6-Base-SetWeight.yml

---
AWSTemplateFormatVersion: "2010-09-09"
Description: SetWeight functionality for VPN. Must be deployed in the SES region. Need to manually activate SES Receiving RuleSet after creation. 1) Lightsail sends alert to admin@ALERT_FROM_DOMAIN 2) Prereq - Set up forwarding for Lightsail alerts from admin@ALERT_FROM_DOMAIN to lightsail@ALERT_TO_DOMAIN. 3) Prereq - ALERT_TO_DOMAIN needs to be set up for SES Email Receiving 4) SES Email Receiving rule triggers SNS topic to trigger Lambda. Note we cannot call Lambda directly from SES because it does not attach the full email alert.

Parameters:

  Environment:
    Type: String
    Description: Name of the environment.

  HostedZoneId:
    Type: String

  SourceId:
    Type: String

  BatchId:
    Type: String

  VpnDomain:
    Type: String

  AlertFromDomain:
    Type: String
    Description: Probably same as VPN_DOMAIN, but not always

  AlertToDomain:
    Type: String

Resources:

  SetWeightFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: !Sub >
          const HOSTED_ZONE_ID = '${HostedZoneId}';
          const SOURCE_ID = '${SourceId}';
          const BATCH_ID = '${BatchId}';
          const VPN_DOMAIN = '${VpnDomain}';
          const ALERT_FROM_DOMAIN = '${AlertFromDomain}';

          exports.handler = function(event, context) {
              console.log("event:\n", JSON.stringify(event));

              // Grab the email notification, parse it
              var snsMessage = event.Records[0].Sns.Message;
              var sesNotification = JSON.parse(snsMessage);
              console.log("parsed:\n", JSON.stringify(sesNotification, null, 2));

              console.log('ensure valid source for email');
              if (sesNotification.mail.source.endsWith("@" + ALERT_FROM_DOMAIN) !== true) {
                  console.log("Invalid email source");
                  context.fail("Invalid source for email: " + sesNotification.mail.source);
                  return;
              }

              // Check if any spam check failed
              console.log('Check for Spam');
              if (sesNotification.receipt.spfVerdict.status      === 'FAIL'
                  || sesNotification.receipt.dkimVerdict.status  !== 'PASS'
                  || sesNotification.receipt.spamVerdict.status  !== 'PASS'
                  || sesNotification.receipt.virusVerdict.status !== 'PASS'
                  || sesNotification.receipt.dmarcVerdict.status === 'FAIL') {
                  console.log('Dropping spam/unverified');
                  context.fail("Spam/unverified message");
              }
              else {
                  // Not Failed, print body of email
                  var content = Buffer.from(sesNotification.content.toString('utf8'), 'base64').toString('ascii');
                  console.log("Not Spam - Email content:\n", content);
                  // find line with  MonitoredResourceName: us-east-1-VPN-1A
                  var lines = content.split("\n");
              	for (var i = 0; i < lines.length; i++) {
              		if (lines[i].includes("MonitoredResourceName: ")) {
              			console.log("found: ", lines[i]);
              			// extract instance ID - last item
              			var lineSplit = lines[i].split(" ");
              			var instanceID = lineSplit[lineSplit.length - 1].trim(); // trim line breaks/whitespace
              			console.log(instanceID);
              			// transform ap-southeast-2-VPN-1A to ap-sydney
              			// we want this to filter down Record name for Route 53
              			var splitInstanceID = instanceID.split("-VPN-");
              			var instanceIDregion = splitInstanceID[0]; // "ap-southeast-2"
              			var instanceRegion = "us-east";
              			switch(instanceIDregion) {
              			    case 'ap-south-1':
              			        instanceRegion = "ap-mumbai";
              			        break;
              			    case 'ap-northeast-2':
              			        instanceRegion = "ap-seoul";
              			        break;
              			    case 'ap-southeast-1':
              			        instanceRegion = "ap-singapore";
              			        break;
              			    case 'ap-southeast-2':
              			        instanceRegion = "ap-sydney";
              			        break;
              			    case 'ap-northeast-1':
              			        instanceRegion = "ap-tokyo";
              			        break;
              			    case 'ca-central-1':
              			        instanceRegion = "canada";
              			        break;
              			    case 'eu-central-1':
              			        instanceRegion = "eu-frankfurt";
              			        break;
              			    case 'eu-west-1':
              			        instanceRegion = "eu-ireland";
              			        break;
              			    case 'eu-west-2':
              			        instanceRegion = "eu-london";
              			        break;
              			    case 'eu-west-3':
              			        instanceRegion = "eu-paris";
              			        break;
              			    case 'us-east-1':
              			        instanceRegion = "us-east";
              			        break;
              			    case 'us-west-2':
              			        instanceRegion = "us-west";
              			        break;
              			    default:
              			        break;
              			}
              			// attach source ID
              			var recordName = instanceRegion + "-" + SOURCE_ID + "-" + BATCH_ID + "." + VPN_DOMAIN;

