@kumologica/sdk 3.2.0-beta8 → 3.2.0

package/src/app/lib/aws/cf.js

@@ -1,449 +0,0 @@
-const AWS = require('aws-sdk');
-const jp = require('jsonpath');
-const KLRekognition = require('./kl-rekognition-api');
-
-class AWSCFTemplate {
-  constructor() {
-    this.rekognition = new KLRekognition();
-  }
-
-  /*
-   * Creates cloud formation template file for current lambda:
-   * It is composed of:
-   * - lambda definition
-   * - lambda's role
-   * - lambda's policy
-   * - if event subriptions confirmed then event source mappings for:
-   *   - dynamodb stream
-   *   - sns
-   *   - kinesis
-   * - if flow nodes are provided then
-   *   - role added for each downstream aws node
-   */ 
-  createCfTemplate(params, settings, nodes, region) {
-    let ts = new Date();
-
-    let template = {
-      AWSTemplateFormatVersion: '2010-09-09',
-      Resources: {},
-      Outputs: {
-        LambdaArn: {
-          Description: 'The Arn of the cloud action flow lambda.',
-          Value: { 'Fn::GetAtt': ['Lambda', 'Arn'] }
-        }
-      }
-    };
-
-    let lambda = {
-        Type: "AWS::Lambda::Function",
-        Properties: {
-          FunctionName: settings.functionName,
-          Handler: "lambda.handler",
-          Role: { "Fn::GetAtt": [ "LambdaRole", "Arn" ] },
-          Code: {
-            S3Bucket: settings.deploymentBucketName,
-            S3Key: settings.zipFileName
-          },
-          Runtime: "nodejs12.x",
-          Timeout: 300,
-          Environment: {
-            Variables: {}
-          },
-          Tags: [
-            {
-                Key : "Kumologica-ts", 
-                Value : `${ts.toISOString()}`
-            }
-          ]
-        }
-    };
-    template.Resources['Lambda'] = lambda;
-
-    let lambdaRole = {
-      Type: 'AWS::IAM::Role',
-      Properties: {
-        RoleName: settings.roleName,
-        AssumeRolePolicyDocument: {
-          Version: '2012-10-17',
-          Statement: [
-            {
-              Effect: 'Allow',
-              Principal: {
-                Service: ['lambda.amazonaws.com']
-              },
-              Action: ['sts:AssumeRole']
-            }
-          ]
-        },
-        Path: '/',
-        Policies: [
-          {
-            PolicyName: 'AWSLambdaBasicExecutionPolicy',
-            PolicyDocument: {
-              Version: '2012-10-17',
-              Statement: [
-                {
-                  Effect: 'Allow',
-                  Action: [
-                    'logs:CreateLogGroup',
-                    'logs:CreateLogStream',
-                    'logs:PutLogEvents'
-                  ],
-                  Resource: '*'
-                }
-              ]
-            }
-          }
-        ]
-      }
-    };
-
-    const xRayPolicy = {
-      PolicyName: 'AWSLambdaXRayPolicy',
-      PolicyDocument: {
-        Version: '2012-10-17',
-        Statement: [
-          {
-            Effect: 'Allow',
-            Action: [
-              'xray:PutTraceSegments',
-              'xray:PutTelemetryRecords'
-            ],
-            Resource: '*'
-          }
-        ]
-      }
-    };
-
-    if (params.description) {
-      lambda.Properties.Description = params.description;
-    }
-    if (params.memory) {
-      lambda.Properties.MemorySize = params.memory;
-    }
-    if (params.timeout) {
-      lambda.Properties.Timeout = params.timeout;
-    }
-
-    if (params.reservedConcurrency) {
