Ability to specify source directory for Lambda@Edge submodule #260

zdmytriv · 2023-03-03T14:35:48Z

what

Ability to specify source directory for Lambda@Edge submodule

why

Currently, we can pass the list of files that will be archived and uploaded as Lambda sources. This is not an option if more advanced logic is used and a lot of files should be used.

Example

For example, we have the following file structure for lambda@edge submodule:

lambda_edge_example/
    lib/
        node_modules/
        index.js
        package.json
        package-lock.json
    context.tf
    main.tf
    outputs.tf
    variables.tf

And we want the whole directory lib to be packaged.

With this enhancement path to lib might be specified like this

module "lambda_edge" {
  source  = "cloudposse/cloudfront-s3-cdn/aws//modules/lambda@edge"
  version = "x.xx.x"

  functions = {
    viewer_request = {
      source_dir   = "${path.module}/lib/"
      runtime      = "nodejs12.x"
      handler      = "index.handler"
      event_type   = "viewer-request"
      include_body = false
    }
  }

  // ...
}

Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability
Resource: aws_cloudfront_distribution.default | Bridgecrew ID: BC_AWS_GENERAL_186 | Checkov ID: CKV2_AWS_47

How to Fix

resource "aws_cloudfront_distribution" "pass" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_access_control_id = aws_cloudfront_origin_access_control.default.id origin_id = local.s3_origin_id } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.pass_acl.arn } resource "aws_wafv2_web_acl" "pass_acl" { name = "managed-rule-example" description = "Example of a managed rule." scope = "REGIONAL" default_action { allow {} } rule { name = "rule-1" priority = 1 override_action { count {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" excluded_rule { name = "SizeRestrictions_QUERYSTRING" } scope_down_statement { geo_match_statement { country_codes = ["US", "NL"] } } } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-rule-metric-name" sampled_requests_enabled = false } } rule { name = "rule-2" priority = 2 override_action { count {} } statement { managed_rule_group_statement { name = "AWSManagedRulesKnownBadInputsRuleSet" vendor_name = "AWS" excluded_rule { name = "SizeRestrictions_QUERYSTRING" } scope_down_statement { geo_match_statement { country_codes = ["US", "NL"] } } } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-rule-metric-name" sampled_requests_enabled = false } } tags = { Tag1 = "Value1" Tag2 = "Value2" } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-metric-name" sampled_requests_enabled = false } }

Description
This policy identifies AWS CloudFront attached with WAFv2 WebACL which is not configured with AWS Managed Rules (AMR) for Log4j Vulnerability. As per the guidelines given by AWS, CloudFront attached with WAFv2 WebACL should be configured with AWS Managed Rules (AMR) AWSManagedRulesKnownBadInputsRuleSet and AWSManagedRulesAnonymousIpList to protect from Log4j Vulnerability (CVE-2021-44228).\n\nFor more information please refer below URL,\nhttps://aws.amazon.com/security/security-bulletins/AWS-2021-006/

zdmytriv · 2023-03-10T14:47:59Z

/test all

bridgecrew · 2023-03-10T14:51:52Z

main.tf

@@ -418,7 +418,7 @@ resource "aws_cloudfront_distribution" "default" {
    origin_path = var.origin_path

    dynamic "s3_origin_config" {
-      for_each = ! var.website_enabled ? [1] : []
+      for_each = !var.website_enabled ? [1] : []


Ensure AWS CloudFront attached WAFv2 WebACL is configured with AMR for Log4j Vulnerability
    Resource: module.cloudfront_s3_cdn.aws_cloudfront_distribution.default | Bridgecrew ID: BC_AWS_GENERAL_186 | Checkov ID: CKV2_AWS_47

