├── .editorconfig
├── .gitignore
├── CloudFormation
    ├── Creating-Lambda-Backed-Custom-Resources
    │   ├── README.md
    │   ├── cf.yaml
    │   └── index.py
    └── S3-Hosted-Website
    │   ├── cf.yaml
    │   └── index.py
├── Config
    └── Finding-Outdated-Instance-Types
    │   ├── README.md
    │   ├── configuration_item.json
    │   └── lamba_function.py
├── DynamoDB
    ├── MoviesCreateTable.py
    ├── MoviesDeleteTable.py
    ├── MoviesItemOps01.py
    ├── MoviesItemOps02.py
    ├── MoviesItemOps03.py
    ├── MoviesItemOps04.py
    ├── MoviesItemOps05.py
    ├── MoviesItemOps06.py
    ├── MoviesLoadData.py
    ├── MoviesQuery01.py
    ├── MoviesQuery02.py
    ├── MoviesScan.py
    ├── README.md
    └── moviedata.json
├── EC2
    ├── AWS-Instance-Scheduler
    │   ├── README.md
    │   └── aws-instance-scheduler.json
    ├── Backing-Up-EC2-Instances
    │   ├── Create-Backups
    │   │   ├── iam.json
    │   │   └── lambda_handler.py
    │   └── Prune-Backups
    │   │   ├── iam.json
    │   │   └── lambda_handler.py
    ├── Deregistering-Old-AMIs
    │   ├── iam.json
    │   └── lambda_handler.py
    ├── Removing-Unattached-EBS-Volumes
    │   ├── README.md
    │   ├── iam.json
    │   ├── lambda_handler.py
    │   └── mapping.json
    └── Stopping-EC2-Instances-Nightly
    │   ├── README.md
    │   ├── iam.json
    │   └── lambda_function.py
├── Lab-Create-an-EC2-Instance-Using-Lambda
    ├── lambda_execution_role.json
    └── lambda_function.py
├── Lambda
    ├── CodeCommit-Change-Notification
    │   ├── README.md
    │   ├── lambda_execution_role.json
    │   ├── lambda_function.py
    │   └── state_change.json
    └── Working-with-Lambda-Layers
    │   ├── .gitignore
    │   ├── README.md
    │   ├── list_packages.py
    │   └── test_requests.py
├── Monitoring-Debugging
    ├── CloudWatch-Custom-Metrics
    │   ├── .gitignore
    │   ├── README.md
    │   ├── URLs.txt
    │   └── shopping-cart-app
    │   │   ├── add_to_cart
    │   │       ├── app.py
    │   │       └── requirements.txt
    │   │   ├── purchase
    │   │       ├── app.py
    │   │       └── requirements.txt
    │   │   ├── template.yaml
    │   │   └── view_product
    │   │       ├── app.py
    │   │       └── requirements.txt
    └── Tracing-with-X-Ray
    │   ├── README.md
    │   └── example
    │       ├── Pipfile
    │       ├── Pipfile.lock
    │       ├── app.py
    │       ├── requirements.txt
    │       └── zappa_settings.json
├── README.md
├── S3
    ├── Detecting-Faces-with-Rekognition
    │   ├── README.md
    │   ├── iam.json
    │   ├── lambda_function.py
    │   ├── names.txt
    │   ├── presidents.jpg
    │   └── response.json
    ├── Importing-CSV-Files
    │   ├── README.md
    │   ├── iam.json
    │   ├── lambda_function.py
    │   └── movies.csv
    ├── Resizing-Images
    │   ├── .gitignore
    │   ├── README.md
    │   ├── blue-marble.jpg
    │   ├── iam.json
    │   └── lambda_function.py
    └── Transcribing-Audio
    │   ├── InauguralAddress-1981.mp3
    │   ├── ParseTranscription
    │       ├── iam.json
    │       └── lambda_function.py
    │   ├── README.md
    │   ├── TranscribeAudio
    │       ├── iam.json
    │       └── lambda_function.py
    │   └── asrOutput.json
├── SQS
    ├── Creating-Queue-Using-Cross-Account-Permissions
    │   ├── .gitignore
    │   ├── README.md
    │   ├── lambda_execution_role.json
    │   └── lambda_function.py
    └── Triggering-Lambda-from-SQS
    │   ├── README.md
    │   ├── lambda_execution_role.json
    │   ├── lambda_function.py
    │   └── send_message.py
├── Scheduling-DynamoDB-Backups
    ├── lambda_execution_role.json
    └── lambda_function.py
├── Security
    ├── Automating-Resource-Tagging
    │   ├── README.md
    │   ├── TagBasedEC2RestrictionsPolicy.json
    │   ├── access_policy.json
    │   ├── event_pattern.json
    │   ├── lambda_function.py
    │   └── trust_policy.json
    ├── Enabling-VPC-Flow-Logs
    │   ├── README.md
    │   ├── event-pattern.json
    │   ├── lambda_execution_role.json
    │   ├── lambda_function.py
    │   ├── test-event.json
