it in the next step

Step 4: Store Phone Number ID in AWS Parameter Store

Now you'll store the Phone Number ID securely in AWS Parameter Store:

Go to AWS Systems Manager in your AWS console
Click on Parameter Store in the left sidebar
Click Create parameter
Fill in the following details:
- Name: /whatsappApiNumberId
- Type: String
- Description: "WhatsApp Business Phone Number ID for Trello notifications"
- Value: Paste the Phone Number ID you copied from Meta (e.g., 9267151971935456)
Click Create parameter

Step 5: Verify Parameter Storage

You should see a success message confirming the parameter was created
Navigate to Parameter Store to verify your parameter appears in the list
You should see:
- Parameter Name: /whatsappApiNumberId
- Type: String
- Last Modified Date: Current date

AWS Parameter Store Configuration

Your AWS Parameter Store should now contain:

Parameter Name	Type	Value	Description
`/whatsappApiNumberId`	String	Your Phone Number ID	WhatsApp Business Phone Number ID
`/whatsappToken`	SecureString	Your Access Token	WhatsApp API Access Token
`/WhatsAppNumberEliana`	String	Recipient Phone Number	Recipient phone number for notifications

Important Notes

⚠️ Phone Number ID Format: The Phone Number ID is a numeric string without any special characters or formatting

⚠️ Test vs Production: Meta provides a test phone number for development and testing. For production use, you'll need to set up a dedicated phone number

⚠️ Recipient Phone Number: Make sure the recipient phone number is also stored in Parameter Store as /WhatsAppNumberEliana in international format (e.g., 573123234567)

⚠️ Security: Keep your Phone Number ID and Access Token secure. These credentials authenticate all API requests to the WhatsApp API

Next Steps

Now that you have all three credentials stored in AWS Parameter Store:

✅ Phone Number ID: /whatsappApiNumberId
✅ Access Token: /whatsappToken
✅ Recipient Phone Number: /WhatsAppNumberEliana

Step 6: Authorize WhatsApp Number for Testing

Now you need to authorize your WhatsApp number to receive and review messages from your assigned test number. This step is required to test the WhatsApp notification integration.

Step 1: Access Use Cases Configuration

Go to your Meta App Dashboard
In the left sidebar, click on Use Cases
Find and click on Connect with customers through WhatsApp
Click on API Setup or Configuration
You'll see the WhatsApp API configuration page

Step 2: Add a Phone Number

In the API configuration page, look for the section Phone Numbers or Add Phone Number
Click on the dropdown menu that says Select a phone number to add or Add Phone Number
This dropdown will show available phone numbers or an option to add a new one

Step 3: Enter Your Phone Number

In the dropdown or input field, enter your phone number in international format
Format: Country code + phone number
Make sure to include:
- Country code (without the + symbol)
- Phone number without spaces or special characters
Click Next or Add

Step 4: Enter Verification Code

Meta will send a verification code to the phone number you provided
You'll receive an whatsapp message with a code (usually 6 digits)
Enter the verification code in the dialog box that appears
Click Verify to confirm your phone number

Create Step Function

Template Definition

# filepath: template.yaml
Resources:
  StateMachine80541e5e:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      Definition:
        Comment: A description of my state machine
        StartAt: trello event type
        States:
          trello event type:
            Type: Choice
            Choices:
              - Next: Lambda Invoke
                Condition: >-
                  {% (($states.input.action.type) = ("updateCard") and
                  ($states.input.action.display.translationKey) =
                  ("action_added_a_due_date")) %}
            Default: Success
          Lambda Invoke:
            Type: Task
            Resource: arn:aws:states:::lambda:invoke
            Output: '{% $states.result.Payload %}'
            Arguments:
              FunctionName: ${lambdainvoke_FunctionName_ccca2377}
              Payload: '{% $states.input %}'
            Retry:
              - ErrorEquals:
                  - Lambda.ServiceException
                  - Lambda.AWSLambdaException
                  - Lambda.SdkClientException
                  - Lambda.TooManyRequestsException
                IntervalSeconds: 1
                MaxAttempts: 3
                BackoffRate: 2
                JitterStrategy: FULL
            End: true
          Success:
            Type: Succeed
        QueryLanguage: JSONata
      DefinitionSubstitutions:
        lambdainvoke_FunctionName_ccca2377: >-
          arn:aws:lambda:us-east-1:724772097129:function:lambda-create-record-notification-trello:$LATEST
      RoleArn:
        Fn::GetAtt:
          - Role470f0f3f
          - Arn
      StateMachineName: StateMachine80541e5e
      StateMachineType: STANDARD
      EncryptionConfiguration:
        Type: AWS_OWNED_KEY
      LoggingConfiguration:
        Level: 'OFF'
        IncludeExecutionData: false

  Role470f0f3f:
    Type: AWS::IAM::Role
    Properties:
      RoleName: StepFunctions_IAM_ROLE_trelloWhatsappStateMachine78bed1bd
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: states.amazonaws.com
            Action: sts:AssumeRole
      MaxSessionDuration: 3600

  Policy2bd1232d:
    Type: AWS::IAM::RolePolicy
    Properties:
      PolicyName: DynamoDBTableContentScopedAccessPolicycf373a3d
      RoleName:
        Ref: Role470f0f3f
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - dynamodb:GetItem
              - dynamodb:PutItem
              - dynamodb:UpdateItem
              - dynamodb:DeleteItem
            Resource:
              - >-
                arn:aws:dynamodb:us-east-1:724772097129:table/TrelloNotificationEvents

  Policyb218aea1:
    Type: AWS::IAM::RolePolicy
    Properties:
      PolicyName: LambdaInvokeScopedAccessPolicyff7103aa
      RoleName:
        Ref: Role470f0f3f
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - lambda:InvokeFunction
            Resource:
              - >-
                arn:aws:lambda:us-east-1:724772097129:function:lambda-create-record-notification-trello:*
          - Effect: Allow
            Action:
              - lambda:InvokeFunction
            Resource:
              - >-
                arn:aws:lambda:us-east-1:724772097129:function:lambda-create-record-notification-trello

  Policy0c0067d6:
    Type: AWS::IAM::RolePolicy
    Properties:
      PolicyName: XRayAccessPolicya9ae136e
      RoleName:
        Ref: Role470f0f3f
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - xray:PutTraceSegments
              - xray:PutTelemetryRecords
              - xray:GetSamplingRules
              - xray:GetSamplingTargets
            Resource:
              - '*'

Outputs:
  StateMachineArn:
    Description: ARN of the Step Functions State Machine
    Value:
      Ref: StateMachine80541e5e
    Export:
      Name: TrelloWhatsappStateMachineArn

  StateMachineName:
    Description: Name of the Step Functions State Machine
    Value:
      Ref: StateMachine80541e5e

Add the arn lambda for create lambda create scheduler.

Deploy CloudFormation Stack

aws cloudformation create-stack --stack-name trello-whatsapp-state-machine --template-body template.yaml --region us-east-1 --capabilities CAPABILITY_NAMED_IAM

Step Functions Workflow

Once you deploy the CloudFormation stack, your Step Functions State Machine will be created and will appear in the AWS Step Functions console. The state machine implements a filtering mechanism to process only relevant Trello events.

State Machine Purpose

The Step Functions State Machine evaluates incoming Trello webhook events and determines whether they should be processed by the Lambda function. It acts as a gatekeeper, filtering events based on specific criteria:

Action Type: Must be updateCard
Action Display Translation Key: Must be action_added_a_due_date

If the event meets both conditions, it is passed to the Lambda function for processing. If not, the execution terminates successfully without further processing.

