Skip to content

Commit 4ec3ab2

Browse files
authored
Merge pull request #89 from SumoLogic/sechub_timestamp_fix
Security Hub Timestamp fixed
2 parents 192753c + 7c6f28f commit 4ec3ab2

File tree

13 files changed

+294
-31
lines changed

13 files changed

+294
-31
lines changed

.travis.yml

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,23 +7,22 @@ jobs:
77
include:
88
- stage: Node 8
99
node_js: '8.10'
10-
env: FUNCTION_DIR=cloudwatchlogs-with-dlq TEST_FILE=test_cwl_lambda.py NODE_VERSION="8.10"
10+
env: FUNCTION_DIR=cloudwatchlogs-with-dlq TEST_DIR=cloudwatchlogs-with-dlq TEST_FILE=test_cwl_lambda.py NODE_VERSION="8.10"
1111
- stage: Node 8
1212
node_js: '8.10'
13-
env: FUNCTION_DIR=loggroup-lambda-connector/test TEST_FILE=test_loggroup_lambda_connector.py NODE_VERSION="8.10"
13+
env: FUNCTION_DIR=loggroup-lambda-connector TEST_DIR=loggroup-lambda-connector/test TEST_FILE=test_loggroup_lambda_connector.py NODE_VERSION="8.10"
1414
- stage: Node 6
1515
node_js: '6.10'
16-
env: FUNCTION_DIR=cloudwatchlogs-with-dlq TEST_FILE=test_cwl_lambda.py NODE_VERSION="6.10"
16+
env: FUNCTION_DIR=cloudwatchlogs-with-dlq TEST_DIR=cloudwatchlogs-with-dlq TEST_FILE=test_cwl_lambda.py NODE_VERSION="6.10"
1717
- stage: Node 6
1818
node_js: '6.10'
19-
env: FUNCTION_DIR=loggroup-lambda-connector/test TEST_FILE=test_loggroup_lambda_connector.py NODE_VERSION="6.10"
19+
env: FUNCTION_DIR=loggroup-lambda-connector TEST_DIR=loggroup-lambda-connector/test TEST_FILE=test_loggroup_lambda_connector.py NODE_VERSION="6.10"
2020
before_install:
2121
- sudo apt-get install python-pip
22-
- cd $FUNCTION_DIR
23-
- sudo pip install -r requirements.txt
22+
- cd $TEST_DIR && sudo pip install -r requirements.txt && cd -
2423
script:
25-
- npm run build
26-
- python $TEST_FILE
24+
- cd $FUNCTION_DIR && npm run build && cd -
25+
- cd $TEST_DIR && python $TEST_FILE && cd -
2726
env:
2827
global:
2928
- secure: iGATK/X1PfH8FCJlUpBbJ//mQ57QBQT0jETyDDH2r+GxZxXPnFS46ugPGsWTX0IDDEGjXE+/P6wnm0ORo7aa3yp7DZnfWFDyrgFchgUo1p3unt5sQcHg/9mitkQF7lHFlnAqM1D69AEGP5WU63m/9xQoj0BVYCVb2eUEqatV1AU8lpvRAkFc2juumy1ba4skoDFLOtrsaO2k+SCCBfMKq2SOJkcPnfMZGTOT7niaNnNAZSDYDovAlMYaLDOR10EMUAyklnmmAADyDxNRwSSAG8JKJMmfxSqIe4+s7xjqztjtkApWmEAjevDLpc62v1TWe0O2zCxnb4E4EBN6A31R1XJha4i/IKSeVL99J9X8aV1wIb9feV85qmZmlxVL2EU7/CcFGTdKeAak3qQWHZ1C6X32TBB6x5C0qASSC/x5pwDDJIOyeZr0Z93+dDhnBLNmzz8sA3h7AyzQZfhTqG/f4/SOgxTf7aF13X8BKuoM8BaGfXjy0keaVb0xbTjtDvi9F21EymWPdwNlQHsKca+EcTT2KE3mwFNrHAsTeNhGzMbrzmbZzvNHlmIwjB1C5l9h4GpUkxNb/mqi9SBTx9YfDIgz0bDOds1T92tGIAcBaHfJLTjc2JIgxwgdL13X3cL8GJBiFFwiJqiKJCSz4SxhWqsrrbsGSQBUqN5UoSsyKco=
Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
{
2+
3+
"AWSTemplateFormatVersion": "2010-09-09",
4+
"Outputs": {
5+
"CloudWatchEventFunction": {
6+
"Description": "CloudWatchEvent Processor Function ARN",
7+
"Value": {
8+
"Fn::GetAtt": [
9+
"CloudWatchEventFunction",
10+
"Arn"
11+
]
12+
},
13+
"Export" : {
14+
"Name" : { "Fn::Join": [ "-", [ "CloudWatchEventFunctionArn", { "Fn::Select" : [ "2", {"Fn::Split" : [ "/" , { "Ref": "AWS::StackId" } ]}] } ] ] }
15+
}
16+
}
17+
},
18+
"Mappings" : {
19+
"RegionMap" : {
20+
"us-east-1": {"bucketname": "appdevzipfiles-us-east-1"},
21+