    │   ├── trust-policy.json
    │   └── vpc-flow-logs-iam-role.json
    ├── Making-Public-S3-Objects-Private
    │   ├── .gitignore
    │   ├── README.md
    │   ├── access_policy.json
    │   ├── bucket_policy.json
    │   ├── event_pattern.json
    │   ├── event_selectors.json
    │   ├── lambda_function.py
    │   └── trust_policy.json
    ├── Remediating-Inspector-Findings
    │   ├── README.md
    │   ├── finding-details.json
    │   └── lambda_function.py
    ├── Responding-to-Invalid-SSH-Logins
    │   ├── README.md
    │   ├── lambda_execution_role.json
    │   └── lambda_function.py
    └── Rotating-IAM-Access-Keys
    │   ├── README.md
    │   ├── lambda_execution_role.json
    │   └── lambda_function.py
├── ThirdParty
    ├── Slack
    │   ├── README.md
    │   ├── lambda_execution_role.json
    │   ├── lambda_function.py
    │   ├── sample_alarm.json
    │   └── sample_sns_message.json
    └── Twitter
    │   ├── .gitignore
    │   ├── README.md
    │   ├── data.txt
    │   ├── lambda_execution_role.json
    │   ├── lambda_function.py
    │   └── targets.json
├── Triggering-Lambda-from-SQS
    ├── README.md
    ├── lambda_execution_role.json
    ├── lambda_function.py
    ├── send_message.py
    └── sqs_lambda_function.py
├── Video-Transcoding
    ├── .gitignore
    ├── Aerial.mp4
    ├── Clouds.mp4
    ├── lambda_execution_role.json
    └── lambda_handler.py
└── WebApps
    └── Contact-Form
        ├── README.md
        ├── lambda
            ├── lambda_execution_role.json
            └── lambda_function.py
        └── webapp
            ├── css
                └── style.css
            ├── index.html
            └── js
                └── form.js


/.editorconfig:
--------------------------------------------------------------------------------
 1 | ; http://editorconfig.org
 2 | 
 3 | root = true
 4 | 
 5 | [*.{py,rst,txt}]
 6 | indent_style = space
 7 | trim_trailing_whitespace = true
 8 | indent_size = 4
 9 | end_of_line = LF
10 | 
11 | [*.{yml,yaml}]
12 | indent_style = space
13 | indent_size = 2
14 | end_of_line = LF
15 | 
16 | [*.json]
17 | indent_style = space
18 | indent_size = 2
19 | end_of_line = lf
20 | charset = utf-8
21 | trim_trailing_whitespace = true
22 | insert_final_newline = true
23 | 
24 | [*.md]
25 | indent_size = 4


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | **/.idea
2 | **/.sonarlint
3 | **/.vscode
4 | **/.DS_Store
5 | 


--------------------------------------------------------------------------------
/CloudFormation/Creating-Lambda-Backed-Custom-Resources/README.md:
--------------------------------------------------------------------------------
 1 | # Creating Lambda-backed Custom Resources
 2 | 
 3 | When you associate a Lambda function with a custom resource, the function is invoked whenever the custom resource is created, updated, or deleted. CloudFormation calls a Lambda API to invoke the function and to pass all the request data (such as the request type and resource properties) to the function.
 4 | 
 5 | In this lesson, you will learn how to implement password confirmation logic into a CloudFormation template.
 6 | 
 7 | ## AWS CloudFormation Deep Dive
 8 | 
 9 | <https://linuxacademy.com/cp/modules/view/id/157>
10 | 
11 | Custom resources are Lambda functions that get called by CloudFormation. CloudFormation has lots of defined resources that you can use to provision AWS resources. However, if you want to provision an AWS resource that CloudFormation doesn't support yet, or if you want to include some complicated logic during your CloudFormation stack create/update/delete, you can use a custom resource to do that easily.
12 | 
13 | ## Create CloudFormation stack
14 | 
15 | During a stack operation, CloudFormation sends a request to a pre-signed URL with a service token specified in the template, and then waits for a response before proceeding with the stack operation.
16 | 
17 | The custom resource provider (i.e. Lambda function) processes the CloudFormation request and returns a response of `SUCCESS` or `FAILED` to the pre-signed URL.