-      lambda.Properties.ReservedConcurrentExecutions = params.reservedConcurrency;
-    }
-
-    if (params.xRay) {
-      lambdaRole.Properties.Policies.push(xRayPolicy);
-      lambda.Properties.TracingConfig = {'Mode': 'Active'};
-    }
-
-    if (params.role) {
-      lambda.Properties.Role = params.role;
-    }
-    if (params.environment) {
-      params.environment.forEach(function(env, index) {
-        lambda.Properties.Environment.Variables[env.key] = env.value;
-      });
-    }
-
-    if (params.tags) {
-      params.tags.forEach(function(tag, index) {
-        lambda.Properties.Tags.push({'Key': tag.key, 'Value': tag.value});
-      });
-    }
-
-    // adding inbound services permissions, only for dynamodb stream, sqs and kinesis
-    if (params.events) {
-      for (var i = 0; i < params.events.length; i++) {
-        if (['dynamodb', 'sqs', 'kinesis'].includes(params.events[i].source)) {
-          var mappingName = `${params.events[i].source}Mapping${i}`;
-
-          template.Resources[mappingName] = this.eventSourceMapping(params.events[i], settings);
-          
-          if (params.events[i].source === 'dynamodb') {
-            lambdaRole.Properties.Policies.push(
-              this.dynamoDbStreamPolicy(params.events[i])
-            );
-          }
-          if (params.events[i].source === 'sqs') {
-            lambdaRole.Properties.Policies.push(
-              this.sqsPolicy(params.events[i])
-            );
-          }
-          if (params.events[i].source === 'kinesis') {
-            lambdaRole.Properties.Policies.push(
-              this.kinesisPolicy(params.events[i])
-            );
-          }
-        }
-      }
-    }
-    
-    // adding all outbound services operations to iam role
-    if (nodes) {
-      for (var i=0; i<nodes.length; i++) {
-        // exluding lambda for time being
-        if (this.validNodeType(nodes[i])) {
-       // if (nodes[i] && nodes[i].type && ['Rekognition', 'S3', 'SQS', 'Cloudwatch', 'Dynamo DB', 'SNS', 'SES', 'SSM'].includes(nodes[i].type)) {
-          
-          if (nodes[i].type === 'Dynamo DB') {
-            //arn:aws:dynamodb:ap-southeast-2:174842903734:table/contact_us
-            let tableArn = this.handleValue(lambda, nodes[i].tableArn);
-            let tableParts = tableArn.split(":");
-            let tableName = '*';
-            if (tableParts && tableParts[5]) {
-              tableName = tableParts[5].replace('table/', '');
-            }
-            
-            this.handlePolicy(lambdaRole, `KLDDB${tableName}`, `dynamodb:${nodes[i].operation}`, tableArn);
-          
-          } else if (nodes[i].type === 'Lambda') {
-              //arn:aws:lambda:ap-southeast-2:174450237637:function:kumologica-deployments-flow-lambda
-               let lambdaArn = this.handleValue(lambda, nodes[i].LambdaArn);
-              let lambdaParts = lambdaArn.split(":");
-              let lambdaName = '*';
-              
-              if (lambdaParts && lambdaParts[6]) {
-                lambdaName = lambdaParts[6];
-              }
-              
-              this.handlePolicy(lambdaRole, `KLLBD${lambdaName}`, `lambda:InvokeFunction`, lambdaArn);
-           
-          } else if (nodes[i].type === 'SQS') {
-            let queueArn = this.handleValue(lambda, nodes[i].QueueArn);
-            let queueName = queueArn.split(":")[5];
-            this.handlePolicy(lambdaRole, `KLSQS${queueName}`, `sqs:${nodes[i].operation}`, queueArn);