"us-east-2": {"bucketname": "appdevzipfiles-us-east-2"},
22+
"us-west-1": {"bucketname": "appdevzipfiles-us-west-1"},
23+
"us-west-2": {"bucketname": "appdevzipfiles-us-west-2"},
24+
"ap-south-1": {"bucketname": "appdevzipfiles-ap-south-1"},
25+
"ap-northeast-2": {"bucketname": "appdevzipfiles-ap-northeast-2"},
26+
"ap-southeast-1": {"bucketname": "appdevzipfiles-ap-southeast-1"},
27+
"ap-southeast-2": {"bucketname": "appdevzipfiles-ap-southeast-2"},
28+
"ap-northeast-1": {"bucketname": "appdevzipfiles-ap-northeast-1"},
29+
"ca-central-1": {"bucketname": "appdevzipfiles-ca-central-1"},
30+
"eu-central-1": {"bucketname": "appdevzipfiles-eu-central-1"},
31+
"eu-west-1": {"bucketname": "appdevzipfiles-eu-west-1"},
32+
"eu-west-2": {"bucketname": "appdevzipfiles-eu-west-2"},
33+
"eu-west-3": {"bucketname": "appdevzipfiles-eu-west-3"},
34+
"eu-north-1": {"bucketname": "appdevzipfiles-eu-north-1s"},
35+
"sa-east-1": {"bucketname": "appdevzipfiles-sa-east-1"}
36+
}
37+
},
38+
"Resources": {
39+
"CloudWatchEventFunctionCloudWatchEventTrigger": {
40+
"Type": "AWS::Events::Rule",
41+
"Properties": {
42+
"EventPattern": {
43+
"source": [
44+
"aws.guardduty"
45+
]
46+
},
47+
"Targets": [
48+
{
49+
"Id": "CloudWatchEventFunctionCloudWatchEventTriggerLambdaTarget",
50+
"Arn": {
51+
"Fn::GetAtt": [
52+
"CloudWatchEventFunction",
53+
"Arn"
54+
]
55+
}
56+
}
57+
]
58+
}
59+
},
60+
"CloudWatchEventFunction": {
61+
"Type": "AWS::Lambda::Function",
62+
"Properties": {
63+
"Code": {
64+
"S3Bucket": { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "bucketname"]},
65+
"S3Key": "guardduty.zip"
66+
},
67+
"Tags": [
68+
{
69+
"Value": "SAM",
70+
"Key": "lambda:createdBy"
71+
}
72+
],
73+
"Environment": {
74+
"Variables": {
75+
"SUMO_ENDPOINT": {
76+
"Ref": "SumoEndpointUrl"
77+
}
78+
}
79+
},
80+
"Handler": "cloudwatchevents.handler",
81+
"Role": {
82+
"Fn::GetAtt": [
83+
"CloudWatchEventFunctionRole",
84+
"Arn"
85+
]
86+
},
87+
"Timeout": 300,
88+
"Runtime": "nodejs8.10"
89+
}
90+
},
91+
"CloudWatchEventFunctionCloudWatchEventTriggerPermission": {
92+
"Type": "AWS::Lambda::Permission",
93+
"Properties": {
94+
"Action": "lambda:invokeFunction",
95+
"Principal": "events.amazonaws.com",
96+
"FunctionName": {
97+
"Ref": "CloudWatchEventFunction"
98+
},
99+
"SourceArn": {
100+
"Fn::GetAtt": [
101+
"CloudWatchEventFunctionCloudWatchEventTrigger",
102+
"Arn"
103+
]
104+
}
105+
}
106+
},
107+
"CloudWatchEventFunctionRole": {
108+
"Type": "AWS::IAM::Role",
109+
"Properties": {
110+
"ManagedPolicyArns": [
111+
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
112+
],
113+
"AssumeRolePolicyDocument": {
114+
"Version": "2012-10-17",
115+
"Statement": [
116+
{
117+
"Action": [
118+
"sts:AssumeRole"
119+
],
120+
"Effect": "Allow",
121+
"Principal": {
122+
"Service": [
123+
"lambda.amazonaws.com"
124+
]
125+
}
126+
}
127+
]
128+
}
129+
}
130+
}
131+
},
132+
"Description": "This function is invoked by AWS CloudWatch events in response to state change in your AWS resources which matches a event target definition. The event payload received is then forwarded to Sumo Logic HTTP source endpoint.\n",
133+
"Parameters": {
134+
"SumoEndpointUrl": {
135+
"Type": "String"
136+
}
137+
}
138+
139+
}