18 | 


--------------------------------------------------------------------------------
/CloudFormation/Creating-Lambda-Backed-Custom-Resources/cf.yaml:
--------------------------------------------------------------------------------
  1 | AWSTemplateFormatVersion: 2010-09-09
  2 | Description: >-
  3 |   Password validation with a Lambda-backed custom resource
  4 | 
  5 | Parameters:
  6 |   Password:
  7 |     NoEcho: 'true'
  8 |     Description: Enter Password
  9 |     Type: String
 10 |     MinLength: '6'
 11 |     MaxLength: '10'
 12 |     AllowedPattern: '[a-zA-Z0-9]*'
 13 |     ConstraintDescription: alphanumeric characters.
 14 |   ConfirmPassword:
 15 |     NoEcho: 'true'
 16 |     Description: Confirm Password
 17 |     Type: String
 18 |     MinLength: '6'
 19 |     MaxLength: '10'
 20 |     AllowedPattern: '[a-zA-Z0-9]*'
 21 |     ConstraintDescription: alphanumeric characters.
 22 | 
 23 | Metadata:
 24 |   'AWS::CloudFormation::Interface':
 25 |     ParameterGroups:
 26 |       - Label:
 27 |           default: Confirm the password
 28 |         Parameters:
 29 |           - Password
 30 |           - ConfirmPassword
 31 | 
 32 | Resources:
 33 | 
 34 |   CFNUser:
 35 |     Type: AWS::IAM::User
 36 |     Properties:
 37 |       LoginProfile:
 38 |         Password: !Ref Password
 39 |   
 40 |   CFNUserGroup:
 41 |     Type: AWS::IAM::Group
 42 |   
 43 |   CFNAdminGroup:
 44 |     Type: AWS::IAM::Group
 45 |   
 46 |   Users:
 47 |     Type: AWS::IAM::UserToGroupAddition
 48 |     Properties:
 49 |       GroupName: !Ref CFNUserGroup
 50 |       Users:
 51 |         - !Ref CFNUser
 52 |   
 53 |   Admins:
 54 |     Type: AWS::IAM::UserToGroupAddition
 55 |     Properties:
 56 |       GroupName: !Ref CFNAdminGroup
 57 |       Users:
 58 |         - !Ref CFNUser
 59 |   
 60 |   CFNUserPolicies:
 61 |     Type: AWS::IAM::Policy
 62 |     Properties:
 63 |       PolicyName: CFNUsers
 64 |       PolicyDocument:
 65 |         Statement:
 66 |           - Effect: Allow
 67 |             Action:
 68 |               - 'cloudformation:Describe*'
 69 |               - 'cloudformation:List*'
 70 |               - 'cloudformation:Get*'
 71 |             Resource: '*'
 72 |       Groups:
 73 |         - !Ref CFNUserGroup
 74 |   
 75 |   CFNAdminPolicies:
 76 |     Type: AWS::IAM::Policy
 77 |     Properties:
 78 |       PolicyName: CFNAdmins
 79 |       PolicyDocument:
 80 |         Statement:
 81 |           - Effect: Allow
 82 |             Action: 'cloudformation:*'
 83 |             Resource: '*'
 84 |       Groups:
 85 |         - !Ref CFNAdminGroup
 86 |   
 87 |   CFNKeys:
 88 |     Type: AWS::IAM::AccessKey
 89 |     Properties:
 90 |       UserName: !Ref CFNUser
 91 | 
 92 |   LambdaExecutionRole:
 93 |     Type: AWS::IAM::Role
 94 |     Properties:
 95 |       AssumeRolePolicyDocument:
 96 |         Version: 2012-10-17
 97 |         Statement:
 98 |           - Effect: Allow
 99 |             Principal:
100 |               Service:
101 |                 - lambda.amazonaws.com
102 |             Action:
103 |               - 'sts:AssumeRole'
104 |       Policies:
105 |         - PolicyName: lambdalogtocloudwatch
106 |           PolicyDocument:
107 |             Version: 2012-10-17
108 |             Statement:
109 |               - Effect: Allow
110 |                 Action:
111 |                   - 'logs:CreateLogGroup'
112 |                   - 'logs:CreateLogStream'
113 |                   - 'logs:PutLogEvents'
114 |                 Resource: 'arn:aws:logs:*:*:*'
115 | 
116 |   CheckPasswordsFunction:
117 |     Type: AWS::Lambda::Function
118 |     Properties:
119 |       Code:
120 |         ZipFile: |
121 |           import json
122 | 
123 |           import cfnresponse
124 | 
125 | 
126 |           def lambda_handler(event, context):
127 |               print(json.dumps(event))
128 |               response_data = {}
129 |               response_data['Data'] = None
130 | 
131 |               if event['RequestType'] != 'Create':
132 |                   cfnresponse.send(event, context, cfnresponse.SUCCESS,
133 |                                   response_data, "CustomResourcePhysicalID")
134 |                   return
135 | 
136 |               password = event['ResourceProperties']['Password']
137 |               confirm_password = event['ResourceProperties']['ConfirmPassword']
138 | 
139 |               if password == confirm_password:
140 |                   cfnresponse.send(event, context, cfnresponse.SUCCESS,
141 |                                   response_data, "CustomResourcePhysicalID")
142 |               else:
143 |                   print('Passwords do not match!')
