@kumologica/sdk 3.0.0

package/src/app/lib/aws/cf.js

@@ -0,0 +1,439 @@
+const AWS = require('aws-sdk');
+const jp = require('jsonpath');
+const KLRekognition = require('./kl-rekognition-api');
+
+class AWSCFTemplate {
+  constructor() {
+    this.rekognition = new KLRekognition();
+  }
+
+  /*
+   * Creates cloud formation template file for current lambda:
+   * It is composed of:
+   * - lambda definition
+   * - lambda's role
+   * - lambda's policy
+   * - if event subriptions confirmed then event source mappings for:
+   *   - dynamodb stream
+   *   - sns
+   *   - kinesis
+   * - if flow nodes are provided then
+   *   - role added for each downstream aws node
+   */ 
+  createCfTemplate(params, settings, nodes, region) {
+    let ts = new Date();
+
+    let template = {
+      AWSTemplateFormatVersion: '2010-09-09',
+      Resources: {},
+      Outputs: {
+        LambdaArn: {
+          Description: 'The Arn of the cloud action flow lambda.',
+          Value: { 'Fn::GetAtt': ['Lambda', 'Arn'] }
+        }
+      }
+    };
+
+    let lambda = {
+        Type: "AWS::Lambda::Function",
+        Properties: {
+          FunctionName: settings.functionName,
+          Handler: "lambda.handler",
+          Role: { "Fn::GetAtt": [ "LambdaRole", "Arn" ] },
+          Code: {
+            S3Bucket: settings.deploymentBucketName,
+            S3Key: settings.zipFileName
+          },
+          Runtime: "nodejs12.x",
+          Timeout: 300,
+          Environment: {
+            Variables: {}
+          },
+          Tags: [
+            {
+                Key : "Kumologica-ts", 
+                Value : `${ts.toISOString()}`
+            }
+          ]
+        }
+    };
+    template.Resources['Lambda'] = lambda;
+
+    let lambdaRole = {
+      Type: 'AWS::IAM::Role',
+      Properties: {
+        RoleName: settings.roleName,
+        AssumeRolePolicyDocument: {
+          Version: '2012-10-17',
+          Statement: [
+            {
+              Effect: 'Allow',
+              Principal: {
+                Service: ['lambda.amazonaws.com']
+              },
+              Action: ['sts:AssumeRole']
+            }
+          ]
+        },
+        Path: '/',
+        Policies: [
+          {
+            PolicyName: 'AWSLambdaBasicExecutionPolicy',
+            PolicyDocument: {
+              Version: '2012-10-17',
+              Statement: [
+                {
+                  Effect: 'Allow',
+                  Action: [
+                    'logs:CreateLogGroup',
+                    'logs:CreateLogStream',
+                    'logs:PutLogEvents'
+                  ],
+                  Resource: '*'
+                }
+              ]
+            }
+          }
+        ]
+      }
+    };
+
+    const xRayPolicy = {
+      PolicyName: 'AWSLambdaXRayPolicy',
+      PolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Effect: 'Allow',
+            Action: [
+              'xray:PutTraceSegments',
+              'xray:PutTelemetryRecords'
+            ],
+            Resource: '*'
+          }
+        ]
+      }
+    };
+
+    if (params.description) {
+      lambda.Properties.Description = params.description;
+    }
+    if (params.memory) {
+      lambda.Properties.MemorySize = params.memory;
+    }
+    if (params.timeout) {
+      lambda.Properties.Timeout = params.timeout;
+    }
+
+    if (params.reservedConcurrency) {
+      lambda.Properties.ReservedConcurrentExecutions = params.reservedConcurrency;
+    }
+
+    if (params.xRay) {
+      lambdaRole.Properties.Policies.push(xRayPolicy);
+      lambda.Properties.TracingConfig = {'Mode': 'Active'};
+    }
+
+    if (params.role) {
+      lambda.Properties.Role = params.role;
+    }
+    if (params.environment) {
+      params.environment.forEach(function(env, index) {
+        lambda.Properties.Environment.Variables[env.key] = env.value;
+      });
+    }
+
+    if (params.tags) {
+      params.tags.forEach(function(tag, index) {
+        lambda.Properties.Tags.push({'Key': tag.key, 'Value': tag.value});
+      });
+    }
+
+    // adding inbound services permissions, only for dynamodb stream, sqs and kinesis
+    if (params.events) {
+      for (var i = 0; i < params.events.length; i++) {
+        if (['dynamodb', 'sqs', 'kinesis'].includes(params.events[i].source)) {
+          var mappingName = `${params.events[i].source}Mapping${i}`;
+
+          template.Resources[mappingName] = this.eventSourceMapping(params.events[i], settings);
+          
+          if (params.events[i].source === 'dynamodb') {
+            lambdaRole.Properties.Policies.push(
+              this.dynamoDbStreamPolicy(params.events[i])
+            );
+          }
+          if (params.events[i].source === 'sqs') {
+            lambdaRole.Properties.Policies.push(
+              this.sqsPolicy(params.events[i])
+            );
+          }
