Designing automation for webhook-triggered Lightsail reboot

To set up an automation that reboots an AWS Lightsail instance upon receiving a webhook event, you'll need to integrate AWS services. First, configure an API Gateway endpoint to receive the webhook. Then, create a Lambda function with an appropriate IAM role that can call the Lightsail reboot-instance API. You can write the function in Node.js or Python. Optionally, AWS CloudWatch or EventBridge can aid event handling. You can also consider using GitHub webhooks or other services, depending on your needs.

Thought for 4 seconds

Below is a reference architecture and step‑by‑step guide for wiring a generic “webhook → reboot Lightsail instance” automation using AWS API Gateway and Lambda.

---

1. High‑level Architecture

Webhook Sender
      │
      ▼
AWS API Gateway (HTTP POST endpoint)
      │
      ▼
AWS Lambda Function
      │
      ▼
AWS Lightsail API ── RebootInstance

---

2. IAM Permissions

1. Create an IAM role for your Lambda with a policy like:

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "lightsail:RebootInstance"
          ],
          "Resource": ["*"]
        }
      ]
    }
   

2. Attach the role to your Lambda.

---

3. Lambda Function

3.1. Environment Variables

• INSTANCE_NAME: the Lightsail instance name you want to reboot.

• (Optional) WEBHOOK_SECRET: a shared secret to verify the webhook payload.

3.2. Example (Python)

import os
import json
import hmac
import hashlib
import boto3

lightsail = boto3.client('lightsail')
INSTANCE_NAME = os.environ['INSTANCE_NAME']
WEBHOOK_SECRET = os.environ.get('WEBHOOK_SECRET')

def verify_signature(body, signature_header):
    # HMAC SHA256 of the body using your secret
    mac = hmac.new(WEBHOOK_SECRET.encode(), body, hashlib.sha256)
    expected = 'sha256=' + mac.hexdigest()
    return hmac.compare_digest(expected, signature_header)

def lambda_handler(event, context):
    # 1. (Optional) verify signature
    sig = event['headers'].get('X-Hub-Signature-256', '')
    body_bytes = event['body'].encode() if isinstance(event['body'], str) else event['body']
    if WEBHOOK_SECRET and not verify_signature(body_bytes, sig):
        return {"statusCode": 401, "body": "Invalid signature"}

    # 2. Optionally inspect event['body'] to decide whether to reboot
    #    e.g. only reboot on certain event types

    # 3. Reboot the Lightsail instance
    resp = lightsail.reboot_instance(instanceName=INSTANCE_NAME)
    return {
        "statusCode": 200,
        "body": json.dumps({
            "message": f"Reboot initiated for {INSTANCE_NAME}.",
            "lightsailResponse": resp
        })
    }

---

4. API Gateway Setup

1. Create a REST API (or HTTP API) in API Gateway.

2. Define a POST resource, e.g. /hooks/reboot.

3. Integrate it with your Lambda function.

4. Enable CORS if your webhook sender requires it.

5. (Optional) Require an API Key or use a Custom Authorizer for extra security.

---

5. Deploy & Test

1. Deploy the API (e.g. to “prod” stage) to get an invoke URL:

    POST https://{api-id}.execute-api.{region}.amazonaws.com/prod/hooks/reboot
   

2. Configure your external system’s webhook to call that URL on the desired event.

3. Optionally include a header X-Hub-Signature-256 computed via your WEBHOOK_SECRET.

4. Trigger the event and verify in the AWS Console:

   • CloudWatch Logs for your Lambda invocation.

   • Lightsail Console to see the instance entering reboot.

---

6. (Optional) Advanced Enhancements

• Filtering: In Lambda, inspect payload JSON and only reboot under specific conditions (e.g. event_type == "deploy_complete").

• Retries & Dead‑Letter: Configure Lambda retry attempts and a DLQ (SQS) if reboot fails.

• Monitoring: Use CloudWatch Alarms on Lambda errors or Lightsail health metrics.

• Infrastructure as Code: Define the API Gateway, Lambda, IAM roles with AWS SAM or Terraform so it’s fully repeatable.

---

With this pattern in place, any HTTP POST sent to your API Gateway endpoint will trigger the Lambda, which calls the Lightsail API to reboot your instance.