144 |                   cfnresponse.send(event, context, cfnresponse.FAILED,
145 |                                   response_data, "CustomResourcePhysicalID")
146 |       
147 |       Description: CloudFormation custom resource
148 |       FunctionName: CheckPasswords
149 |       Handler: index.lambda_handler
150 |       Runtime: python3.7
151 |       Timeout: 3
152 |       Role: !GetAtt LambdaExecutionRole.Arn
153 |   
154 |   TestPasswords:
155 |     Type: Custom::LambdaCallout
156 |     Properties:
157 |       ServiceToken: !GetAtt CheckPasswordsFunction.Arn
158 |       Password: !Ref Password
159 |       ConfirmPassword: !Ref ConfirmPassword
160 | 
161 | Outputs:
162 |   AccessKey:
163 |     Value: !Ref CFNKeys
164 |     Description: AWSAccessKeyId of new user
165 |   SecretKey:
166 |     Value: !GetAtt CFNKeys.SecretAccessKey
167 |     Description: AWSSecretKey of new user
168 | 


--------------------------------------------------------------------------------
/CloudFormation/Creating-Lambda-Backed-Custom-Resources/index.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | 
 3 | import cfnresponse
 4 | 
 5 | 
 6 | def lambda_handler(event, context):
 7 |     print(json.dumps(event))
 8 |     response_data = {}
 9 |     response_data['Data'] = None
10 | 
11 |     if event['RequestType'] != 'Create':
12 |         cfnresponse.send(event, context, cfnresponse.SUCCESS,
13 |                          response_data, "CustomResourcePhysicalID")
14 |         return
15 | 
16 |     password = event['ResourceProperties']['Password']
17 |     confirm_password = event['ResourceProperties']['ConfirmPassword']
18 | 
19 |     if password == confirm_password:
20 |         cfnresponse.send(event, context, cfnresponse.SUCCESS,
21 |                          response_data, "CustomResourcePhysicalID")
22 |     else:
23 |         print('Passwords do not match!')
24 |         cfnresponse.send(event, context, cfnresponse.FAILED,
25 |                          response_data, "CustomResourcePhysicalID")
26 | 


--------------------------------------------------------------------------------
/CloudFormation/S3-Hosted-Website/cf.yaml:
--------------------------------------------------------------------------------
  1 | AWSTemplateFormatVersion: 2010-09-09
  2 | 
  3 | Description: Create an S3-hosted static website and deploy content from Github
  4 | 
  5 | Parameters:
  6 | 
  7 |   RepoURL:
  8 |     Description: Github repository to upload into S3
  9 |     Type: String
 10 |     Default: 'https://github.com/linuxacademy/content-lambda-boto3/'
 11 |     MinLength: 1
 12 |     AllowedPattern: '^https?://[^\\s/$.?#].[^\\s]*$'
 13 |     ConstraintDescription: URL
 14 |   RepoSubdir:
 15 |     Description: Repository subdirectory to upload to S3
 16 |     Type: String
 17 |     Default: 'WebApps/Contact-Form/webapp'
 18 |     MinLength: 1
 19 | 
 20 | 
 21 | Resources:
 22 | 
 23 |   S3Bucket:
 24 |     Type: AWS::S3::Bucket
 25 |     Properties:
 26 |       AccessControl: PublicRead
 27 |       WebsiteConfiguration:
 28 |         IndexDocument: index.html
 29 |     DeletionPolicy: Retain
 30 | 
 31 |   BucketPolicy:
 32 |     Type: AWS::S3::BucketPolicy
 33 |     Properties:
 34 |       PolicyDocument:
 35 |         Id: MyPolicy
 36 |         Version: 2012-10-17
 37 |         Statement:
 38 |           - Sid: PublicReadForGetBucketObjects
 39 |             Effect: Allow
 40 |             Principal: '*'
 41 |             Action: 's3:GetObject'
 42 |             Resource: !Sub "arn:aws:s3:::${S3Bucket}/*"
 43 |       Bucket: !Ref S3Bucket
 44 | 
 45 |   LambdaDeployToS3Role:
 46 |     Type: AWS::IAM::Role
 47 |     Properties:
 48 |       AssumeRolePolicyDocument:
 49 |         Version: 2012-10-17
 50 |         Statement:
 51 |           - Effect: Allow
 52 |             Principal:
 53 |               Service:
 54 |                 - lambda.amazonaws.com
 55 |             Action:
 56 |               - 'sts:AssumeRole'
 57 |       ManagedPolicyArns:
 58 |         - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 59 |       Policies:
 60 |         - PolicyName: S3Policy
 61 |           PolicyDocument:
 62 |             Version: '2012-10-17'
 63 |             Statement:
 64 |               - Effect: Allow
 65 |                 Action:
 66 |                   - 's3:PutObject'
 67 |                   - 'S3:DeleteObject'
 68 |                 Resource: !Sub "arn:aws:s3:::${S3Bucket}/*"