cloudwatchevents/package.json

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,14 @@
1111
"test": "cd guardduty && sam local invoke CloudWatchEventFunction -e event.json",
1212
"build_guardduty": "cd guardduty && sam package --template-file template.yaml --s3-bucket $SAM_S3_BUCKET --output-template-file packaged.yaml",
1313
"deploy_guardduty": "cd guardduty && sam deploy --template-file packaged.yaml --stack-name testingguarddutylambda --capabilities CAPABILITY_IAM --parameter-overrides SumoEndpointUrl=$SUMO_ENDPOINT",
14-
"view_deploy_logs": "aws cloudformation describe-stack-events --stack-name testingguarddutylambda"
14+
"view_deploy_logs": "aws cloudformation describe-stack-events --stack-name testingguarddutylambda",
15+
"build_zip": "rm -f guardduty.zip && cd src && zip ../guardduty.zip cloudwatchevents.js && cd ..",
16+
"build_temp": "aws cloudformation get-template --stack-name testingguarddutylambda --region $AWS_REGION"
1517
},
1618
"keywords": [
1719
"lambda",
1820
"cloudwatch-events"
1921
]
2022
}
23+
24+

cloudwatchlogs-with-dlq/DLQLambdaCloudFormation.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@
4646
"eu-west-1": {"bucketname": "appdevzipfiles-eu-west-1"},
4747
"eu-west-2": {"bucketname": "appdevzipfiles-eu-west-2"},
4848
"eu-west-3": {"bucketname": "appdevzipfiles-eu-west-3"},
49+
"eu-north-1": {"bucketname": "appdevzipfiles-eu-north-1s"},
4950
"sa-east-1": {"bucketname": "appdevzipfiles-sa-east-1"}
5051
}
5152
},

cloudwatchlogs-with-dlq/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"devDependencies": {},
1111
"scripts": {
1212
"test": "node -e 'require('./test').test()'",
13-
"build": "rm -f cloudwatchlogs-with-dlq.zip && zip -r cloudwatchlogs-with-dlq.zip DLQProcessor.js cloudwatchlogs_lambda.js vpcutils.js package.json sumo-dlq-function-utils/ node_modules/",
13+
"build": "rm -f cloudwatchlogs-with-dlq.zip && npm install && zip -r cloudwatchlogs-with-dlq.zip DLQProcessor.js cloudwatchlogs_lambda.js vpcutils.js package.json sumo-dlq-function-utils/ node_modules/",
1414
"prod_deploy": "python -c 'from test_cwl_lambda import prod_deploy;prod_deploy()'"
1515
},
1616
"author": "Himanshu Pal",