+          if (params.events[i].source === 'kinesis') {
+            lambdaRole.Properties.Policies.push(
+              this.kinesisPolicy(params.events[i])
+            );
+          }
+        }
+      }
+    }
+    
+    // adding all outbound services operations to iam role
+    if (nodes) {
+      for (var i=0; i<nodes.length; i++) {
+        // exluding lambda for time being
+        if (this.validNodeType(nodes[i])) {
+       // if (nodes[i] && nodes[i].type && ['Rekognition', 'S3', 'SQS', 'Cloudwatch', 'Dynamo DB', 'SNS', 'SES', 'SSM'].includes(nodes[i].type)) {
+          
+          if (nodes[i].type === 'Dynamo DB') {
+            //arn:aws:dynamodb:ap-southeast-2:174842903734:table/contact_us
+            let tableArn = this.handleValue(lambda, nodes[i].tableArn);
+            let tableParts = tableArn.split(":");
+            let tableName = '*';
+            if (tableParts && tableParts[5]) {
+              tableName = tableParts[5].replace('table/', '');
+            }
+            
+            this.handlePolicy(lambdaRole, `KLDDB${tableName}`, `dynamodb:${nodes[i].operation}`, tableArn);
+          
+          } else if (nodes[i].type === 'Lambda') {
+              //arn:aws:lambda:ap-southeast-2:174450237637:function:kumologica-deployments-flow-lambda
+              console.log(`lambda ${JSON.stringify(lambda)} node ${JSON.stringify(nodes[i])}`)
+              let lambdaArn = this.handleValue(lambda, nodes[i].LambdaArn);
+              let lambdaParts = lambdaArn.split(":");
+              let lambdaName = '*';
+              
+              if (lambdaParts && lambdaParts[6]) {
+                lambdaName = lambdaParts[6];
+              }
+              
+              this.handlePolicy(lambdaRole, `KLLBD${lambdaName}`, `lambda:InvokeFunction`, lambdaArn);
+           
+          } else if (nodes[i].type === 'SQS') {
+            let queueArn = this.handleValue(lambda, nodes[i].QueueArn);
+            let queueName = queueArn.split(":")[5];
+            this.handlePolicy(lambdaRole, `KLSQS${queueName}`, `sqs:${nodes[i].operation}`, queueArn);
+
+          } else if (nodes[i].type === 'SNS') { 
+            const topic = this.handleValue(lambda, nodes[i].publishTopic);
+            this.handlePolicy(lambdaRole, `KLSNS${topic}`, `sns:${nodes[i].operation}`, topic);
+
+          } else if (nodes[i].type === 'SES') { 
+            this.handlePolicy(lambdaRole, `KLSES`, `ses:${nodes[i].operation}`, '*');
+
+          } else if (nodes[i].type === 'SSM') {
+            const key = this.handleValue(lambda, nodes[i].Key);
+            const ssmArn =  { "Fn::Sub": `arn:aws:ssm:\${AWS::Region}:\${AWS::AccountId}:parameter/${key}` };
+            this.handlePolicy(lambdaRole, `KLSSM${key}`, `ssm:${nodes[i].operation}`, ssmArn);
+
+          } else if (nodes[i].type === 'S3') {
+            let bucketName = this.handleValue(lambda, nodes[i].Bucket);
+            const bucketArn = `arn:aws:s3:::${bucketName}/*`;
+            this.handlePolicy(lambdaRole, `KLS3${bucketName}`, `s3:${nodes[i].operation}`, bucketArn);
+          
+          } else if (nodes[i].type === 'Cloudwatch') {
+            let source = this.handleValue(lambda, nodes[i].Source);
+            this.handlePolicy(lambdaRole, `KLCWE${source}`, `event:${nodes[i].operation}`, source);
+          
+          } else if (nodes[i].type === 'Rekognition') {
+            const resource = this.rekognition.mapResource(nodes[i].operation, region, '*', nodes[i]);
+            this.handlePolicy(lambdaRole, `KLR${nodes[i].operation}`, `rekognition:${nodes[i].operation}`, resource);
+            
+            if (['DetectModerationLabels', 
+                'DetectText', 
+                'DetectLabels', 
+                'DetectFaces', 
+                'IndexFaces', 
+                'RecognizeCelebrities', 
+                'SearchFacesByImage', 
+                'StartStreamProcessor',
+                'StopStreamProcessor'].includes(nodes[i].operation)) {
+
+              const bucketName = nodes[i].Image;
+              const bucketArn = `arn:aws:s3:::${bucketName}/*`;
+              this.handlePolicy(lambdaRole, `KLS3${bucketName}`, `s3:Get*`, bucketArn);
+              this.handlePolicy(lambdaRole, `KLS3${bucketName}`, `s3:List*`, bucketArn);
+            }
+          }
+        }
+      }
+    }
+
+    if (!params.role) {
+      template.Resources['LambdaRole'] = lambdaRole;
+    }
+    return template;
+  }
+
+  validNodeType(node) {
+    return node 
+      && node.type 
+      && ['Rekognition', 'S3', 'SQS', 'Cloudwatch', 'Dynamo DB', 'SNS', 'SES', 'SSM', 'Lambda'].includes(node.type);
+  }
+  
+  // 
+  // Function allows the storage of aws resource identifier (arn or other)
+  // in either:
+  // - string property - value returned as is (key input)
+  // - env property - key input is a key to reference environment variable.