 69 | 
 70 |   DeployToS3Function:
 71 |     Type: AWS::Lambda::Function
 72 |     Properties:
 73 |       Code:
 74 |         ZipFile: |
 75 |           import json
 76 |           import mimetypes
 77 |           import os
 78 |           import threading
 79 |           import urllib.request
 80 |           import zipfile
 81 |           from urllib.parse import urlparse
 82 | 
 83 |           import boto3
 84 |           import cfnresponse
 85 | 
 86 |           s3 = boto3.resource('s3')
 87 | 
 88 | 
 89 |           def lambda_handler(event, context):
 90 |               print(json.dumps(event))
 91 |               response_data = {}
 92 |               response_data['Data'] = None
 93 | 
 94 |               # Setup timer to catch timeouts
 95 |               t = threading.Timer((context.get_remaining_time_in_millis() / 1000.00) - 0.5,
 96 |                                   timeout, args=[event, context])
 97 |               t.start()
 98 | 
 99 |               try:
100 |                   bucket = event['ResourceProperties']['BucketName']
101 |                   repo_subdir = event['ResourceProperties']['RepoSubdir']
102 |                   repo_url = event['ResourceProperties']['RepoURL']
103 |                   repo_name = urlparse(repo_url).path.split('/')[-2]
104 |                   local_file = download_repo(repo_url)
105 |                   extract(local_file, '/tmp')
106 |                   upload_to_s3(bucket, f'/tmp/{repo_name}-master/{repo_subdir}')
107 |                   cfnresponse.send(event, context, cfnresponse.SUCCESS,
108 |                                   response_data, "CustomResourcePhysicalID")
109 |               except Exception as e:
110 |                   print("Error: " + str(e))
111 |                   cfnresponse.send(event, context, cfnresponse.FAILED,
112 |                                   response_data, "CustomResourcePhysicalID")
113 |               finally:
114 |                   # Cancel timer before exit
115 |                   t.cancel()
116 | 
117 | 
118 |           # Function that executes just before lambda execution times out
119 |           def timeout(event, context, logger):
120 |               print("Execution is about to time out, sending failure message")
121 |               cfnresponse.send(event, context, cfnresponse.FAILED,
122 |                               {}, "CustomResourcePhysicalID", reason="Execution timed out")
123 | 
124 | 
125 |           def download_repo(url):
126 |               # i.e. https://github.com/linuxacademy/content-lambda-boto3/archive/master.zip
127 |               url += 'archive/master.zip'
128 |               print('Downloading repo: ' + url)
129 |               file_name = os.path.basename(url)  # i.e. master.zip
130 |               local_file = os.path.join('/tmp', file_name)
131 |               urllib.request.urlretrieve(url, local_file)
132 |               st = os.stat(local_file)
133 |               print(f'Downloaded {st.st_size} bytes')
134 |               return local_file
135 | 
136 | 
137 |           def extract(file, target_dir):
138 |               print(f'Extracting {file} to {target_dir}')
139 |               with zipfile.ZipFile(file, "r") as zip:
140 |                   zip.printdir()
141 |                   zip.extractall(target_dir)
142 | 
143 | 
144 |           def upload_to_s3(bucket, path):
145 |               print(f'Uploading {path} to s3://{bucket}')
146 |               bucket = s3.Bucket(bucket)
147 |               for subdir, dirs, files in os.walk(path):
148 |                   for file in files:
149 |                       full_path = os.path.join(subdir, file)
150 |                       mime_type = mimetypes.MimeTypes().guess_type(full_path)[0]
151 |                       with open(full_path, 'rb') as data:
152 |                           print(f'Uploading: {full_path} [{mime_type}]')
153 |                           bucket.put_object(
154 |                               Key=full_path[len(path)+1:], Body=data, ContentType=mime_type)
155 |       
156 |       Description: CloudFormation custom resource
157 |       Handler: index.lambda_handler
158 |       Runtime: python3.7
159 |       Timeout: 60
160 |       Role: !GetAtt LambdaDeployToS3Role.Arn
161 |   
162 |   DeployToS3:
163 |     Type: Custom::DeployToS3
164 |     Properties:
165 |       ServiceToken: !GetAtt DeployToS3Function.Arn
166 |       RepoURL: !Ref RepoURL
