How can I access AWS iot.describeCertificate() inside lambda with NodeJS? - node.js

Question

I need to retrieve an IoT-certificate status using a lambda function with NodeJS.
Following the documentation I should use describeCertificate() to accomplish this task.
This is the code I have so far (using for testes):
const AWS = require('aws-sdk')
const iot = new AWS.Iot()
let cert = {}
async function descCert (params) {
console.log("start descCert")
console.log("params")
console.log(params)
await iot.describeCertificate(params, function(err, data) {
console.log('describeCertificate - Fn')
if (err) {
console.log('describeCertificate - Error')
console.log(err, err.stack)
}else{
console.log('describeCertificate - data')
cert = data
console.log(data)
}
console.log("end describeCertificate - Fn")
})
console.log("end descCert")
}
module.exports.testFn = async (event, context, callback) => {
var zzz = {
certificateId: 'xxxx8c0891f8xxxxxx'
}
await descCert(zzz)
console.log("after descCert")
console.log(cert)
...
}
My guess is that I am not accessing the function await iot.describeCertificate( ... since I cant see the logs in CloudWatch.
I should receive this sequence:
start descCert
params
{certificateId: 'xxxx8c0891f8xxxxxx'}
describeCertificate - Fn
Or describeCertificate - Error Or describeCertificate - data
actual data response
end describeCertificate - Fn
end descCert
after descCert
actual data response
But this is what I am getting:
start descCert
params
{certificateId: 'xxxx8c0891f8xxxxxx'}
(8) end descCert
(9) after descCert
(10) os dados mesmo //{}
I can't see the steps 4-7 in the logs INFO. So the conclusion is the FUnctions is not being called.
What am I missing?

Answer 1

For accessing IoT core service (or any other services) you should give the Lambda function the corresponding RIGHT accesses to that service. To do that you can go to IAM -> Roles and add the corresponding policy to the role attached to your Lambda function.
You may add inline policy to the corresponding lambda-role:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "iot:DescribeCertificate",
"Resource": "arn:aws:iot:*:*:cert/*"
}
]
}
It is better to change the Resource to your corresponding arn.

Answer 2

var AWS = require('aws-sdk');
async function get_certificate_status(iot, params) {
try {
const data = await iot.describeCertificate(params).promise();
return data.certificateDescription.status;
} catch(e) {
throw new Error(e.message);
}
}
exports.handler = async function(event, context, callback) {
var iot = new AWS.Iot({'region': <region>, apiVersion: '2015-05-28'});
var params = { certificateId: <certificateId> };
var cert_status = await get_certificate_status(iot, params);
console.log("STATUS: " + cert_status);
}