Skip to content

FireFly Cloud

FireFly Cloud is the serverless AWS backend that manages the Arduino firmware lifecycle. It handles firmware uploads, validation, status progression, deletion, and over-the-air (OTA) delivery via an HTTP API backed by Lambda, DynamoDB, API Gateway, S3, and CloudFront.

Architecture

Firmware enters the system by being uploaded directly to S3, which triggers the upload Lambda to validate and register it. The API Gateway exposes endpoints for querying firmware records, advancing their release status, and initiating deletion. When firmware is released, binaries are published to a public S3 bucket fronted by CloudFront for device OTA delivery. When firmware is revoked, the binaries are moved to a restricted prefix and the CloudFront URLs become inaccessible.

CloudFormation Stacks

The environment is composed of multiple CloudFormation stacks, each managed by its own deploy and delete workflow:

StackDescription
firefly-acmACM certificate for API Gateway, CloudFront, and Cognito custom domains (us-east-1)
firefly-api-gatewayHTTP API Gateway v2 with custom domain, access logs, and Cognito JWT authorizer
firefly-dynamodb-firmwareDynamoDB firmware table
firefly-dynamodb-usersDynamoDB allowed-list table for invitation-only access control
firefly-cognitoCognito User Pool with Google IdP, pre-signup trigger, and super_users group
firefly-func-cognito-pre-signupPre-signup Lambda trigger that enforces invitation-only access
firefly-func-api-users-getUsers list endpoint
firefly-func-api-users-postUser invite endpoint
firefly-func-api-users-deleteUser deletion endpoint
firefly-func-api-users-patchSuper user status endpoint
firefly-func-api-appconfig-getConfiguration page — logging configuration list endpoint (super user only)
firefly-func-api-appconfig-patchConfiguration page — logging configuration update endpoint (super user only)
firefly-func-api-appconfig-postConfiguration page — create new logging configuration application (super user only)
firefly-s3-firmwarePrivate S3 firmware bucket with lifecycle rules and event notifications
firefly-s3-firmware-publicPublic S3 bucket for OTA firmware binary delivery; revoked/ prefix is access-denied and expires after 90 days
firefly-cloudfront-firmwareCloudFront distribution fronting the public firmware bucket for OTA delivery
firefly-shared-layerShared Python Lambda layer
firefly-func-api-health-getHealth check endpoint
firefly-func-api-firmware-getFirmware list and item retrieval endpoints
firefly-func-api-firmware-status-patchFirmware status transition endpoint
firefly-func-api-firmware-deleteFirmware deletion endpoint
firefly-func-s3-firmware-uploadedS3 upload event handler
firefly-func-s3-firmware-deletedS3 delete event handler
firefly-func-api-ota-getOTA firmware manifest endpoint
firefly-func-api-firmware-download-getPre-signed URL endpoint for downloading firmware ZIPs from the private bucket
firefly-s3-uiPrivate S3 bucket for the UI static files
firefly-cloudfront-uiCloudFront distribution serving the firmware management UI SPA

Shared Lambda Layer

All firmware Lambda functions except func-api-health-get depend on firefly-shared-layer, a Python layer located at lambdas/shared/python/shared/:

ModuleDescription
logging_config.pyConfigures JSON structured logging; log level driven by AppConfig
app_config.pyFetches configuration from AWS AppConfig via the Lambda extension
feature_flags.pyEvaluates feature flags from AppConfig