-
-          } else if (nodes[i].type === 'SNS') { 
-            const topic = this.handleValue(lambda, nodes[i].publishTopic);
-            this.handlePolicy(lambdaRole, `KLSNS${topic}`, `sns:${nodes[i].operation}`, topic);
-
-          } else if (nodes[i].type === 'SES') { 
-            this.handlePolicy(lambdaRole, `KLSES`, `ses:${nodes[i].operation}`, '*');
-
-          } else if (nodes[i].type === 'SSM') {
-            let key;
-            if (nodes[i].operation === "GetParametersByPath") {
-              key = this.handleValue(lambda, nodes[i].Path);
-            } else {  
-              key = this.handleValue(lambda, nodes[i].Key);
-            }
-
-            if (key.startsWith('/')) {
-              key = key.substring(1);
-            }
-            const ssmArn = {'Fn::Sub': 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/' + key};  
-            this.handlePolicy(lambdaRole, `KLSSM${new Date().valueOf()}`, `ssm:${nodes[i].operation}`, ssmArn);
-
-            if (nodes[i].operation === "GetParameter" && nodes[i].Key.startsWith("/aws/reference/secretsmanager/")) {
-              const smArn = {'Fn::Sub': 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:*'};  
-              this.handlePolicy(lambdaRole, `KLSM${new Date().valueOf()}`, "secretsmanager:GetSecretValue", smArn);
-            }
-          } else if (nodes[i].type === 'S3') {
-            let bucketName = this.handleValue(lambda, nodes[i].Bucket);
-            const bucketArn = `arn:aws:s3:::${bucketName}/*`;
-            this.handlePolicy(lambdaRole, `KLS3${bucketName}`, `s3:${nodes[i].operation}`, bucketArn);
-          
-          } else if (nodes[i].type === 'Cloudwatch') {
-            let source = this.handleValue(lambda, nodes[i].Source);
-            this.handlePolicy(lambdaRole, `KLCWE${source}`, `event:${nodes[i].operation}`, source);
-          
-          } else if (nodes[i].type === 'Rekognition') {
-            const resource = this.rekognition.mapResource(nodes[i].operation, region, '*', nodes[i]);
-            this.handlePolicy(lambdaRole, `KLR${nodes[i].operation}`, `rekognition:${nodes[i].operation}`, resource);
-            
-            if (['DetectModerationLabels', 
-                'DetectText', 
-                'DetectLabels', 
-                'DetectFaces', 
-                'IndexFaces', 
-                'RecognizeCelebrities', 
-                'SearchFacesByImage', 
-                'StartStreamProcessor',
-                'StopStreamProcessor'].includes(nodes[i].operation)) {
-
-              const bucketName = nodes[i].Image;
-              const bucketArn = `arn:aws:s3:::${bucketName}/*`;
-              this.handlePolicy(lambdaRole, `KLS3${bucketName}`, `s3:Get*`, bucketArn);
-              this.handlePolicy(lambdaRole, `KLS3${bucketName}`, `s3:List*`, bucketArn);
-            }
-          }
-        }
-      }
-    }
-
-    if (!params.role) {
-      template.Resources['LambdaRole'] = lambdaRole;
-    }
-
-    return template;
-  }
-
-  validNodeType(node) {
-    return node 
-      && node.type 
-      && ['Rekognition', 'S3', 'SQS', 'Cloudwatch', 'Dynamo DB', 'SNS', 'SES', 'SSM', 'Lambda'].includes(node.type);
-  }
-  
-  // 
-  // Function allows the storage of aws resource identifier (arn or other)
-  // in either:
-  // - string property - value returned as is (key input)
-  // - env property - key input is a key to reference environment variable.