167 |       RepoSubdir: !Ref RepoSubdir
168 |       BucketName: !Ref S3Bucket
169 |       
170 | 
171 | Outputs:
172 | 
173 |   WebsiteURL:
174 |     Value: !GetAtt 
175 |       - S3Bucket
176 |       - WebsiteURL
177 |     Description: URL for website hosted on S3
178 | 
179 |   S3BucketSecureURL:
180 |     Value: !Join 
181 |       - ''
182 |       - - 'https://'
183 |         - !GetAtt 
184 |           - S3Bucket
185 |           - DomainName
186 |     Description: Name of S3 bucket to hold website content


--------------------------------------------------------------------------------
/CloudFormation/S3-Hosted-Website/index.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | import mimetypes
 3 | import os
 4 | import threading
 5 | import urllib.request
 6 | import zipfile
 7 | from urllib.parse import urlparse
 8 | 
 9 | import boto3
10 | import cfnresponse
11 | 
12 | s3 = boto3.resource('s3')
13 | 
14 | 
15 | def lambda_handler(event, context):
16 |     print(json.dumps(event))
17 |     response_data = {}
18 |     response_data['Data'] = None
19 | 
20 |     # Setup timer to catch timeouts
21 |     t = threading.Timer((context.get_remaining_time_in_millis() / 1000.00) - 0.5,
22 |                         timeout, args=[event, context])
23 |     t.start()
24 | 
25 |     try:
26 |         bucket = event['ResourceProperties']['BucketName']
27 |         repo_subdir = event['ResourceProperties']['RepoSubdir']
28 |         repo_url = event['ResourceProperties']['RepoURL']
29 |         repo_name = urlparse(repo_url).path.split('/')[-2]
30 |         local_file = download_repo(repo_url)
31 |         extract(local_file, '/tmp')
32 |         upload_to_s3(bucket, f'/tmp/{repo_name}-master/{repo_subdir}')
33 |         cfnresponse.send(event, context, cfnresponse.SUCCESS,
34 |                          response_data, "CustomResourcePhysicalID")
35 |     except Exception as e:
36 |         print("Error: " + str(e))
37 |         cfnresponse.send(event, context, cfnresponse.FAILED,
38 |                          response_data, "CustomResourcePhysicalID")
39 |     finally:
40 |         # Cancel timer before exit
41 |         t.cancel()
42 | 
43 | 
44 | # Function that executes just before lambda execution times out
45 | def timeout(event, context, logger):
46 |     print("Execution is about to time out, sending failure message")
47 |     cfnresponse.send(event, context, cfnresponse.FAILED,
48 |                      {}, "CustomResourcePhysicalID", reason="Execution timed out")
49 | 
50 | 
51 | def download_repo(url):
52 |     # i.e. https://github.com/linuxacademy/content-lambda-boto3/archive/master.zip
53 |     url += 'archive/master.zip'
54 |     print('Downloading repo: ' + url)
55 |     file_name = os.path.basename(url)  # i.e. master.zip
56 |     local_file = os.path.join('/tmp', file_name)
57 |     urllib.request.urlretrieve(url, local_file)
58 |     st = os.stat(local_file)
59 |     print(f'Downloaded {st.st_size} bytes')
60 |     return local_file
61 | 
62 | 
63 | def extract(file, target_dir):
64 |     print(f'Extracting {file} to {target_dir}')
65 |     with zipfile.ZipFile(file, "r") as zip:
66 |         zip.printdir()
67 |         zip.extractall(target_dir)
68 | 
69 | 
70 | def upload_to_s3(bucket, path):
71 |     print(f'Uploading {path} to s3://{bucket}')
72 |     bucket = s3.Bucket(bucket)
73 |     for subdir, dirs, files in os.walk(path):
74 |         for file in files:
75 |             full_path = os.path.join(subdir, file)
76 |             mime_type = mimetypes.MimeTypes().guess_type(full_path)[0]
77 |             with open(full_path, 'rb') as data:
78 |                 print(f'Uploading: {full_path} [{mime_type}]')
79 |                 bucket.put_object(
80 |                     Key=full_path[len(path)+1:], Body=data, ContentType=mime_type)
81 | 


--------------------------------------------------------------------------------
/Config/Finding-Outdated-Instance-Types/README.md:
--------------------------------------------------------------------------------
 1 | # Finding Outdated Instance Types
 2 | 
 3 | In this lesson, we'll create a custom AWS Config rule to find outdated EC2 instance types. Moving off these old instance types could save on costs and improve performance.
 4 | 
 5 | ## Create Lambda Function
 6 | 
 7 | Create a role called **LambdaCheckInstanceTypeRole** and specify **AWS Config Rules permissions** as the policy template.