State Machine Workflow

Trello Webhook Event
        ↓
   ┌─────────────────┐
   │  Trello event   │
   │     type        │
   └────────┬────────┘
            ↓
   ┌─────────────────────────────────────────┐
   │ Check:                                  │
   │ - action.type == "updateCard"           │
   │ - action.display.translationKey ==      │
   │   "action_added_a_due_date"             │
   └────────┬─────────────────────┬──────────┘
            │ YES                 │ NO
            ↓                     ↓
   ┌──────────────────┐   ┌──────────────┐
   │  Lambda Invoke   │   │   Success    │
   │  (Process Card)  │   │  (Terminate) │
   └──────────────────┘   └──────────────┘
            ↓
   ┌──────────────────────────────────┐
   │ Create EventBridge Schedule      │
   │ Send WhatsApp Notification       │
   └──────────────────────────────────┘

State Machine Components

Choice State: "trello event type"

This state evaluates the incoming Trello webhook event against two conditions:

Condition 1: action.type == "updateCard"
- Ensures the event is for a card update action
- Filters out other Trello actions like board updates, list changes, etc.
Condition 2: action.display.translationKey == "action_added_a_due_date"
- Ensures the card update is specifically a due date change
- Filters out other card updates like name changes, description changes, etc.

Logic:

If BOTH conditions are TRUE → Route to "Lambda Invoke" state
If EITHER condition is FALSE → Route to "Success" state (terminate execution)

Lambda Invoke State

This state invokes the Lambda function that will:

Create an EventBridge scheduler for the notification
Store the card information in DynamoDB
Calculate the notification timing based on the due date

Success State

This state terminates the execution successfully when:

The event is not a card update
The event is a card update but not a due date change
Any other non-matching scenarios

Example Scenarios

Scenario 1: Due Date Added to Card (✅ PROCESSES)

{
  "action": {
    "type": "updateCard",
    "display": {
      "translationKey": "action_added_a_due_date"
    },
    "data": {
      "card": {
        "id": "5f8c7d4e3c2b1a9d",
        "name": "Complete project documentation",
        "due": "2026-02-02T10:58:00.000Z"
      }
    }
  }
}

Result: ✅ Event passes both conditions → Lambda is invoked

Scenario 2: Card Name Changed (❌ DOES NOT PROCESS)

{
  "action": {
    "type": "updateCard",
    "display": {
      "translationKey": "action_changed_the_name"
    },
    "data": {
      "card": {
        "id": "5f8c7d4e3c2b1a9d",
        "name": "Updated card name"
      }
    }
  }
}

Result: ❌ Event fails translation key condition → Execution terminates

Scenario 3: Board Created (❌ DOES NOT PROCESS)

{
  "action": {
    "type": "createBoard",
    "display": {
      "translationKey": "action_created_board"
    },
    "data": {
      "board": {
        "id": "5f8c7d4e3c2b1a9d",
        "name": "New Board"
      }
    }
  }
}

Result: ❌ Event fails action type condition → Execution terminates

Benefits of This Filtering Approach

✅ Efficient: Only processes relevant due date events
✅ Cost-effective: Reduces unnecessary Lambda invocations
✅ Reliable: Prevents processing incomplete or irrelevant data
✅ Scalable: Handles high volume of Trello webhook events
✅ Maintainable: Clear, declarative logic for event filtering

Monitoring the State Machine

You can monitor your Step Functions State Machine executions in the AWS console:

Go to Step Functions in the AWS console
Click on StateMachine80541e5e
View execution history and logs
Check which events passed the filter and which were rejected
Debug any issues with event structure or conditions

Integration with Step Functions

The POST endpoint is integrated with AWS Step Functions, which orchestrates the workflow by filtering events and routing them to the appropriate Lambda function.

Configure API Gateway with Step Functions Integration

Now you need to configure the API Gateway POST endpoint to integrate directly with your Step Functions State Machine instead of using a Lambda function.

Step 1: Delete the Existing POST Method

Go to your API Gateway console
Select the POST method under /events
Click Delete Method
Confirm the deletion

Step 2: Create a New POST Method

In your API Gateway console, select the /events resource
Click on Create Method
Select POST from the dropdown menu
Click Create

Step 3: Configure POST Method Integration

In the integration setup page, fill in the following:
- Integration type: Select AWS Service
- AWS Service: Select Step Functions
- HTTP Method: Select POST
- Action Type: Select StartSyncExecution (for synchronous execution)
- Action: Enter StartSyncExecution
- Execution Role ARN: Select or create an IAM role that allows API Gateway to invoke Step Functions
In the Request section:
- Set Request Body Passthrough to When there are no templates defined (recommended)
Click Save

Step 4: Configure Request Mapping

Click on the POST method you just created
Click on Integration Request
Expand the Mapping Templates section
Click on Add mapping template
Enter application/json as the content type
In the template body, enter:

{
  "stateMachineArn": "arn:aws:states:us-east-1:724772097129:stateMachine:StateMachine80541e5e",
  "input": "$input.json('$')"

click create y and deploy the api changes

Test the Integration with Trello

Now that your API Gateway is configured and deployed, you can test the complete integration by setting a due date on a Trello card.

Step 1: Add a Due Date to a Trello Card

Go to your Trello Board
Select a card you want to test with
Click on the card to open it
In the card details panel, click on Due Date
Set a due date for the card (e.g., tomorrow at 10:00 AM)
Click Save

Screenshot

Step 2: Receive WhatsApp Notification

When the scheduled notification time arrives based on your due date, you will receive a WhatsApp message on your authorized phone number with the following information:

🎯 Task Name: The name of your Trello card
Board: The board the card belongs to
List: The list containing the card
Due Date: The formatted due date (DD/MM/YYYY HH:MM)
Link: Direct URL to the Trello card

Screenshot

How It Works

Set Due Date in Trello: You add or update a due date on a Trello card
Webhook Triggered: Trello sends a webhook event to your API Gateway endpoint
Step Functions Filter: The Step Functions State Machine evaluates the event
Lambda Processing: If the event matches the criteria, the Lambda function is invoked
EventBridge Scheduler Created: An EventBridge scheduler is created for the notification time
DynamoDB Storage: The card information is stored in DynamoDB
Scheduled Execution: At the scheduled time, another Lambda function is triggered
WhatsApp Message Sent: The WhatsApp notification is sent to your phone
Status Updated: The DynamoDB record is updated to mark the notification as sent

Notification Timing

The notification will be sent based on the due date:

If due date is > 24 hours away: Notification sent 1 day before the due date
If due date is 12-24 hours away: Notification sent 12 hours before the due date
If due date is < 12 hours away: No notification is scheduled (event may have already passed)

Example Scenario

Card Details:

Card Name: "Complete project documentation"
Board: "Working Tasks"
List: "In Progress"
Due Date: February 5, 2026 at 10:00 AM

Notification Timing:

If set on February 3, 2026: Notification sent on February 4, 2026 at 10:00 AM (1 day before)
If set on February 4, 2026 at 11:00 AM: Notification sent on February 5, 2026 at 10:00 AM (< 24 hours, so 12 hours before if applicable)

WhatsApp Message Received:

🎯 Trello Reminder Notification

Task: Complete project documentation
Board: Working Tasks
List: In Progress
Due Date: 05/02/2026 at 10:00

View Task: https://trello.com/c/RscETyKh

Please complete this task on time!

Update Due Date

You can also test the update functionality:

Go back to the same Trello card
Click on the due date to edit it
Change it to a different date/time
The DynamoDB Streams will trigger the Update Lambda
The EventBridge scheduler will be updated with the new date
You'll receive a WhatsApp notification at the new scheduled time

Bibliography and References

This document contains all the reference materials and documentation used in the development of the Trello WhatsApp Notifications system.

AWS Step Functions

AWS DynamoDB

DynamoDB Streams and Lambda Tutorial

Trello API Documentation

Meta WhatsApp Business API

WhatsApp Business API - Getting Started

Video Resources

AWS Step Functions Tutorial

Additional Resources

For more information about the technologies and services used in this project:

Asocia guias paso a paso con Amazon Q en Connect en ESPAÑOL, para mejorar la eficiencia en el centro de contacto

Nori — Fri, 31 Jan 2025 03:00:00 +0000

Por Eliana Perez

Amazon Q in Connect es una herramienta diseñada para ayudar a los agentes a encontrar soluciones rápidamente. Una de sus características clave es la capacidad de asociar guías paso a paso con el contenido de la base de conocimientos. Esto permite que, cuando Amazon Q in Connect recomiende una solución a un agente, también le ofrezca la opción de iniciar la guía paso a paso correspondiente. Desde Diciembre de 2024 en español.