-  //                  if env variables got key missing then error is returned
-  // if var or msg used then error is returned, in these cases its impossible
-  // to determine the value 
-  handleValue(lambda, key) {
-    let value;
-
-    if (!key) {
-      return key;
-    }
-    let keyValue = key.replace(/\s+/g, '');
-
-    if (keyValue.startsWith("env.")) {
-      keyValue = keyValue.replace("env.", "");
-      value = lambda.Properties.Environment.Variables[keyValue];
-      if (!value) {
-        throw new Error(`Missing Environment variable: ${keyValue}`);
-      }
-    } else if (key.startsWith("msg.") || key.startsWith("vars.")) {
-      throw new Error('Only literal string and Environment variable references env. are supported sources of values. To use other types you must specify explicit role arn in function properties.');
-    } else {
-      value = key;
-    }
-    return this.sanitizeValue(value);
-  }
-
-  // Removes strings in quotes, they will cause cloudformation script to be invalid
-  sanitizeValue(value) {
-    let v = value.trim();
-    if (v.charAt(0) === '"' && v.charAt(v.length -1) === '"') {
-        return v.substr(1,v.length -2);
-    }
-    return value;
-  }
-
-  // 
-  // Function handles policy changes for specific resource:
-  // - creates new policy for resource if not found
-  // - updates existing resource policy (if found) with new permissions 
-  //
-  handlePolicy(lambdaRole, policyName, operation, id) {
-    policyName = policyName.replace('/', '-').replace('*', 'all');
-    let policy = jp.query(lambdaRole.Properties, `Policies[?(@.PolicyName=='${policyName}')]`);    
-    
-    if (policy.length == 1) {
-      policy[0].PolicyDocument.Statement[0].Action.push(operation);
-    } else {
-      lambdaRole.Properties.Policies.push(
-        this.outputPolicy(policyName, operation, id));
-    }
-  }
-
-  dynamoDbStreamPolicy(event) {
-    if (!event.stream) {
-      throw new Error(`Missing Trigger Parameter: DynamoDB Stream's ARN`);
-    }
-
-    return {
-      PolicyName: 'KumologicaLambdaDynamoDbStreamPolicy',
-      PolicyDocument: {
-        Version: '2012-10-17',
-        Statement: [
-          {
-            Action: [
-              'dynamodb:DescribeStream',
-              'dynamodb:GetRecords',
-              'dynamodb:GetShardIterator'
-            ],
-            Resource: event.stream,
-            Effect: 'Allow'
-          }
-        ]
-      }
-    };
-  }
-
-  outputPolicy(name, action, resource) {
-    return {
-      PolicyName: name,
-      PolicyDocument: {
-        Version: '2012-10-17',
-        Statement: [
-          {
-            Action: [action],
-            Resource: resource,
-            Effect: 'Allow'
-          }
-        ]
-      }
-    };
-  }
-
-  sqsPolicy(event) {
-    if (!event.stream) {
-      throw new Error(`Missing Trigger Parameter: SQS url`);
-    }
-    return {
-      PolicyName: 'KLSQSPolicy'+process.hrtime(),
-      PolicyDocument: {
-        Version: '2012-10-17',
-        Statement: [
-          {
-            Action: [
-              'sqs:ReceiveMessage',
-              'sqs:DeleteMessage',
-              'sqs:GetQueueAttributes'
-            ],
-            Resource: event.stream,
-            Effect: 'Allow'
-          }
-        ]
-      }
-    };
-  }
-
-  kinesisPolicy(event) {
-    return {
-      PolicyName: 'KumologicaLambdaKinesisPolicy',
-      PolicyDocument: {
-        Version: '2012-10-17',
-        Statement: [
-          {
-            Action: [
-              'kinesis:DescribeStream',
-              'kinesis:DescribeStreamSummary',
-              'kinesis:GetRecords',
-              'kinesis:GetShardIterator',
-              'kinesis:ListShards',
-              'kinesis:ListStreams',
-              'kinesis:SubscribeToShard'
-            ],
-            Resource: event.stream,
-            Effect: 'Allow'
-          }
-        ]
-      }
-    };
-  }
-
-  eventSourceMapping(event, settings) {
-    
-    let mapping = {
-      Type: 'AWS::Lambda::EventSourceMapping',
-      DependsOn: 'Lambda',
-      Properties: {
-        EventSourceArn: event.stream,
-        FunctionName: { 'Fn::GetAtt': ['Lambda', 'Arn'] },
-        BatchSize: event.batchSize,
-        MaximumBatchingWindowInSeconds: event.batchWindow,
-        Enabled: true
-      }
-    };
-
-    if (event.startingPosition) {
-      mapping.Properties.StartingPosition = event.startingPosition;
-    }
-    return mapping;
-  }
-}
-
-module.exports = AWSCFTemplate;