Friday, March 2, 2018

Check Website with Lambda

Check website with AWS Lambda using Python 2.7

Create SNS topic

  1. Go to SNS
  2. Create Topic
    1. Topic name: Check_Website
    2. Display name: checksite
  3. Subscribe yourself to this topic
Take note of the Topic ARN

Create IAM Policy

  1. Go to IAM
  2. Select Policies
  3. Create Policy
    1. Service: SNS
    2. Action: ALL (*)
    3. Resource: Specific, enter ARN from SNS topic created in previous step
  4. Review policy
  5. Name: publish_check_website
  6. Create Policy
Take note of the Policy ARN

Create the appropriate role

  1. Go to IAM
  2. Select Roles
  3. Create Role
  4. Select AWS service
  5. Select Lambda
  6. Click Next: Permissions
  7. Add AWSLambdaBasicExecutionRole
  8. Add publish_check_website
  9. Next: Review
  10. Role Name: Lambda_SNS
  11. Create Role

Create Lambda Function

  1. Go to Lambda
  2. Select Create Function
  3. Select Blueprints
  4. Filter on term, "lambda-canary" and select the blueprint
  5. Select Configure
  6. Basic Information
    1. Name: website-check
    2. Role: Choosing an existing role
    3. Existing role: Lambda_SNS
  7. cloudwatch-events
    1. Rule: Create a new rule
    2. Rule name: daily_website_check
    3. Rule type: schedule expression
    4. Schedule Expression: cron(0 10 * * ? *) Ref
  8. Enable trigger
  9. Create function

Update Code



 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
from __future__ import print_function

import os
import json
import boto3
from botocore.vendored import requests
from datetime import datetime
from urllib2 import urlopen

SITES = os.environ['sites']  # URL of the site to check, stored in the site environment variable, e.g. https://aws.amazon.com
EXPECTED = os.environ['expected']  # String expected to be on the page, stored in the expected environment variable, e.g. Amazon
SNS_ARN = os.environ['sns_arn']


sites_array = SITES.split(';')
expec_array = EXPECTED.split(';')

def validate(res,exp):
    '''Return False to trigger the canary

    Currently this simply checks whether the EXPECTED string is present.
    However, you could modify this to perform any number of arbitrary
    checks on the contents of SITE.
    '''
    return exp in res

def lambda_handler(event, context):
    this_message = "Website Check Script\r\n"
    this_message = this_message + datetime.now().strftime('%m/%d/%Y %H:%M')
    this_message = this_message + "(UTC) \r\n"
    for i in range(len(sites_array)):
        this_message = this_message + 'Checking ' + sites_array[i] + ": "
        try:
            if not validate(urlopen(sites_array[i]).read(),expec_array[i]):
                raise Exception('Validation failed')
        except:
            this_message = this_message + 'Check Failed ' + "\r\n"
        else:
            this_message = this_message + 'Check Success ' + "\r\n"
            
            
    url = 'https://icanhazdadjoke.com/'
    headers = {'Accept': 'text/plain'}
    r = requests.get(url, headers=headers)
    print(r.text)
    this_message = this_message + "\r\b" + r.text + "\r\n"
    
    client = boto3.client('sns')
    response = client.publish(
        TargetArn=SNS_ARN,
        Message=this_message,
        MessageStructure='text'
    )

Update Environment Variables


  1. Update the keys to as follows:
  2. Values for expected and sites must be semi-colon separated. List of expected must be any unique string(s) that exists on the page

Create a test event

  1. Scroll to the top and Configure test events
  2. Event name: test
  3. Accept default and click create
  4. Press Test to test the function




AWS WAF log4j query

How to query AWS WAF log for log4j attacks 1. Setup your Athena table using this instruction https://docs.aws.amazon.com/athena/latest/ug/wa...