Revisemos el paso a paso en detalle

Paso 1. Revisar en detalle la información que se va a integrar

Obtener el ID de la base de conocimiento (CLI)
aws qconnect list-knowledge-bases

el resultado de este comando es el knowledgeBaseId del paso 2

Paso 2. Obtener el Id de contenido (CLI)
aws qconnect list-contents \
--knowledge-base-id knowledgeBaseId

Paso 3. Obtenga el ARN del flujo de contacto donde se encuentra la guía paso a paso

Dentro de la instancia de Amazon Connect, revisa el flujo donde se encuentra la guía paso a paso que quieres activar.

Paso 4. Asociar el contenido a la guía paso a paso que quieres activar (CLI)
knowledgeBaseId (viene de Paso 1)
contentId (viene de Paso 2)
flowArn (viene de Paso 3)

aws qconnect create-content-association \
--knowledge-base-id knowledgeBaseId \
--content-id contentId \
--association-type AMAZON_CONNECT_GUIDE \
--association '{"amazonConnectGuideAssociation":{"flowId":"flowArn"}}'

Paso 5. Prueba que la asociación se ha realizado correctamente (CLI)
aws qconnect list-content-associations \
--knowledge-base-id knowledgebaseId \
--content-id contentId

Paso 6. Asignar los permisos en la instancia de Amazon Connect a los agentes, para que puedan usar tanto Amazon Q en Connect como las vistas personalizadas

Prueba en Acción

Escribe el procedimiento que deseas activar

Dar click en el boton SBS proceso de renovación

Se activara el proceso paso a paso en la vista personalizada en el escritorio del agente.

Asociar guías paso a paso con Amazon Q in Connect permite mejorar la eficiencia en el centro de contacto al proporcionar a los agentes instrucciones claras y estructuradas para resolver consultas y problemas de manera rápida y efectiva. Siguiendo estos pasos, podrás optimizar la experiencia de los agentes y mejorar la calidad del servicio ofrecido a los clientes. La integración adecuada y la asignación de permisos garantizan que los agentes puedan acceder fácilmente a la información relevante en el momento oportuno.

Habla con Amazon Q en Connect en Español

Nori — Fri, 31 Jan 2025 02:12:35 +0000

Por Eliana Perez

El pasado 19 de diciembre de 2024, AWS anunció que Amazon Connect ahora admite hasta 64 idiomas, incluyendo el español, gracias a la integración con Amazon Q(para negocios). Esto representa un gran avance para los centros de contacto que buscan ofrecer una mejor experiencia a sus clientes y agentes. Puedes leer el anuncio oficial en este enlace.

Pasemos a la implementación

Si deseas activar Amazon Q en Amazon Connect para configurar un agente en español, sigue estos pasos:

Paso 1. Activar la Característica de Amazon Q

Accede a la consola de AWS, ingresa a Amazon Connect y dentro de la configuración habilita la función Amazon Q

Paso 2. Crear un Dominio para Amazon Q

Define y crea un dominio específico para Amazon Q en la configuración.

Paso 3. Configurar una Llave de KMS

Establece una llave de KMS para garantizar la encriptación de los datos sensibles.

Paso 4. Seleccionar una Fuente de Información

Amazon Q puede integrarse con diferentes plataformas como:

Salesforce, ServiceNow, Zendesk, SharePoint Online, S3 (opción recomendada para pruebas)

Para una prueba rápida, selecciona S3 como la fuente de información y carga documentos relevantes.

Paso 5. Configurar el Bucket de S3

Sube documentos que actúen como base de conocimiento.

Consideraciones:

El tamaño máximo permitido es 1MB.

Se aceptan archivos en texto plano, Word y PDF.

Paso 6. Configurar la Base de Conocimiento

Agrega documentos de procesos relevantes que el agente de IA pueda utilizar como referencia.

Paso 7. Crear la Integración con Amazon Connect

Configura la integración con Amazon Connect para que Amazon Q quede activado y pueda operar dentro del centro de contacto.

Configuración de Amazon Q en Español

Seguimos la documentación de principio a fin en el siguiente enlace https://docs.aws.amazon.com/connect/latest/adminguide/customize-q.html

Paso 1. Crear un Nuevo Agente de IA (CLI)

Dado que el idioma predeterminado es inglés, se debe configurar un nuevo agente de IA en español.

Paso 2. Crear un Prompt IA con "Answer Recommendation" (CLI)

Define un prompt en formato YAML para guiar las respuestas del agente de IA.

Paso 3. Crear una Versión del Prompt (CLI)

Publica una versión del prompt generado.

Paso 4. Crear un Agente de IA (CLI)

Selecciona el tipo Answer Recommendation.

Configura el idioma del agente de IA en español.

Asocia este agente con el prompt creado.

Paso 5. Crear una Versión del Agente de IA (CLI)

Publica la versión del agente IA.

Paso 6. Asociar el Agente de IA con Amazon Q (CLI)

Vincula el agente de IA configurado con Amazon Q en la integración.

Se puede asignar este agente a todas las sesiones de Amazon Connect o personalizarlo por contacto.

Activar Amazon Q en el Flujo de Contacto

Configurar el Flujo de Contacto

Habilita Amazon Q en el flujo de contacto de Amazon Connect para que pueda asistir a los agentes y manejar interacciones con los clientes.

Disfruta conversar con tu asistente de IA mientras trabajas

De ahora en adelante, los agentes podrán hablarle en español al asistente, consultar que pueden hacer o activar procedimientos paso a paso.
TODO EN ESPAÑOL!!!

La capacidad de hablar en español dentro de los centros de contacto con Amazon Q en Connect representa un gran avance para los agentes y la experiencia del cliente. Ahora, los agentes pueden recibir asistencia en su idioma nativo, mejorando la eficiencia y reduciendo errores en la atención al cliente.

Además, la posibilidad de integrar un agente de IA no solo facilita la interacción en español, sino que también permite automatizar tareas, mejorar la gestión de consultas frecuentes y optimizar los tiempos de respuesta en los centros de contacto.

Con esta integración, las empresas pueden ofrecer un soporte más rápido y eficiente, logrando una mejor experiencia tanto para los clientes como para los agentes.

Automatización para la creación de imágenes con Amazon EC2 Image Builder

Nori — Mon, 25 Mar 2024 15:36:38 +0000

By: Eliana Perez
Si tienes que desplegar o administrar imágenes de máquinas virtuales con EC2 Image Builder desde novato a experto, este tutorial te va a servir. ¡Guárdalo!

Builder nivel 100

¿Qué es una AMI?
Una AMI (Amazon Machine Image) es una plantilla de virtualización utilizada para crear instancias de máquinas virtuales (VM) en Amazon Web Services (AWS). Una AMI proporciona la información necesaria para lanzar una instancia EC2 (Elastic Compute Cloud) que puede ser una máquina virtual de Windows o Linux, junto con el software preinstalado, configuraciones del sistema o personalizadas y datos asociados.

Con las AMIs podremos desplegar entornos de computación en la nube de manera rápida y consistente.

Hay AMIs ofrecidas por AWS y podemos crear AMIs propias.
En este video se muestra como lanzar una instancia de EC2 con una AMI personalizada. Es el mismo proceso para imágenes de Amazon o de terceros.
https://www.youtube.com/watch?v=Kg1XRjOHqFY

En este video se muestra como lanzar una instancia EC2 con AMI de Windows
https://www.youtube.com/watch?v=DshwCN2twuE

Builder nivel 200

Inicialmente la gestión y actualización de imágenes puede realizarse de forma manual. Pero bien podría automatizarse este proceso utilizando el creador de imágenes EC2 que simplifica la creación, el mantenimiento, la validación, el intercambio y la implementación de imágenes de Linux o Windows para usarlas con Amazon EC2 y en las premisas. Así habrá mayor productividad, soporte integrado y conformidad con la postura de seguridad de la organización.