 8 | 
 9 | Create the Lambda function **CheckInstanceType**. Note the ARN for the next steps.
10 | 
11 | ## Create AWS Config Rule
12 | 
13 | 1. In the AWS Config console, select Rules, then click the **Add rule** button.
14 | 2. Next, select **Add custom rule**.
15 | 3. Name: **DesiredInstanceTypes**
16 | 4. Description: **Checks that all EC2 instances are of the type specified**
17 | 5. Select the **AWS Lambda function ARN**, i.e. `arn:aws:lambda:us-east-1:123456789012:function:CheckInstanceType`
18 | 6. Trigger type: **Configuration changes**
19 | 7. Scope of changes: **Resources**
20 | 8. Resources: **EC2: Instance**
21 | 9. Rule parameters:
22 |    - Key: `desiredInstanceType`
23 |    - Value: `t2.micro` or a comma-separated list, i.e. `t2.micro,t3.micro`. Any values **not** in this list will have the effect of **noncompliant**.
24 | 10. Click **Save**


--------------------------------------------------------------------------------
/Config/Finding-Outdated-Instance-Types/configuration_item.json:
--------------------------------------------------------------------------------
  1 | {
  2 |   "version": "1.2",
  3 |   "accountId": "681361479661",
  4 |   "configurationItemCaptureTime": "2017-04-05T22:23:11.677Z",
  5 |   "configurationItemStatus": "ResourceDiscovered",
  6 |   "configurationStateId": "1491430991677",
  7 |   "configurationItemMD5Hash": "7d83283adb8b966945d43cee39c7419c",
  8 |   "arn": "arn:aws:ec2:us-east-1:681361479661:instance/i-03402838daac1d611",
  9 |   "resourceType": "AWS::EC2::Instance",
 10 |   "resourceId": "i-03402838daac1d611",
 11 |   "awsRegion": "us-east-1",
 12 |   "availabilityZone": "us-east-1b",
 13 |   "resourceCreationTime": "2017-04-05T22:15:53.000Z",
 14 |   "tags": {},
 15 |   "relatedEvents": [
 16 |     "d3d87c29-bde3-4380-a7de-810f379246cc"
 17 |   ],
 18 |   "relationships": [{
 19 |       "resourceType": "AWS::EC2::NetworkInterface",
 20 |       "resourceId": "eni-d055cfc4",
 21 |       "relationshipName": "Contains NetworkInterface"
 22 |     },
 23 |     {
 24 |       "resourceType": "AWS::EC2::SecurityGroup",
 25 |       "resourceId": "sg-fd215482",
 26 |       "relationshipName": "Is associated with SecurityGroup"
 27 |     },
 28 |     {
 29 |       "resourceType": "AWS::EC2::Subnet",
 30 |       "resourceId": "subnet-1aaccc7f",
 31 |       "relationshipName": "Is contained in Subnet"
 32 |     },
 33 |     {
 34 |       "resourceType": "AWS::EC2::Volume",
 35 |       "resourceId": "vol-0c24aa343c564eda8",
 36 |       "relationshipName": "Is attached to Volume"
 37 |     },
 38 |     {
 39 |       "resourceType": "AWS::EC2::VPC",
 40 |       "resourceId": "vpc-79b3ea1e",
 41 |       "relationshipName": "Is contained in Vpc"
 42 |     }
 43 |   ],
 44 |   "configuration": {
 45 |     "instanceId": "i-03402838daac1d611",
 46 |     "imageId": "ami-22ce4934",
 47 |     "state": {
 48 |       "code": 16,
 49 |       "name": "running"
 50 |     },
 51 |     "privateDnsName": "ip-172-31-74-239.ec2.internal",
 52 |     "publicDnsName": "ec2-34-205-29-138.compute-1.amazonaws.com",
 53 |     "stateTransitionReason": "",
 54 |     "keyName": "ssm-key",
 55 |     "amiLaunchIndex": 0,
 56 |     "productCodes": [],
 57 |     "instanceType": "t2.micro",
 58 |     "launchTime": "2017-04-05T22:15:53.000Z",
 59 |     "placement": {
 60 |       "availabilityZone": "us-east-1b",
 61 |       "groupName": "",
 62 |       "tenancy": "default"
 63 |     },
 64 |     "monitoring": {
 65 |       "state": "disabled"
 66 |     },
 67 |     "subnetId": "subnet-1aaccc7f",
 68 |     "vpcId": "vpc-79b3ea1e",
 69 |     "privateIpAddress": "172.31.74.239",
 70 |     "publicIpAddress": "34.205.29.138",
 71 |     "architecture": "x86_64",
 72 |     "rootDeviceType": "ebs",
 73 |     "rootDeviceName": "/dev/xvda",
 74 |     "blockDeviceMappings": [{
 75 |       "deviceName": "/dev/xvda",
 76 |       "ebs": {
 77 |         "volumeId": "vol-0c24aa343c564eda8",
 78 |         "status": "attached",