deploy_function.py

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
import boto3
2+
import os
3+
from argparse import ArgumentParser
4+
5+
regions = [
6+
"us-east-2",
7+
"us-east-1",
8+
"us-west-1",
9+
"us-west-2",
10+
"ap-south-1",
11+
"ap-northeast-2",
12+
"ap-southeast-1",
13+
"ap-southeast-2",
14+
"ap-northeast-1",
15+
"ca-central-1",
16+
# "cn-north-1",
17+
"eu-central-1",
18+
"eu-west-1",
19+
"eu-west-2",
20+
"eu-west-3",
21+
"eu-north-1",
22+
"sa-east-1"
23+
]
24+
25+
26+
def get_bucket_name(bucket_prefix, region):
27+
if region == "eu-north-1":
28+
return '%s-%ss' % (bucket_prefix, region)
29+
return '%s-%s' % (bucket_prefix, region)
30+
31+
32+
def upload_code_in_multiple_regions(filepath, bucket_prefix):
33+
34+
for region in regions:
35+
upload_code_in_S3(filepath, get_bucket_name(bucket_prefix, region), region)
36+
37+
38+
def create_buckets(bucket_prefix):
39+
for region in regions:
40+
s3 = boto3.client('s3', region)
41+
bucket_name = get_bucket_name(bucket_prefix, region)
42+
try:
43+
if region == "us-east-1":
44+
response = s3.create_bucket(Bucket=bucket_name) # the operation is idempotent
45+
else:
46+
response = s3.create_bucket(Bucket=bucket_name,
47+
CreateBucketConfiguration={
48+
'LocationConstraint': region
49+
})
50+
print("Creating bucket", region, response)
51+
except:
52+
pass
53+
54+
55+
def upload_code_in_S3(filepath, bucket_name, region):
56+
print("Uploading zip file in S3", region)
57+
s3 = boto3.client('s3', region)
58+
filename = os.path.basename(filepath)
59+
s3.upload_file(filepath, bucket_name, filename,
60+
ExtraArgs={'ACL': 'public-read'})
61+
62+
63+
def upload_cftemplate(templatepath, bucket_name, region='us-east-1'):
64+
print("Uploading template file in S3")
65+
s3 = boto3.client('s3', region)
66+
filename = os.path.basename(templatepath)
67+
s3.upload_file(templatepath, bucket_name, filename,
68+
ExtraArgs={'ACL': 'public-read'})
69+
70+
71+
if __name__ == '__main__':
72+
73+
parser = ArgumentParser()
74+
parser.add_argument("-t", "--templatefile", dest="templatefile",
75+
help="CF template")
76+
77+
parser.add_argument("-z", "--zipfile", dest="zipfile",
78+
help="deployment package")
79+
80+
parser.add_argument("-d", "--deployment", dest="deployment", default="dev",
81+
help="aws account type")
82+
83+
args = parser.parse_args()
84+
if args.deployment == "prod":
85+
zip_bucket_prefix = "appdevzipfiles"
86+
template_bucket = "appdev-cloudformation-templates"
87+
else:
88+
zip_bucket_prefix = "appdevstore"
89+
template_bucket = "cf-templates-5d0x5unchag-us-east-1"
90+
91+
if not os.path.isfile(args.templatefile):
92+
raise Exception("templatefile does not exists")
93+
if not os.path.isfile(args.zipfile):
94+
raise Exception("zipfile does not exists")
95+
96+
create_buckets(zip_bucket_prefix)
97+
upload_code_in_multiple_regions(args.zipfile, zip_bucket_prefix)
98+
upload_cftemplate(args.templatefile, template_bucket)
99+
print("Deployment Successfull: ALL files copied to %s" % args.deployment)

loggroup-lambda-connector/test/test_loggroup_lambda_connector.py

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,8 @@ def upload_code_in_S3(region):
220220
s3 = boto3.client('s3', region)
221221
bucket_name = get_bucket_name(region)
222222
filename = TestLambda.ZIP_FILE
223-
s3.upload_file(filename, bucket_name, filename,
223+
key = os.path.basename(filename)
224+
s3.upload_file(filename, bucket_name, key,
224225
ExtraArgs={'ACL': 'public-read'})
225226

226227

@@ -230,9 +231,10 @@ def prod_deploy():
230231
upload_code_in_multiple_regions()
231232
print("Uploading template file in S3")
232233
s3 = boto3.client('s3', "us-east-1")
233-
filename = 'loggroup-lambda-cft.json'
234+
filename = os.path.join('test', 'loggroup-lambda-cft.json')
234235
bucket_name = "appdev-cloudformation-templates"
235-
s3.upload_file(filename, bucket_name, filename,
236+
key = os.path.basename(filename)
237+
s3.upload_file(filename, bucket_name, key,
236238
ExtraArgs={'ACL': 'public-read'})
237239
print("Deployment Successfull: ALL files copied to Sumocontent")
238240