Este tutorial técnico ayudará con la automatización de la creación de imágenes utilizando EC2 Image Builder
https://www.youtube.com/watch?v=YP2hPUq-VAc&t=15s

Este workshop te llevará paso a paso en la automatización para creación de imágenes en Windows. Aplica igualmente para Linux
https://catalog.us-east-1.prod.workshops.aws/workshops/d6c7ecdc-c75f-4ad1-910f-fdd994cc4aed/en-US

Builder nivel 300

Caso de Uso
El equipo de seguridad, libera una nueva imagen (AMI) con las últimas actualizaciones de seguridad para los sistemas operativos Windows y Linux.
De forma automatizada debe crearse una nueva AMI que, a partir de la AMI entregada por el equipo de seguridad, agregue datos, software pre-instalado y configuraciones de sistema o personalizada, para posteriormente activar el despliegue de un nuevo pipeline que cree las nuevas instancias, con la nueva configuración y apague las instancias que ya no son conformes.
El objetivo es que el equipo de pruebas trabaje en un sistema operativo conforme con la postura de seguridad de la organización, sin perder eficiencia en los recursos, productividad en los equipos o elevar los costos.

Solución
Cada vez que se genera una nueva actualización del equipo de seguridad, se detectará el evento que viene a través de Amazon Eventbridge, automáticamente se creará una nueva versión de la imagen (ya conforme y con las configuraciones necesarias) con EC2 Image Builder y se notificará al pipeline que activará la creación de las nuevas instancias de EC2 sobre las que debe trabajar el equipo de pruebas. Se notificará del proceso a través del canal de slack correspondiente con AWS chatbot.

Arquitectura de la solución

Amazon Eventbridge es un enrutador de eventos que se encarga en este caso de llevar a quien lo solicite la información de que una nueva AMI de seguridad está disponible. Para ello se debe crear la siguiente regla.
En este contexto solo el equipo de seguridad crea las AMIs

1.  {
2.  "source": ["aws.ec2"],
3.  "detail-type": ["EC2 AMI State Change"],
4.  "detail": {
5.  "State": ["available"]
6.  }
7.  }

Una Función Lambda se encargará de procesar el evento. Básicamente, una función Lambda es una pieza de código que se ejecuta en la nube de AWS en respuesta a eventos específicos, como cambios en la creación de AMIs, cambio en los datos, solicitudes HTTP, actualizaciones de bases de datos, cargas de archivos, etc. Puedes escribir funciones Lambda en varios lenguajes de programación, como Python, Node.js, Java, C#, entre otros.
La función lambda recibe como entrada el evento que se generó desde Eventbridge con el siguiente payload

1.  {
2.  "version": "0",
3.  "id": "123f456f-7b89-c012-d3cb-e4567de8901e",
4.  "detail-type": "EC2 AMI State Change",
5.  "source": "aws.ec2",
6.  "account": "123456789012",
7.  "time": "2024-01-09T14:46:28Z",
8.  "region": "us-east-x",
9.  "resources": [
10. "arn:aws:ec2:us-east-x::image/ami-1c2df3456fe78901b"
11. ],
12. "detail": {
13. "RequestId": "1a2c345a-fdd6-78b9-01bf-2eedb345678b",
14. "State": "available",
15. "ImageId": "ami-1c2df3456fe78901b",
16. "ErrorMessage": ""
17. }
18. }

La función lambda está hecha en Python por lo que utilizaremos la librería boto3 v 1.34.69. Utilizas el SDK de AWS para Python (Boto3) para crear, configurar y gestionar servicios de AWS, como Amazon Elastic Compute Cloud (Amazon EC2) y Amazon Simple Storage Service (Amazon S3). El SDK proporciona una API orientada a objetos, así como acceso de bajo nivel a los servicios de AWS. Aquí está el enlace que te llevará a la documentación de EC2 Image Builder
https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/imagebuilder.html

Retomando EC2 Image Builder
Un pipeline de imagen para automatizar la creación de AMIs, necesita al menos una Receta de Imagen y una Configuración de Infraestructura. Las recetas de Imagen son un recurso versionado que contiene una imagen Padre y unos componentes.
La versión de la receta de imagen debemos obtenerla en la función lambda
La imagen padre es la imagen enviada por el equipo de seguridad de la que debemos tener su ARN.
Los componentes son los bloques de construcción que son consumidos por una receta de imagen, por ejemplo, paquetes para instalación, pasos de endurecimiento de seguridad y pruebas.
Son básicamente 3 pasos

Una receta de imagen es un documento que define los componentes que se van a aplicar a las imágenes base para crear la configuración deseada para la imagen de salida. Luego de crear la receta, no es posible modificarla. Se debe crear una nueva versión para cambiar los componentes.
Los componentes de compilación y las pruebas forman parte de una receta. Los componentes de compilación contienen software, ajustes y configuraciones que se instalan o aplican durante el proceso de creación de imágenes personalizadas. Las pruebas se ejecutan después de crear una imagen personalizada para validar la funcionalidad, la seguridad, el rendimiento, etc.

La creación de estos componentes también puede automatizarse utilizando AWS CloudFormation y entregarlos a la función Lambda como variables de entorno. AWS CloudFormation es un servicio de infraestructura como código (IaC) que te permite modelar, aprovisionar y gestionar fácilmente recursos de AWS y de terceros.
Aquí un ejemplo de como crear una carpeta. Se define como componente, se le da un nombre un sistema operativo, descripción, versión, pasos y acciones a tomar para la creación de esa carpeta.

CreateFolderComponent:
    Type: 'AWS::ImageBuilder::Component'
    Properties:
      Name: 'folderssTestingHubCreation'
      Platform: 'Linux'
      Version: '1.0.2'
      Description: 'This component create a folder called TestingHub in the ubuntu user folder and delete the .m2 folder'
      SupportedOsVersions: 
        - 'Ubuntu 20'
      # Require one of 'Data' or 'Uri' for Component template
      Data: |
        name: CreationOfTestingHubFolder
        description: This is to create TestingHub folder on the root path
        schemaVersion: 1.0

        phases:
          - name: build
            steps:

              - name: CreatingFolderLinux
                action: CreateFolder
                inputs:
                  - path: /home/ubuntu/TestingHubDeepak3

              - name: DeletingFolderM2
                action: DeleteFolder
                inputs:
                  - path: /home/ubuntu/.m2
                    force: true

Dado que la función lambda donde se va a procesar el evento es stateless, se debe guardar la información de la versión de la receta de imagen en un sitio seguro. AWS proporciona ese sitio en el servicio AWS System Manager Parameter store. El Parameter Store se utiliza comúnmente para almacenar datos de configuración que necesitan ser compartidos entre diferentes servicios o instancias de EC2, como configuraciones de aplicaciones, credenciales, rutas de conexión a bases de datos, etc. Proporciona integraciones con otros servicios de AWS, como AWS Lambda, Amazon ECS, Amazon EC2, entre otros, lo que facilita el acceso seguro a los datos de configuración desde diferentes partes de tu infraestructura.
Ya con los recursos necesarios para crear la receta de imagen procedemos a crear la función Lambda

Lógica de la función Lambda

Se recibe el evento
Si el nombre de la ami que esta disponible comienza con un prefijo especifico continuamos
Se carga en la función la lista de componentes que van a ejecutarse en la receta de imagen
Se obtiene y actualiza la ultima versión de la receta de Imagen
Se actualiza esta nueva versión en el pipeline de EC2 Image Builder
Se crea la nueva imagen
Se activa el pipeline de creación de la nueva receta de imagen
Inicia el proceso de notificación con aws chatbot y publica el tópicon con SNS

Cuando se actualiza el ID de la nueva AMI, el pipeline que despliega las instancias EC2 ya conformes, detecta el evento a través de una regla de Eventbridge, activa la ejecución del Pipeline, se crean las nuevas instancias, se apagan las que ya estaban y ya el equipo de pruebas puede continuar sin problema.
Con esta automatización se puede reducir a horas la aplicación de políticas de conformidad, así como la carga operativa necesaria para mantener la postura de seguridad de la organización.