              			// look up instance ID on R53
                    var AWS = require('aws-sdk');
              			var route53 = new AWS.Route53();
              			var params = {
                            HostedZoneId: HOSTED_ZONE_ID,
                            MaxItems: '200',
                            StartRecordName: recordName,
                            StartRecordType: 'A'
                          };
                          console.log(params);
                          route53.listResourceRecordSets(params, function(err, data) {
                              if (err) {
                                  // TODO: send error email on this and other errors
                                  console.log(err, err.stack);
                                  context.fail("Failed to list resource records:\n " + JSON.stringify(err));
                  			    return;
                              }
                              else {
                                  console.log(data);
                                  var records = data.ResourceRecordSets;
                                  for (var j = 0; j < records.length; j++) {
                                      // find the matching setIdentifier
                                      if (records[j].SetIdentifier == instanceID) {
                                          console.log("found entry: ", records[j]);
                                          var record = records[j];
                                          record.Weight = 0;
                                          console.log("new record: ", record);
                                          var params = {
                                              ChangeBatch: {
                                                  Changes: [{
                                                      Action: "UPSERT",
                                                      ResourceRecordSet: record
                                                  }]
                                              },
                                              HostedZoneId: HOSTED_ZONE_ID
                                          };
                                          route53.changeResourceRecordSets(params, function(err, data) {
                                              if (err) {
                                                  console.log(err, err.stack);
                                                  context.fail("error changing weight:\n" + JSON.stringify(err));
                                                  return;
                                              }
                                              else {
                                                  console.log(data);
                                                  console.log("SUCCESS Changed Weight for " + instanceID)
                                                  context.succeed();
                                  			          return;
                                              }
                                          });
                                          break; // don't do any others after the first match
                                      }
                                  }
                              }
                          });
              		}
              	}
              }
          };
      Handler: index.handler
      Role: !GetAtt SetWeightFunctionRole.Arn
      Runtime: nodejs14.x
      Timeout: 20

  SetWeightFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: lambda-logs-and-r53
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource:
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*:log-stream:*
          - Effect: Allow
            Action:
              - route53:ChangeResourceRecordSets
              - route53:ListResourceRecordSets
            Resource:
              - !Sub arn:aws:route53:::hostedzone/${HostedZoneId}

  SetWeightFromSnsPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt SetWeightFunction.Arn
      Action: lambda:InvokeFunction
      Principal: !Sub sns.amazonaws.com
      SourceArn: !Ref SetWeightSnsTopic

  SetWeightSnsTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
        - Endpoint: !GetAtt SetWeightFunction.Arn
          Protocol: lambda

  SetWeightSnsTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Version: '2008-10-17'
        Statement:
        - Effect: Allow
          Principal:
            AWS: "*"
          Action:
            - SNS:GetTopicAttributes
            - SNS:SetTopicAttributes
            - SNS:Subscribe
            - SNS:ListSubscriptionsByTopic
            - SNS:Publish
            - SNS:Receive
          Resource: !Ref SetWeightSnsTopic
          Condition:
            StringEquals:
              AWS:SourceOwner: !Sub ${AWS::AccountId}

      Topics:
        - !Ref SetWeightSnsTopic

  ReceiveRuleSet:
    Type: AWS::SES::ReceiptRuleSet
    Properties:
      RuleSetName: !Ref AlertToDomain

  ReceiveRule:
    Type: AWS::SES::ReceiptRule
    DependsOn:
      - ReceiveRuleSet
      - EmailsBucketPolicy
    Properties:
      RuleSetName: !Ref AlertToDomain
      Rule:
        Actions:
          - S3Action:
              BucketName: !Ref EmailsBucket
          - SNSAction:
              Encoding: Base64
              TopicArn: !Ref SetWeightSnsTopic
        Enabled: true
        Recipients:
          - !Sub lightsail@${AlertToDomain}
        ScanEnabled: true
        TlsPolicy: Require

  SetWeightLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub /aws/lambda/${SetWeightFunction}

  SetWeightEmailerErrorSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      DestinationArn:
        Fn::ImportValue:
          !Join [ '-', [ !Ref Environment, ErrorEmailerFunctionArn ] ]
      FilterPattern: 'ERROR'
      LogGroupName: !Ref SetWeightLogGroup

  SetWeightEmailerSuccessSubscriptionFilter:
    Type: AWS::Logs::SubscriptionFilter
    Properties:
      DestinationArn: !GetAtt SuccessEmailerFunction.Arn
      FilterPattern: 'SUCCESS'
      LogGroupName: !Ref SetWeightLogGroup

  # ===== Alerts =====

  SuccessEmailerFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: !Sub
          - >
            var aws = require('aws-sdk');
            var zlib = require('zlib');
            exports.handler = function(event, context) {
              var payload = new Buffer(event.awslogs.data, 'base64');
              zlib.gunzip(payload, function(e, result) {
                if (e) { context.fail(e); }
                else {
                  result = JSON.parse(result.toString('ascii'));
                  var sns = new aws.SNS();
                  var params = {
                      Message: JSON.stringify(result, null, 2),
                      Subject: "[SUCCESS] Set Weight to 0",
                      TopicArn: "${CloudWatchAlarmEmailerTopic}"
                  };
                  sns.publish(params, context.done);
                }
              });
            };
          - CloudWatchAlarmEmailerTopic:
              Fn::ImportValue:
                !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]
      Handler: index.handler
      Role: !GetAtt SuccessEmailerFunctionRole.Arn
      Runtime: nodejs12.x
      Timeout: 10

  SuccessEmailerFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: lambda-logs-SNS-success
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource:
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*
              - !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/*:log-stream:*
          - Effect: Allow
            Action:
              - sns:Publish
            Resource:
              Fn::ImportValue:
                !Join [ '-', [ !Ref Environment, CloudWatchAlarmEmailerTopic ] ]

  SuccessEmailerCloudWatchPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt SuccessEmailerFunction.Arn
      Action: lambda:InvokeFunction
      Principal: !Sub logs.${AWS::Region}.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'


  EmailsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      AccessControl: Private
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  EmailsBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref EmailsBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Sid: AllowSESPuts
          Effect: Allow
          Principal:
            Service: ses.amazonaws.com
          Action: s3:PutObject
          Resource: !Join
            - ''
            - - 'arn:aws:s3:::'
              - !Ref EmailsBucket
              - /*
          Condition:
            StringEquals:
              aws:Referer: !Ref "AWS::AccountId"