How to Fix

resource "aws_cloudfront_distribution" "pass" { origin { domain_name = aws_s3_bucket.b.bucket_regional_domain_name origin_access_control_id = aws_cloudfront_origin_access_control.default.id origin_id = local.s3_origin_id } enabled = true is_ipv6_enabled = true comment = "Some comment" default_root_object = "index.html" aliases = ["mysite.example.com", "yoursite.example.com"] default_cache_behavior { allowed_methods = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"] cached_methods = ["GET", "HEAD"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false cookies { forward = "none" } } viewer_protocol_policy = "allow-all" min_ttl = 0 default_ttl = 3600 max_ttl = 86400 } # Cache behavior with precedence 0 ordered_cache_behavior { path_pattern = "/content/immutable/*" allowed_methods = ["GET", "HEAD", "OPTIONS"] cached_methods = ["GET", "HEAD", "OPTIONS"] target_origin_id = local.s3_origin_id forwarded_values { query_string = false headers = ["Origin"] cookies { forward = "none" } } min_ttl = 0 default_ttl = 86400 max_ttl = 31536000 compress = true viewer_protocol_policy = "redirect-to-https" } price_class = "PriceClass_200" restrictions { geo_restriction { restriction_type = "whitelist" locations = ["US", "CA", "GB", "DE"] } } tags = { Environment = "production" } viewer_certificate { cloudfront_default_certificate = true } web_acl_id = aws_wafv2_web_acl.pass_acl.arn } resource "aws_wafv2_web_acl" "pass_acl" { name = "managed-rule-example" description = "Example of a managed rule." scope = "REGIONAL" default_action { allow {} } rule { name = "rule-1" priority = 1 override_action { count {} } statement { managed_rule_group_statement { name = "AWSManagedRulesAnonymousIpList" vendor_name = "AWS" excluded_rule { name = "SizeRestrictions_QUERYSTRING" } scope_down_statement { geo_match_statement { country_codes = ["US", "NL"] } } } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-rule-metric-name" sampled_requests_enabled = false } } rule { name = "rule-2" priority = 2 override_action { count {} } statement { managed_rule_group_statement { name = "AWSManagedRulesKnownBadInputsRuleSet" vendor_name = "AWS" excluded_rule { name = "SizeRestrictions_QUERYSTRING" } scope_down_statement { geo_match_statement { country_codes = ["US", "NL"] } } } } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-rule-metric-name" sampled_requests_enabled = false } } tags = { Tag1 = "Value1" Tag2 = "Value2" } visibility_config { cloudwatch_metrics_enabled = false metric_name = "friendly-metric-name" sampled_requests_enabled = false } }

Description
This policy identifies AWS CloudFront attached with WAFv2 WebACL which is not configured with AWS Managed Rules (AMR) for Log4j Vulnerability. As per the guidelines given by AWS, CloudFront attached with WAFv2 WebACL should be configured with AWS Managed Rules (AMR) AWSManagedRulesKnownBadInputsRuleSet and AWSManagedRulesAnonymousIpList to protect from Log4j Vulnerability (CVE-2021-44228).\n\nFor more information please refer below URL,\nhttps://aws.amazon.com/security/security-bulletins/AWS-2021-006/

     🎉 Fixed by commit 814dc66 - update

zdmytriv · 2023-03-10T15:02:14Z

/test all

zdmytriv · 2023-03-10T15:16:52Z

/test all

zdmytriv · 2023-03-10T15:29:30Z

/test all

zdmytriv · 2023-03-10T16:12:32Z

modules/lambda@edge/package.tf

@@ -2,14 +2,15 @@ data "archive_file" "lambda_zip" {
  for_each = local.functions

  dynamic "source" {
-    for_each = each.value.source
+    for_each = coalesce(each.value.source, [])


source might be empty list now because we source_dir as well

zdmytriv · 2023-03-10T16:12:58Z

modules/lambda@edge/variables.tf

      filename = string
      content  = string
-    }))
+    })))
+    source_dir   = optional(string)


both source and source_dir are optional

zdmytriv · 2023-03-10T16:13:43Z

versions.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13.0"
+  required_version = ">= 1.3"


bumped version in order to support optional() function

zdmytriv · 2023-03-10T16:13:52Z

modules/lambda@edge/versions.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13.0"
+  required_version = ">= 1.3"


bumped version in order to support optional() function

zdmytriv · 2023-03-10T16:17:12Z

modules/lambda@edge/outputs.tf

+    }
+  }
+}


Exporting role arn so policy attachment can be added to lambda.

zdmytriv · 2023-03-10T16:17:34Z

main.tf

@@ -52,7 +52,7 @@ locals {

  override_origin_bucket_policy = local.enabled && var.override_origin_bucket_policy