Función Lambda

import json
import boto3
import os



#Boto3 Clients
imageBuilder = boto3.client('imagebuilder')
ec2 = boto3.client('ec2')
ssm = boto3.client('ssm')

#environment variables

testRecipeArn= os.environ['testRecipeArn']
infrastructureConfigurationArn= os.environ['infrastructureConfigurationArn'] 
imagepipelineArn = os.environ['imagepipelineArn']
ssmPath = os.environ['ssmPath']
components= os.environ['components']


def lambda_handler(event, context):
    # Image Id delivers by Event Bridge event
    amiId= event['detail']['ImageId']

    # Get the name associated with the Ami ID
    amiInformation= ec2.describe_images(ImageIds=[ amiId, ],)
    amiName= amiInformation['Images'][0]['Name']

      # Compare if the name Ami starts with the specific pattern
    if amiName.startswith('testRecipe') :
        try:
            print('Correct Image')

            #create components array

            componentsRecipe= components.split(',')
            component = [{"componentArn": arn} for arn in componentsRecipe]

            print(component)

            # get Actual version
            version = ssm.get_parameter(Name=ssmPath)['Parameter']['Value']
            values = version.split('.')
            nextVersion = int(values[2]) + 1

            # Convert nextVersion to string before concatenating
            newValueVersion = values[0]+"."+ values[1]+"."+ str(nextVersion)

            print(newValueVersion)

            #update new value version
            ssm.put_parameter(Name=ssmPath, Value=newValueVersion, Type="String", Overwrite=True)


            # Create the new Image Recipe with the new AMI 
            newImageRecipe = imageBuilder.create_image_recipe(
                name='testRecipe',
                description='newversion' + newValueVersion,
                semanticVersion=newValueVersion,
                components=component,
                parentImage=amiId
            )
            # Get the new recipe Arn
            newImageRecipeArn = newImageRecipe['imageRecipeArn']

            # Update the Image Pipeline with the new Image Recipe
            response = imageBuilder.update_image_pipeline(
                imagePipelineArn=imagepipelineArn,
                description='new version for imagepipeline' + newValueVersion,
                imageRecipeArn=newImageRecipeArn,
                infrastructureConfigurationArn=infrastructureConfigurationArn
            )

        except Exception as e:
            print("Error:", e)

Template CloudFormation para automatizar todo el proceso

# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
AWSTemplateFormatVersion: 2010-09-09
Transform: 'AWS::Serverless-2016-10-31'


Resources:
  # Create an S3 Bucket for logs.
  # When deleting the stack, make sure to empty the bucket first.
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket.html
  ImageBuilderLogBucket:
    Type: AWS::S3::Bucket
    # If you want to delete the stack, but keep the bucket, set the DelectionPolicy to Retain.
    # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html
    # DeletionPolicy: Retain
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        IgnorePublicAcls: true
        BlockPublicPolicy: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled

  # By default, AWS Services do not have permission to perform actions on your instances. This grants
  # AWS Systems Manager (SSM) and EC2 Image Builder the necessary permissions to build an image.
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html
  # https://docs.aws.amazon.com/imagebuilder/latest/userguide/image-builder-setting-up.html
  InstanceRole:
    Type: AWS::IAM::Role
    Metadata:
      Comment: Role to be used by instance during image build.
    Properties:
      ManagedPolicyArns:
        - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/AmazonSSMManagedInstanceCore
        - Fn::Sub: arn:${AWS::Partition}:iam::aws:policy/EC2InstanceProfileForImageBuilder
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - !Sub 'ec2.${AWS::URLSuffix}'
        Version: '2012-10-17'
      Path: /executionServiceEC2Role/

  # Policy to allow the instance to write to the S3 bucket (via instance role / instance profile).
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
  InstanceRoleLoggingPolicy:
    Type: AWS::IAM::Policy
    Metadata:
      Comment: Allows the instance to save log files to an S3 bucket.
    Properties:
      PolicyName: ImageBuilderLogBucketPolicy
      Roles:
        - Ref: InstanceRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Action:
              - s3:PutObject
            Effect: Allow
            Resource:
              - Fn::Sub:
                  - arn:${AWS::Partition}:s3:::${BUCKET}/*
                  - BUCKET:
                      Ref: ImageBuilderLogBucket

  # To pass the InstanceRole to an EC2 instance, we need an InstanceProfile.
  # This profile will be used during the image build process.
  # https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html
  InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /executionServiceEC2Role/
      Roles:
        - Ref: InstanceRole

  # Specifies the infrastructure within which to build and test your image.
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-imagebuilder-infrastructureconfiguration.html
  Ubuntu2004ImageInfrastructureConfiguration:
    Type: AWS::ImageBuilder::InfrastructureConfiguration
    Properties:
      InstanceTypes:
        - 'm4.large'
        - 'm5.large'
      Name: Ubuntu-2004-with-latest-SSM-Agent-Infrastructure-Configuration
      InstanceProfileName:
        Ref: InstanceProfile
      # Specify an S3 bucket and EC2 Image Builder will save logs to the bucket.
      Logging:
        S3Logs:
          S3BucketName:
            Ref: ImageBuilderLogBucket
          # S3KeyPrefix: 'my-imagebuilder-bucket-prefix'
      # If you would like to keep the instance running after a failed build, set TerminateInstanceOnFailure to false.
      # TerminateInstanceOnFailure: false
      # If you do not have a default VPC or want to use a different VPC, you must specify the subnet ID to use
      # SubnetId: 'subnet-id'

  # The CloudWatch LogGroup for the image build logs is provided to ensure the LogGroup is cleaned up if the stack is deleted.
  Ubuntu2004LogGroup:
    Type: AWS::Logs::LogGroup
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      LogGroupName: /aws/imagebuilder/Ubuntu-2004-with-latest-SSM-Agent
      RetentionInDays: 3

  # Recipe which references the latest (x.x.x) version of the Amazon Linux 2 AMI).
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-imagebuilder-imagerecipe.html
  Ubuntu2004ImageRecipe:
    Type: AWS::ImageBuilder::ImageRecipe
    Properties:
      Name: Ubuntu-2004-with-latest-SSM-Agent
      Version: 1.0.1
      # ${AWS::Partition} returns the partition where you are running the CloudFormation template. For standard AWS regions, the
      # partition is aws. For resources elsewhere, the partition is aws-partitionname. For example, China (Beijing and Ningxia)
      # regions use aws-cn and AWS GovCloud (US) regions are aws-us-gov.
      # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html
      ParentImage:
        Fn::Sub: arn:${AWS::Partition}:imagebuilder:${AWS::Region}:aws:image/ubuntu-server-20-lts-x86/x.x.x
      Components:
        - ComponentArn:
            Fn::Sub: arn:aws:imagebuilder:${AWS::Region}:aws:component/amazon-cloudwatch-agent-linux/x.x.x
        - ComponentArn: 
            Fn::Sub: arn:aws:imagebuilder:${AWS::Region}:aws:component/amazon-corretto-11-apt-generic/x.x.x
        - ComponentArn:
            Fn::Sub: arn:aws:imagebuilder:${AWS::Region}:aws:component/powershell-linux/x.x.x
        - ComponentArn: !Ref CreateFolderComponent
        - ComponentArn: !Ref MavenInstallationComponent

  # Create an SSM Parameter Store entry with our resulting ImageId.
  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-parameter.html