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,26 @@
1-
mkdir python
2-
cd python
3-
pip install -r ../requirements.txt -t ./
4-
zip -r ../securityhub_deps.zip .
5-
cd ..
6-
aws s3 cp securityhub_deps.zip s3://appdevstore/ --region us-east-1
1+
#!bash/bin
72

8-
aws lambda publish-layer-version --layer-name securityhub_deps --description "contains securityhub solution dependencies" --license-info "MIT" --content S3Bucket=appdevstore,S3Key=securityhub_deps.zip --compatible-runtimes python3.7 python3.6 --region us-east-1
3+
if [ ! -f securityhub_deps.zip ]; then
4+
echo "creating zip file"
5+
mkdir python
6+
cd python
7+
pip install -r ../requirements.txt -t ./
8+
zip -r ../securityhub_deps.zip .
9+
cd ..
10+
fi
911

10-
aws lambda add-layer-version-permission --layer-name securityhub_deps --statement-id securityhub-deps --version-number 3 --principal '*' --action lambda:GetLayerVersion --region us-east-1
12+
declare -a regions=("us-east-2" "us-east-1" "us-west-1" "us-west-2" "ap-south-1" "ap-northeast-2" "ap-southeast-1" "ap-southeast-2" "ap-northeast-1" "ca-central-1" "eu-central-1" "eu-west-1" "eu-west-2" "eu-west-3" "sa-east-1")
13+
14+
for i in "${regions[@]}"
15+
do
16+
echo "Deploying layer in $i"
17+
bucket_name="appdevzipfiles-$i"
18+
aws s3 cp securityhub_deps.zip s3://$bucket_name/ --region $i
19+
20+
aws lambda publish-layer-version --layer-name securityhub_deps --description "contains securityhub solution dependencies" --license-info "MIT" --content S3Bucket=$bucket_name,S3Key=securityhub_deps.zip --compatible-runtimes python3.7 python3.6 --region $i
21+
22+
aws lambda add-layer-version-permission --layer-name securityhub_deps --statement-id securityhub-deps --version-number 1 --principal '*' --action lambda:GetLayerVersion --region $i
23+
done
24+
25+
# aws lambda remove-layer-version-permission --layer-name securityhub_deps --version-number 1 --statement-id securityhub-deps --region us-east-1
26+
# aws lambda get-layer-version-policy --layer-name securityhub_deps --region us-east-1

securityhub-collector/sam/packaged.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ Parameters:
2222
Resources:
2323
SecurityHubCollectorFunction:
2424
Properties:
25-
CodeUri: s3://appdevstore/d6d324a075082bfb9446aa118eeb64c6
25+
CodeUri: s3://appdevstore/cc901e7163326ccceb15877d3cc3fe9a
2626
Environment:
2727
Variables:
2828
LOCK_TABLE:
@@ -31,7 +31,7 @@ Resources:
3131
Ref: S3SourceBucketName
3232
Handler: securityhub_collector.lambda_handler
3333
Layers:
34-
- arn:aws:lambda:us-east-1:956882708938:layer:securityhub_deps:1
34+
- Fn::Sub: arn:aws:lambda:${AWS::Region}:956882708938:layer:securityhub_deps:1
3535
MemorySize: 128
3636
Policies:
3737
- Statement:
@@ -86,7 +86,7 @@ Resources:
8686
Type: AWS::DynamoDB::Table
8787
SecurityHubSchedulerFunction:
8888
Properties:
89-
CodeUri: s3://appdevstore/d6d324a075082bfb9446aa118eeb64c6
89+
CodeUri: s3://appdevstore/cc901e7163326ccceb15877d3cc3fe9a
9090
Environment:
9191
Variables:
9292
LOCK_TABLE:
@@ -100,7 +100,7 @@ Resources:
100100
Type: Schedule
101101
Handler: securityhub_scheduler.lambda_handler
102102
Layers:
103-
- arn:aws:lambda:us-east-1:956882708938:layer:securityhub_deps:3
103+
- Fn::Sub: arn:aws:lambda:${AWS::Region}:956882708938:layer:securityhub_deps:1
104104
MemorySize: 128
105105
Policies:
106106
- Statement:

0 commit comments

Comments
 (0)