Move to Arm64 lambdas

Arm based lambdas are cheaper and more performant.

See https://aws.amazon.com/blogs/aws/aws-lambda-functions-powered-by-aws-graviton2-processor-run-your-functions-on-arm-and-get-up-to-34-better-price-performance/.

packages/cdk/lib/__snapshots__/service-catalogue.test.ts.snap

@@ -14161,6 +14161,9 @@ spec:
         "DataAuditRoleB3B90C40",
       ],
       "Properties": {
+        "Architectures": [
+          "arm64",
+        ],
         "Code": {
           "S3Bucket": {
             "Ref": "DistributionBucketName",
@@ -14457,6 +14460,9 @@ spec:
         "GithubActionsUsageServiceRole782ABC41",
       ],
       "Properties": {
+        "Architectures": [
+          "arm64",
+        ],
         "Code": {
           "S3Bucket": {
             "Ref": "DistributionBucketName",
@@ -15218,6 +15224,9 @@ spec:
         "dependencygraphintegratorServiceRole5200A556",
       ],
       "Properties": {
+        "Architectures": [
+          "arm64",
+        ],
         "Code": {
           "S3Bucket": {
             "Ref": "DistributionBucketName",
@@ -15740,6 +15749,9 @@ spec:
         "interactivemonitorServiceRoleC210EED3",
       ],
       "Properties": {
+        "Architectures": [
+          "arm64",
+        ],
         "Code": {
           "S3Bucket": {
             "Ref": "DistributionBucketName",
@@ -16700,6 +16712,9 @@ spec:
         "repocopServiceRole757D74E8",
       ],
       "Properties": {
+        "Architectures": [
+          "arm64",
+        ],
         "Code": {
           "S3Bucket": {
             "Ref": "DistributionBucketName",
@@ -20120,6 +20135,9 @@ spec:
         "snykintegratorServiceRole8B7567EF",
       ],
       "Properties": {
+        "Architectures": [
+          "arm64",
+        ],
         "Code": {
           "S3Bucket": {
             "Ref": "DistributionBucketName",

packages/cdk/lib/data-audit.ts

@@ -5,7 +5,7 @@ import { Duration, Tags } from 'aws-cdk-lib';
 import type { IVpc } from 'aws-cdk-lib/aws-ec2';
 import { Schedule } from 'aws-cdk-lib/aws-events';
 import { ManagedPolicy, Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
-import { Runtime } from 'aws-cdk-lib/aws-lambda';
+import { Architecture, Runtime } from 'aws-cdk-lib/aws-lambda';
 import type { DatabaseInstance } from 'aws-cdk-lib/aws-rds';
 import { cloudqueryAccess, listOrgsPolicy } from './cloudquery/policies';
 
@@ -61,6 +61,7 @@ export function addDataAuditLambda(scope: GuStack, props: DataAuditProps) {
 		role,
 		app,
 		vpc,
+		architecture: Architecture.ARM_64,
 		securityGroups: [dbAccess],
 		fileName: `${app}.zip`,
 		handler: 'index.main',

packages/cdk/lib/github-actions-usage.ts

@@ -6,7 +6,7 @@ import type { IVpc } from 'aws-cdk-lib/aws-ec2';
 import { ScheduledFargateTask } from 'aws-cdk-lib/aws-ecs-patterns';
 import { Rule } from 'aws-cdk-lib/aws-events';
 import { LambdaFunction } from 'aws-cdk-lib/aws-events-targets';
-import { Runtime } from 'aws-cdk-lib/aws-lambda';
+import { Architecture, Runtime } from 'aws-cdk-lib/aws-lambda';
 import type { DatabaseInstance } from 'aws-cdk-lib/aws-rds';
 
 interface GithubActionsUsageProps {
@@ -26,6 +26,7 @@ export function addGithubActionsUsageLambda(
 	const lambda = new GuLambdaFunction(scope, 'GithubActionsUsage', {
 		app,
 		vpc,
+		architecture: Architecture.ARM_64,
 		securityGroups: [dbAccess],
 		fileName: `${app}.zip`,
 		handler: 'index.main',