  Ubuntu2004WithLatestSSMAgentParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Description: image recipe latest version for image build pipeline 
      Name: /ec2ImageBuilder/imageRecipeVersion
      Type: String
      Value: '0.0.1'

  ImagePipelineBami:
    Type: 'AWS::ImageBuilder::ImagePipeline'
    Properties:
      Name: 'golden-image-for-BAMI'
      Description: 'description'
      ImageRecipeArn: !Ref Ubuntu2004ImageRecipe
      InfrastructureConfigurationArn: !Ref Ubuntu2004ImageInfrastructureConfiguration
      ImageTestsConfiguration:
        ImageTestsEnabled: false
        TimeoutMinutes: 90

  CreateFolderComponent:
    Type: 'AWS::ImageBuilder::Component'
    Properties:
      Name: 'folderssTestingHubCreation'
      Platform: 'Linux'
      Version: '1.0.2'
      Description: 'This component create a folder called TestingHub in the ubuntu user folder and delete the .m2 folder'
      SupportedOsVersions: 
        - 'Ubuntu 20'
      # Require one of 'Data' or 'Uri' for Component template
      Data: |
        name: CreationOfTestingHubFolder
        description: This is to create TestingHub folder on the root path
        schemaVersion: 1.0

        phases:
          - name: build
            steps:

              - name: CreatingFolderLinux
                action: CreateFolder
                inputs:
                  - path: /home/ubuntu/TestingHubDeepak3

              - name: DeletingFolderM2
                action: DeleteFolder
                inputs:
                  - path: /home/ubuntu/.m2
                    force: true

  MavenInstallationComponent:
    Type: 'AWS::ImageBuilder::Component'
    Properties:
      Name: 'MavenComponent'
      Platform: 'Linux'
      Version: '1.0.0'
      Description: 'This component is to install maven'
      SupportedOsVersions: 
        - 'Ubuntu 20'
      # Require one of 'Data' or 'Uri' for Component template
      Data: |
        name: Maven
        description: This is to install Maven
        schemaVersion: 1.0
        phases:
          - name: build
            steps:
              - name: Install_Maven
                action: ExecuteBash
                inputs:
                  commands:
                    - sudo apt update
                    - sudo apt install maven -y

## Lambdas Event Management 

  StartImagePipelineLambda:
    Type: 'AWS::Serverless::Function'
    Properties:
      Handler: startImagePipeline.lambda_handler
      Runtime: python3.8
#      CodeUri: ../functions/startImagePipeline
      InlineCode: |
        import json
        import boto3
        import os



        #Boto3 Clients
        imageBuilder = boto3.client('imagebuilder')
        ec2 = boto3.client('ec2')
        ssm = boto3.client('ssm')

        #environment variables

        testRecipeArn= os.environ['testRecipeArn']
        infrastructureConfigurationArn= os.environ['infrastructureConfigurationArn'] 
        imagepipelineArn = os.environ['imagepipelineArn']
        ssmPath = os.environ['ssmPath']
        components= os.environ['components']


        def lambda_handler(event, context):
            # Image Id delivers by Event Bridge event
            amiId= event['detail']['ImageId']

            # Get the name associated with the Ami ID
            amiInformation= ec2.describe_images(ImageIds=[ amiId, ],)
            amiName= amiInformation['Images'][0]['Name']

              # Compare if the name Ami starts with the specific pattern
            if amiName.startswith('testRecipe') :
                try:
                    print('Correct Image')

                    #create components array

                    componentsRecipe= components.split(',')
                    component = [{"componentArn": arn} for arn in componentsRecipe]

                    # get Actual version
                    version = ssm.get_parameter(Name=ssmPath)['Parameter']['Value']
                    values = version.split('.')
                    nextVersion = int(values[2]) + 1

                    # Convert nextVersion to string before concatenating
                    newValueVersion = values[0]+"."+ values[1]+"."+ str(nextVersion)

                    print(newValueVersion)

                    #update new value version
                    ssm.put_parameter(Name=ssmPath, Value=newValueVersion, Type="String", Overwrite=True)

                    # Delete the last 5 characters
        #            modifyVersionImageRecipe = testRecipeArn[:-5]
        #            actualVersionImageRecipe = modifyVersionImageRecipe + version


                    # Get the last Image Recipe components 
        #            getImageRecipe= imageBuilder.get_image_recipe(imageRecipeArn=actualVersionImageRecipe)
        #            components= getImageRecipe['imageRecipe']['components']

                    # Create the new Image Recipe with the new AMI 
                    newImageRecipe = imageBuilder.create_image_recipe(
                        name='testRecipe',
                        description='newversion' + newValueVersion,
                        semanticVersion=newValueVersion,
                        components=component,
                        parentImage=amiId
                    )
                    # Get the new recipe Arn
                    newImageRecipeArn = newImageRecipe['imageRecipeArn']

                    # Update the Image Pipeline with the new Image Recipe
                    response = imageBuilder.update_image_pipeline(
                        imagePipelineArn=imagepipelineArn,
                        description='new version for imagepipeline' + newValueVersion,
                        imageRecipeArn=newImageRecipeArn,
                        infrastructureConfigurationArn=infrastructureConfigurationArn
                    )

        #        
        #            response = imageBuilder.start_image_pipeline_execution(
        #                imagePipelineArn='arn:aws:imagebuilder:us-east-1:012983038368:image-pipeline/golden-image-for-bami'
        #            )
        #            print("Image pipeline execution started successfully.")
        #            print("Execution ID:", response.get('clientToken'))
                except Exception as e:
                    print("Error:", e)
      Description: Lamdba function to trigger Image Build when a new DAMI is created 
      Environment:
        Variables:
          testRecipeArn: !Ref 'Ubuntu2004ImageRecipe'
          infrastructureConfigurationArn: !Ref 'Ubuntu2004ImageInfrastructureConfiguration'
          imagepipelineArn: !Ref 'ImagePipelineBami'
          ssmPath: !Ref 'Ubuntu2004WithLatestSSMAgentParameter'
          components: 
            Fn::Sub: arn:aws:imagebuilder:${AWS::Region}:aws:component/amazon-cloudwatch-agent-linux/x.x.x,arn:aws:imagebuilder:${AWS::Region}:aws:component/amazon-corretto-11-apt-generic/x.x.x,${CreateFolderComponent.Arn},${MavenInstallationComponent.Arn}


      MemorySize: 128
      Timeout: 300
      Role: !GetAtt 'StartImagePipelineRole.Arn'


  StartImagePipelineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
      Policies:
        - PolicyName: StartImagePipelineLambdaPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Resource: "*"
                Action:
                  - 'ssm:DescribeParameters'
                  - 'ssm:GetParameter'
                  - 'ssm:PutParameter'
                  - 'ssm:GetParameters'
              - Effect: Allow
                Resource: "*"
                Action: 
                  - 'ec2:DescribeImages'
              - Effect: Allow
                Action:
                  - 'imagebuilder:GetWorkflow'
                  - 'imagebuilder:GetComponent'
                  - 'imagebuilder:TagResource'
                  - 'imagebuilder:GetImagePipeline'
                  - 'imagebuilder:GetImageRecipe'
                  - 'imagebuilder:CreateImageRecipe'
                  - 'imagebuilder:GetContainerRecipe'
                  - 'imagebuilder:GetDistributionConfiguration'
                  - 'imagebuilder:GetImage'
                  - 'iam:PassRole'
                  - 'iam:CreateServiceLinkedRole'
                  - 'imagebuilder:GetInfrastructureConfiguration'
                  - 'imagebuilder:UpdateImagePipeline'
                Resource: "*"

  AmiAvailableEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: "Event rule that captures when a new AMI is available"
      State: "ENABLED"
      EventPattern:
        source:
          - aws.ec2
        detail-type:
          - EC2 AMI State Change
        detail:
          state:
            - available
      Targets:
        - Arn: !GetAtt 'StartImagePipelineLambda.Arn'
          Id: !Ref 'StartImagePipelineLambda'

