Creating the Lambda function

The Lambda function is created with the deployment package generated in Preparing the deployment package. This package is uploaded directly to this Lambda function. The Lambda function has five configurable environment variables for severity, AWS region, DynamoDB table name, and IP block list file entry point.

1. Create a function that authors from scratch.
   1. Give the function a unique name.
   2. For its Runtime, select Node.js 6.10.
   3. For Role, select Choose an existing role. Select the role created in Setting up the IAM role and policies.
2. Set up the function code.
   1. For code entry type, select Upload a .ZIP file. The Function package field appears.
   2. For Function package, click Upload to upload the deployment package .zip file generated in Preparing the deployment package.
   3. For Handler, enter index.handler.
3. Set up the environment variables. Note values for key fields are case-sensitive and should all be in upper case.
   1. Add a key MIN_SEVERITY and input a value of 3.
   2. Add a key S3_BUCKET and paste the name of the S3 bucket created in Setting up the S3 bucket. In this example, the S3 bucket name is my-aws-lambda-guardduty.
   3. Add a key S3_BLOCKLIST_KEY and input a value of ip_blocklist or a different name as desired.
   4. Add a key REGION and input the AWS region where your Lambda function and DynamoDB table are situated. For example, the region of US East (N. Virginia) is us-east-1. For information about AWS Regions, see AWS Regions and Endpoints.
   5. Add a key DDB_TABLE_NAME and input the name of the DynamoDB table created in Setting up the DynamoDB table. In this example, the DynamoDB table name is my-aws-lambda-guardduty-db.
4. Save the Lambda function.