packages/cdk/lib/interactive-monitor.ts

@@ -1,7 +1,7 @@
 import { type GuStack } from '@guardian/cdk/lib/constructs/core';
 import { GuLambdaFunction } from '@guardian/cdk/lib/constructs/lambda';
 import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
-import { Runtime } from 'aws-cdk-lib/aws-lambda';
+import { Architecture, Runtime } from 'aws-cdk-lib/aws-lambda';
 import { Secret } from 'aws-cdk-lib/aws-secretsmanager';
 import { Topic } from 'aws-cdk-lib/aws-sns';
 import { LambdaSubscription } from 'aws-cdk-lib/aws-sns-subscriptions';
@@ -22,6 +22,7 @@ export class InteractiveMonitor {
 
 		const lambda = new GuLambdaFunction(guStack, service, {
 			app: service,
+			architecture: Architecture.ARM_64,
 			fileName: `${service}.zip`,
 			handler: 'index.handler',
 			runtime: Runtime.NODEJS_20_X,

packages/cdk/lib/repocop.ts

@@ -9,7 +9,7 @@ import { Duration } from 'aws-cdk-lib';
 import type { IVpc, SecurityGroup } from 'aws-cdk-lib/aws-ec2';
 import type { Schedule } from 'aws-cdk-lib/aws-events';
 import { PolicyStatement } from 'aws-cdk-lib/aws-iam';
-import { Runtime } from 'aws-cdk-lib/aws-lambda';
+import { Architecture, Runtime } from 'aws-cdk-lib/aws-lambda';
 import type { DatabaseInstance } from 'aws-cdk-lib/aws-rds';
 import { Secret } from 'aws-cdk-lib/aws-secretsmanager';
 import { Topic } from 'aws-cdk-lib/aws-sns';
@@ -48,6 +48,7 @@ export class Repocop {
 
 		const repocopLampdaProps: GuScheduledLambdaProps = {
 			app: 'repocop',
+			architecture: Architecture.ARM_64,
 			fileName: 'repocop.zip',
 			handler: 'index.main',
 			memorySize: 1024,
@@ -125,6 +126,7 @@ function stageAwareIntegratorLambda(
 ): GuLambdaFunction {
 	const nonProdLambdaProps = {
 		app,
+		architecture: Architecture.ARM_64,
 		fileName: `${app}.zip`,
 		handler: 'index.handler',
 		memorySize: 1024,

packages/cdk/lib/service-catalogue.test.ts

@@ -1,5 +1,6 @@
 import { App } from 'aws-cdk-lib';
 import { Template } from 'aws-cdk-lib/assertions';
+import { CfnFunction } from 'aws-cdk-lib/aws-lambda';
 import { ServiceCatalogue } from './service-catalogue';
 
 describe('The ServiceCatalogue stack', () => {
@@ -12,4 +13,26 @@ describe('The ServiceCatalogue stack', () => {
 		const template = Template.fromStack(stack);
 		expect(template.toJSON()).toMatchSnapshot();
 	});
+
+	it('only uses arm64 lambdas', () => {
+		const app = new App();
+		const stack = new ServiceCatalogue(app, 'ServiceCatalogue', {
+			stack: 'deploy',
+			stage: 'TEST',
+		});
+
+		const lambdas = stack.node
+			.findAll()
+			.filter((child): child is CfnFunction => child instanceof CfnFunction);
+
+		const architectures = new Set(
+			lambdas.flatMap((lambda) => lambda.architectures),
+		);
+
+		// Only 1 architecture is used...
+		expect(architectures.size).toEqual(1);
+
+		// ...and it's arm64
+		expect(architectures.has('arm64')).toEqual(true);
+	});
 });

packages/common/prisma/schema.prisma

@@ -1,7 +1,7 @@
 generator client {
   provider        = "prisma-client-js"
   previewFeatures = ["views"]
-  binaryTargets   = ["native", "rhel-openssl-3.0.x"]
+  binaryTargets   = ["native", "linux-arm64-openssl-3.0.x"]
 }
 
 datasource db {