  SlackNotificationJavaPipelinepEventsRulePermissions:
      Type: AWS::Lambda::Permission
      Properties:
        FunctionName: !Ref 'StartImagePipelineLambda'
        Action: lambda:InvokeFunction
        Principal: events.amazonaws.com
        SourceArn: !GetAtt 'AmiAvailableEventRule.Arn'

######## AWS CHATBOT NOTIFICATIONS RESOURCES #########

  AwsChatbotNotification:
    Type: AWS::Chatbot::SlackChannelConfiguration
    Properties:
      ConfigurationName: codePipelineStartnotificationJavaCode
      IamRoleArn: !GetAtt 'AwsChatBotIamRole.Arn'
      LoggingLevel: 'ERROR'
      SlackChannelId: "xxxxxxxxxxxx" #!Ref SlackChannelId
      SlackWorkspaceId: "xxxxxxxxxx" #!Ref SlackWorkspaceId
      SnsTopicArns: 
        - !Ref 'AwsChatbotSnsTopicLambda'

  AwsChatbotSnsTopicLambda:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: AwsChatbotSnsTopicLambda
      KmsMasterKeyId:
        Ref: SNSKmsAlias

  SNSKmsAlias:
    Type: 'AWS::KMS::Alias'
    Properties:
      AliasName:
        'Fn::Join':
          - '-'
          - - alias/SnsServiceKmsKey
            - 'Fn::Sub': '${AWS::StackName}'
      TargetKeyId:
        Ref: SNSKmsKey

  SNSKmsKey:
    Type: 'AWS::KMS::Key'
    Properties:
      Description: This is used to encrypt-decrypt the SNS.
      EnableKeyRotation: 'true'
      KeyPolicy:
        Statement:
          - Action:
              - 'kms:Create*'
              - 'kms:Describe*'
              - 'kms:Enable*'
              - 'kms:List*'
              - 'kms:Put*'
              - 'kms:Update*'
              - 'kms:Revoke*'
              - 'kms:Disable*'
              - 'kms:Get*'
              - 'kms:Delete*'
              - 'kms:ScheduleKeyDeletion'
              - 'kms:CancelKeyDeletion'
              - 'kms:UntagResource'
              - 'kms:TagResource'
            Effect: Allow
            Principal:
              AWS:
                - 'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:root'
            Resource: '*'
            Sid: Allow access for Key Administrators
          - Action:
              - 'kms:Encrypt'
              - 'kms:Decrypt'
              - 'kms:ReEncrypt*'
              - 'kms:GenerateDataKey*'
              - 'kms:DescribeKey'
            Effect: Allow
            Principal:
              AWS:
                - 'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:root'
                - 'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder'
              Service: cloudwatch.amazonaws.com
            Resource: '*'
            Sid: Allow use of the key
          - Action:
              - 'kms:CreateGrant'
              - 'kms:ListGrants'
              - 'kms:RevokeGrant'
            Condition:
              Bool:
                'kms:GrantIsForAWSResource': true
            Effect: Allow
            Principal:
              AWS:
                - 'Fn::Sub': 'arn:aws:iam::${AWS::AccountId}:root'
            Resource: '*'
            Sid: Allow attachment of persistent resources
          - Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: 
              - 'kms:Decrypt'
              - 'kms:GenerateDataKey*'
            Resource: '*'
          - Action:
              - 'kms:GenerateDataKey*'
              - 'kms:Decrypt'
            Condition:
              StringEquals:
                'kms:ViaService': sns.us-east-1.amazonaws.com
            Effect: Allow
            Principal:
              Service: codestar-notifications.amazonaws.com
            Resource: '*'
            Sid: Allow codepiple to push message to encrypted sns
        Version: '2012-10-17'

  EventTopicPolicy:
    Type: 'AWS::SNS::TopicPolicy'
    Properties:
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: 
                - events.amazonaws.com
                - codestar-notifications.amazonaws.com
            Action: 
              - 'sns:Publish'
            Resource: !Ref AwsChatbotSnsTopicLambda
      Topics:
        - !Ref AwsChatbotSnsTopicLambda

  AwsChatBotIamRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - config.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
      - PolicyName: AwsChatBotIamPolicyName
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Action:
                - s3:PutObject*
              Resource:
                - arn:aws:s3:::bucket-name/*
              Effect: Allow
              Condition:
                StringLike:
                  s3:x-amz-acl: bucket-owner-full-control
            - Action:
                - s3:GetBucketAcl
              Resource:
                - arn:aws:s3:::bucketname
              Effect: Allow
            - Effect: Allow
              Action:
                - kms:Encrypt
                - kms:Decrypt
                - kms:ReEncrypt*
                - kms:GenerateDataKey*
                - kms:DescribeKey
              Resource:
                - !GetAtt SNSKmsKey.Arn

Espero te sea de mucha utilidad! Disfrutalo!

Building AWS Solution Architectures from the organisation's Reference Architecture

Nori — Thu, 21 Mar 2024 18:06:18 +0000

By: Eliana Perez
One of many approaches to developing solution architectures involves iterative trial and error. Team members propose several architectural experiments aligned to specific quality attributes and, based on the results, make decisions on design and technology choices for subsequent implementation. However, this approach can be problematic if the experiments do not meet essential criteria, such as security requirements, desired level of integration or failure to deliver tangible business value. In such cases, the consequences can be severe, resulting in wasted time, financial resources and operational inefficiencies that could have been avoided.

To address the limitations of the trial-and-error approach, forward-thinking organizations adopt a more structured methodology. Business architects meticulously design the organization's blueprints, much like how architects create detailed plans for a building. These comprehensive blueprints are then handed over to solution architects, who leverage them to propose tailored technology components that support specific business initiatives. This process leads to the development of distinct solution architectures for each initiative across the organization. Over time, a repository of these architectures accumulates, enabling potential reuse. However, merely reusing previous architectures does not inherently resolve operational inefficiencies or escalating costs. To truly optimize, a more holistic and proactive approach is necessary.

While the initial investment may seem slower, organizations can adopt a more resource-efficient and ultimately agile approach by developing their own reference architecture. This reference architecture serves as a reliable foundation that empowers the organization to address diverse technological challenges systematically. It eliminates the need to repeatedly revisit previous architectures that may be questionable or necessitate a comprehensive review across all organizational domains, whenever a new solution requires design. By establishing a cohesive and well-defined reference architecture, organizations can streamline the solution design process, fostering both efficiency and agility in the long run.

Building upon the business-oriented architecture, the reference architecture comprehensively documents the organizational processes, integration mechanisms, and technology services required to deliver business capabilities effectively. It also encompasses the existing technology infrastructure that underpins the organization's entire operational structure. Consequently, the reference architecture serves as a centralized and authoritative repository, encapsulating detailed blueprints spanning all aspects of the organization, from business domains to technological components. This multifaceted documentation enables solution architects to leverage the reference architecture as a foundation, perform necessary analysis and engineering, and iteratively derive optimized solution designs. These designs can then be systematically experimented with and subsequently implemented, with the assurance that they inherently align with the organization's overarching strategy and standards. By fostering such alignment, the reference architecture streamlines decision-making processes, ensuring that solutions are delivered in a cost-effective and efficient manner.

With the organization's reference architecture as a foundation, the solution architect's primary responsibility is to design a tailored technological structure that addresses specific business requirements. This structure must encompass a robust technology component that seamlessly integrates AWS's best practices and guidelines for architecting well-formed cloud solutions, as outlined in the Well-Architected Framework. Furthermore, the solution architect should leverage the comprehensive resources available in the AWS Architecture Center to ensure the proposed solution adheres to industry-leading design principles and architectural patterns. By harmonizing the organization's reference architecture with AWS's proven methodologies and extensive knowledge base, the solution architect can deliver an optimized and future-proof design that aligns with both business objectives and cloud-native architectural principles.