+  //                  if env variables got key missing then error is returned
+  // if var or msg used then error is returned, in these cases its impossible
+  // to determine the value 
+  handleValue(lambda, key) {
+    let value;
+    console.log(`key= ${key}`);
+
+    if (!key) {
+      return key;
+    }
+    let keyValue = key.replace(/\s+/g, '');
+
+    if (keyValue.startsWith("env.")) {
+    console.log(`keyValue= ${keyValue}`);
+      keyValue = keyValue.replace("env.", "");
+      value = lambda.Properties.Environment.Variables[keyValue];
+      if (!value) {
+        throw new Error(`Missing Environment variable: ${keyValue}`);
+      }
+    } else if (key.startsWith("msg.") || key.startsWith("vars.")) {
+      throw new Error('Only literal string and Environment variable references env. are supported sources of values. To use other types you must specify explicit role arn in function properties.');
+    } else {
+      value = key;
+    }
+    return this.sanitizeValue(value);
+  }
+
+  // Removes strings in quotes, they will cause cloudformation script to be invalid
+  sanitizeValue(value) {
+    let v = value.trim();
+    if (v.charAt(0) === '"' && v.charAt(v.length -1) === '"') {
+        return v.substr(1,v.length -2);
+    }
+    return value;
+  }
+
+  // 
+  // Function handles policy changes for specific resource:
+  // - creates new policy for resource if not found
+  // - updates existing resource policy (if found) with new permissions 
+  //
+  handlePolicy(lambdaRole, policyName, operation, id) {
+    console.log(`policyName: ${policyName}`);
+    policyName = policyName.replace('/', '-').replace('*', 'all');
+    let policy = jp.query(lambdaRole.Properties, `Policies[?(@.PolicyName=='${policyName}')]`);    
+    
+    if (policy.length == 1) {
+      policy[0].PolicyDocument.Statement[0].Action.push(operation);
+    } else {
+      lambdaRole.Properties.Policies.push(
+        this.outputPolicy(policyName, operation, id));
+    }
+  }
+
+  dynamoDbStreamPolicy(event) {
+    if (!event.stream) {
+      throw new Error(`Missing Trigger Parameter: DynamoDB Stream's ARN`);
+    }
+
+    return {
+      PolicyName: 'KumologicaLambdaDynamoDbStreamPolicy',
+      PolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Action: [
+              'dynamodb:DescribeStream',
+              'dynamodb:GetRecords',
+              'dynamodb:GetShardIterator'
+            ],
+            Resource: event.stream,
+            Effect: 'Allow'
+          }
+        ]
+      }
+    };
+  }
+
+  outputPolicy(name, action, resource) {
+    return {
+      PolicyName: name,
+      PolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Action: [action],
+            Resource: resource,
+            Effect: 'Allow'
+          }
+        ]
+      }
+    };
+  }
+
+  sqsPolicy(event) {
+    if (!event.stream) {
+      throw new Error(`Missing Trigger Parameter: SQS url`);
+    }
+    return {
+      PolicyName: 'KumologicaLambdaSQSPolicy',
+      PolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Action: [
+              'sqs:ReceiveMessage',
+              'sqs:DeleteMessage',
+              'sqs:GetQueueAttributes'
+            ],
+            Resource: event.stream,
+            Effect: 'Allow'
+          }
+        ]
+      }
+    };
+  }
+
+  kinesisPolicy(event) {
+    return {
+      PolicyName: 'KumologicaLambdaKinesisPolicy',
+      PolicyDocument: {
+        Version: '2012-10-17',
+        Statement: [
+          {
+            Action: [
+              'kinesis:DescribeStream',
+              'kinesis:DescribeStreamSummary',
+              'kinesis:GetRecords',
+              'kinesis:GetShardIterator',
+              'kinesis:ListShards',
+              'kinesis:ListStreams',
+              'kinesis:SubscribeToShard'
+            ],
+            Resource: event.stream,
+            Effect: 'Allow'
+          }
+        ]
+      }
+    };
+  }
+
+  eventSourceMapping(event, settings) {
+    
+    let mapping = {
+      Type: 'AWS::Lambda::EventSourceMapping',
+      DependsOn: 'Lambda',
+      Properties: {
+        EventSourceArn: event.stream,
+        FunctionName: { 'Fn::GetAtt': ['Lambda', 'Arn'] },
+        BatchSize: event.batchSize,
+        MaximumBatchingWindowInSeconds: event.batchWindow,
+        Enabled: true
+      }
+    };
+
+    if (event.startingPosition) {
+      mapping.Properties.StartingPosition = event.startingPosition;
+    }
+    return mapping;
+  }
+}
+
+module.exports = AWSCFTemplate;