-  lookup_cf_log_bucket = local.cloudfront_access_logging_enabled && ! local.cloudfront_access_log_create_bucket
+  lookup_cf_log_bucket = local.cloudfront_access_logging_enabled && !local.cloudfront_access_log_create_bucket


bridgecrew insisted

zdmytriv · 2023-03-10T16:17:48Z

main.tf

@@ -4,7 +4,7 @@ locals {
  # Encapsulate logic here so that it is not lost/scattered among the configuration
  website_enabled           = local.enabled && var.website_enabled
  website_password_enabled  = local.website_enabled && var.s3_website_password_enabled
-  s3_origin_enabled         = local.enabled && ! var.website_enabled
+  s3_origin_enabled         = local.enabled && !var.website_enabled


bridgecrew insisted

zdmytriv · 2023-03-10T16:17:58Z

examples/complete/versions.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 0.13.0"
+  required_version = ">= 1.3"


bumped version in order to support optional() function

zdmytriv · 2023-03-10T16:18:31Z

examples/complete/lib/index.js

+    headers['x-custom-header'] = [{ key: 'X-Custom-Header', value: 'My custom value' }];
+
+    callback(null, response);
+};


sample index.js for the example/complete test

zdmytriv · 2023-03-10T16:19:09Z

examples/complete/lambda-at-edge.tf

+      handler      = "index.handler"
+      event_type   = "viewer-response"
+      include_body = false
+    },


One more type of lambda@edge cloudfront function. Needed to test source_dir

Zinovii Dmytriv added 10 commits March 1, 2023 13:01

Support for source_dir in lambda

30e46ed

update

a25e584

update

b704e0e

update

8369ce0

update

97ea48f

update

6472f53

update

6439e68

update

bb768ac

update

98a5bac

update

bf69589

zdmytriv added the minor New features that do not break anything label Mar 3, 2023

zdmytriv requested review from a team as code owners March 3, 2023 14:35

zdmytriv requested review from jamengual and joe-niland and removed request for a team March 3, 2023 14:35

zdmytriv force-pushed the source_dir-support branch from 31dd959 to bf69589 Compare March 9, 2023 16:37

updated workflows

47a2489

Zinovii Dmytriv and others added 5 commits March 10, 2023 16:07

fixed validation

0731f52

fixed output.tf

429502b

Auto Format

ce3226b

update

c652905

Auto Format

09b6df1

bumped tf required_version

6a3d642

Auto Format

1bd83e7

bridgecrew bot reviewed Mar 10, 2023

View reviewed changes

Zinovii Dmytriv and others added 2 commits March 10, 2023 16:58

fixed version

cc6ecc4

Auto Format

22335e4

fixed validation again

1b5fb58

update

814dc66

zdmytriv commented Mar 10, 2023

View reviewed changes

max-lobur approved these changes Mar 10, 2023

View reviewed changes

osterman approved these changes Mar 12, 2023

View reviewed changes

zdmytriv merged commit 5ea3df7 into master Mar 12, 2023

zdmytriv deleted the source_dir-support branch March 12, 2023 13:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ability to specify source directory for Lambda@Edge submodule #260

Ability to specify source directory for Lambda@Edge submodule #260

zdmytriv commented Mar 3, 2023 •

edited

Loading

zdmytriv commented Mar 10, 2023

zdmytriv commented Mar 10, 2023

zdmytriv commented Mar 10, 2023

bridgecrew bot left a comment

bridgecrew bot Mar 10, 2023

zdmytriv commented Mar 10, 2023

bridgecrew bot Mar 10, 2023 •

edited

Loading

zdmytriv commented Mar 10, 2023

zdmytriv commented Mar 10, 2023

zdmytriv commented Mar 10, 2023

zdmytriv Mar 10, 2023

zdmytriv Mar 10, 2023

zdmytriv Mar 10, 2023

zdmytriv Mar 10, 2023

zdmytriv Mar 10, 2023

zdmytriv Mar 10, 2023

zdmytriv Mar 10, 2023

zdmytriv Mar 10, 2023

zdmytriv Mar 10, 2023

zdmytriv Mar 10, 2023

Ability to specify source directory for Lambda@Edge submodule #260

Ability to specify source directory for Lambda@Edge submodule #260

Conversation

zdmytriv commented Mar 3, 2023 • edited Loading

what

why

Related

zdmytriv commented Mar 10, 2023

zdmytriv commented Mar 10, 2023

zdmytriv commented Mar 10, 2023

bridgecrew bot left a comment

Choose a reason for hiding this comment

bridgecrew bot Mar 10, 2023

Choose a reason for hiding this comment

How to Fix

Description

zdmytriv commented Mar 10, 2023

bridgecrew bot Mar 10, 2023 • edited Loading

Choose a reason for hiding this comment

How to Fix

Description

zdmytriv commented Mar 10, 2023

zdmytriv commented Mar 10, 2023

zdmytriv commented Mar 10, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zdmytriv commented Mar 3, 2023 •

edited

Loading

bridgecrew bot Mar 10, 2023 •

edited

Loading