The following image shows a reference architecture and how the different solutions stem from the technology component, facilitating and streamlining the architect's work, as they only need to refer to this document to generate solutions aligned with the organization. In the example case, a CRM solution with Salesforce and a chatbot solution.

To better illustrate the concept, let's examine a practical example centered around an organization specializing in dessert sales.

Organization: Ana's Dessert
Mission: All people with diabetes feel happy and healthy when eating Ana's Dessert.
Vision: Any diabetic in Colombia will be able to buy Ana's Dessert.
2024 Goal: Any diabetic in Madrid and Alicante will be able to buy Ana's Dessert.
2024 Strategy and Strategic Actions: Increase revenue from sales through different channels.
AS-IS Business: Dessert sales are made only through instant messaging using WhatsApp. One person attends the chat 24/7.

Reference Architecture for Ana's Dessert:
Like any architecture, it has structural components, the relationships between them, and different views that facilitate decision-making for stakeholders, including the solution architect, regarding technology.

Functional View: Diagram created by business-oriented architects showing the process, channels, and mission and support services for delivering a dessert.
Integration View: Diagram including the technology mechanisms required to connect the different activities of the processes, processes, channels, and services that enable the delivery of a dessert. E.g., ESB, REST.
Information View: The data required at the business level, its structure, canonical or governance models, and data architectures that allow the delivery of a dessert. E.g., Data Lake.
Technology View: Hardware and software currently used for production solutions and authorized providers for delivering future technology solutions. (This is where AWS appears as a cloud service provider.) E.g., image of accredited providers for the company.

Technology Initiative

According to the strategy, the initiative is to expand the channels offered to dessert buyers and thus increase sales.

Going through the reference architecture, the use case is generated:
For digital customers (users),
the dessert sales service 24/7 from WhatsApp, Web, and Telephony channels is required. (Service)
So that they can select, place orders, make payments, and request delivery of their order in the cities of Madrid and Alicante. (Required business capabilities)

Solution

The technology, integration, and information views, along with the use case, form the conditions under which the solution must be generated.

Solution Design

Solution Geography: Madrid and Alicante
IT Services: Website chat, Voice (VoIP-PSTN), WhatsApp app, DB, CRM
Users: Customers in Madrid and Alicante (5,000 users per month, 10 concurrent)
Users per service: 3,000 WhatsApp, Estimated (500 Voice, 1,500 Web Chat) - 3 agents per 3 channels
Communication Flow: Web 50 messages per order - Voice 4 minutes (Average call time)
Technology: Here is where the conditions of the information and integration views are considered. For example: Communication via WhatsApp with agent. Voice communication with agent. Web chat communication with agent. Application for order and delivery registration for the agent and Others...
Integration: Connection via REST, Connection to the data lake where order information is recorded, connection to the organization's information systems DB and CRM
Definition of experiments and technology selection: Design the experiment with the expected quality attributes, e.g., security, latency, performance, etc. Subsequently, from the reference architecture, take the technology providers that will serve to design the solution and meet the organization's conditions.
Designing alternative solutions and executing experiments
Let's assume that following the analysis, the team of solution architects has devised two alternatives.

Omnichannel Solution: interface for agent x 3 user interfaces (WhatsApp, Webchat, and Voice)

Source: https://aws.amazon.com/es/blogs/architecture/integrating-amazon-connect-and-amazon-lex-with-third-party-systems/

Self-assistance Solution: 1 bot x 3 user interfaces (WhatsApp, Webchat, and Voice)

Source: https://aws.amazon.com/es/blogs/machine-learning/add-conversational-ai-to-any-contact-center-with-amazon-lex-and-the-amazon-chime-sdk/

Final solution design

After conducting thorough experimentation and evaluating the extent to which each solution alternative satisfies the defined quality attributes, the optimal architectural design is selected. This selection process is underpinned by the confidence that the chosen solution inherently aligns with the organization's strategic objectives, architectural principles, and operational guidelines, while simultaneously adhering to AWS's industry-leading best practices for cloud architecture design. By fostering such comprehensive alignment from the outset, the organization can realize significant efficiencies throughout the solution lifecycle, from the initial design phase through to the eventual development and deployment stages. Furthermore, this proactive approach facilitates seamless optimization and fine-tuning of the solution once it transitions to a production environment, enabling continuous improvement and ensuring long-term sustainability and scalability.

Breakout session: Reference architecture as a growth tool for the AWS solution architect. (Numa Labs, Architecture Day, 23-08-23)

Que es ser Arquitecto de soluciones y por que certificarse como AWS Solutions Architect?

Nori — Mon, 06 Feb 2023 04:08:31 +0000

En términos generales ser arquitecto es un rol donde alineamos la tecnología con la estrategia de la organización.
Pero que es alinear? es lograr que los proyectos que ejecutamos y las decisiones que tomamos, vayan en la dirección de la estrategia de la organización.
Pero como vamos en dirección de la estrategia? generando valor. Pero entonces que es generar valor? Para este contexto, son todos esos proyectos que apuntan a resolver básicamente 4 aspectos: utilidades, costo operacional, reputación o eficiencia de activos.

Ahora bien, para lograr generar valor necesitamos de un aspecto muy importante, la información. Entonces el arquitecto es una persona que modela la información para crear proyectos y tomar decisiones que generen valor en la organización.

Y qué viene siendo un arquitecto de soluciones? Es una persona que aprovecha su dominio del lado tecnológico y el del negocio para generar valor dado un caso de uso específico. Pero qué es un caso de uso? es una descripción de un objetivo que se desea alcanzar, donde normalmente se involucran usuarios, servicios, eventos y un entorno donde debe acotarse la mejor solución que en este contexto es de tecnología.

Aunque no se diga de forma explicita, el arquitecto de soluciones debe demostrar que su solución genera valor, pero ante quién debe demostrarlo? generalmente ante los equipos de TI o los C-level. Entonces, además de generar la idea, el arquitecto de soluciones debe convencer a los que tienen el dinero, es decir a los CEO, CIOs CFOs etc.. osea tener capacidades de comunicación efectiva en ambos mundos para generar cambios que movilicen la organización y la hagan crecer.

Ya con la teoría nos queda una última pregunta. Cómo aplicamos esto en la práctica?. Creando el famoso as-is y el famoso to-be. Primero debemos conocer la organización donde estamos, los procesos que lleva acabo, las métricas que miden cuanto se avanza en la estrategia y el caso de uso que vamos a trabajar. Con habilidad en manejo de la información y la comunicación ya tendremos una base en el contexto del negocio.

Del lado tecnológico tenemos muchas alternativas, una de ellas es la nube de AWS y es allí donde esta compañía ofrece los entrenamientos y certificaciones, para que las organizaciones tengan el más placentero viaje a la nube, con nosotros como facilitadores. Entonces, que logramos con la certificación en AWS como arquitecto de soluciones? Primero credibilidad técnica, es decir tener conocimiento práctico amplio y profundo de los servicios core de la nube AWS. Segundo, visión de negocio, que es todo lo que vimos anteriormente ser capaces de mapear las necesidades del negocio y las métricas, en estado y requerimientos de tecnología (el as-is). Por último, la capacidad de utilizar estas dos capacidades para construir la mejor solución en la nube de AWS, que ayude al negocio a avanzar en su estrategia y ser exitoso (el to-be).

Solo los arquitectos muy experimentados son capaces de ver la gran imagen de una empresa, crear proyectos y generar soluciones de la nada. Los meros mortales como el resto de arquitectos o los que apenas estamos comenzando, nos tenemos que valer de diagramas o artefactos que nos permitan explicar nuestra solución y demostrar como generamos valor. Durante el camino de aprendizaje y certificación como arquitecto de soluciones AWS, también se obtiene la capacidad de diagramar nuestras propias soluciones a partir de las arquitecturas de referencia, explicarlas, encontrar alternativas, justificarlas y demostrar a los C-levels que lo que proponemos es tangible, viable y valioso para la organización.