 79 |         "attachTime": "2017-04-05T22:15:54.000Z",
 80 |         "deleteOnTermination": true
 81 |       }
 82 |     }],
 83 |     "virtualizationType": "hvm",
 84 |     "clientToken": "UuPNx1491430552432",
 85 |     "tags": [],
 86 |     "securityGroups": [{
 87 |       "groupName": "launch-wizard-2",
 88 |       "groupId": "sg-fd215482"
 89 |     }],
 90 |     "sourceDestCheck": true,
 91 |     "hypervisor": "xen",
 92 |     "networkInterfaces": [{
 93 |       "networkInterfaceId": "eni-d055cfc4",
 94 |       "subnetId": "subnet-1aaccc7f",
 95 |       "vpcId": "vpc-79b3ea1e",
 96 |       "description": "",
 97 |       "ownerId": "681361479661",
 98 |       "status": "in-use",
 99 |       "macAddress": "02:3e:c3:cb:e9:da",
100 |       "privateIpAddress": "172.31.74.239",
101 |       "privateDnsName": "ip-172-31-74-239.ec2.internal",
102 |       "sourceDestCheck": true,
103 |       "groups": [{
104 |         "groupName": "launch-wizard-2",
105 |         "groupId": "sg-fd215482"
106 |       }],
107 |       "attachment": {
108 |         "attachmentId": "eni-attach-e8d5c971",
109 |         "deviceIndex": 0,
110 |         "status": "attached",
111 |         "attachTime": "2017-04-05T22:15:53.000Z",
112 |         "deleteOnTermination": true
113 |       },
114 |       "association": {
115 |         "publicIp": "34.205.29.138",
116 |         "publicDnsName": "ec2-34-205-29-138.compute-1.amazonaws.com",
117 |         "ipOwnerId": "amazon"
118 |       },
119 |       "privateIpAddresses": [{
120 |         "privateIpAddress": "172.31.74.239",
121 |         "privateDnsName": "ip-172-31-74-239.ec2.internal",
122 |         "primary": true,
123 |         "association": {
124 |           "publicIp": "34.205.29.138",
125 |           "publicDnsName": "ec2-34-205-29-138.compute-1.amazonaws.com",
126 |           "ipOwnerId": "amazon"
127 |         }
128 |       }],
129 |       "ipv6Addresses": []
130 |     }],
131 |     "ebsOptimized": true,
132 |     "enaSupport": true
133 |   },
134 |   "supplementaryConfiguration": {}
135 | }
136 | 


--------------------------------------------------------------------------------
/Config/Finding-Outdated-Instance-Types/lamba_function.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | 
 3 | import boto3
 4 | 
 5 | config = boto3.client('config')
 6 | 
 7 | 
 8 | def lambda_handler(event, context):
 9 |     invoking_event = json.loads(event['invokingEvent'])
10 |     rule_parameters = json.loads(event['ruleParameters'])  # i.e. 't2.micro'
11 | 
12 |     compliance_value = 'NOT_APPLICABLE'
13 |     item = invoking_event['configurationItem']  # one per AWS resource
14 | 
15 |     if is_applicable(item, event):
16 |         compliance_value = evaluate_compliance(item, rule_parameters)
17 | 
18 |     config.put_evaluations(
19 |         Evaluations=[
20 |             {
21 |                 'ComplianceResourceType': item['resourceType'],
22 |                 'ComplianceResourceId': item['resourceId'],
23 |                 'ComplianceType': compliance_value,
24 |                 'OrderingTimestamp': item['configurationItemCaptureTime']
25 |             },
26 |         ],
27 |         ResultToken=event['resultToken'])
28 | 
29 | 
30 | def is_applicable(item, event):
31 |     status = item['configurationItemStatus']
32 |     event_left_scope = event['eventLeftScope']
33 |     test = ((status in ['OK', 'ResourceDiscovered']) and
34 |             event_left_scope is False)
35 |     return test
36 | 
37 | 
38 | def evaluate_compliance(config_item, rule_parameters):
39 |     if config_item['resourceType'] != 'AWS::EC2::Instance':
40 |         return 'NOT_APPLICABLE'
41 | 
42 |     instance_id = config_item['configuration']['instanceId']
43 |     instance_type = config_item['configuration']['instanceType']
44 | 
45 |     print(f"Instance {instance_id} {instance_type} is ", end='')
46 | 
47 |     if (config_item['configuration']['instanceType'] in
48 |             rule_parameters['desiredInstanceType']):
49 |         print('COMPLIANT')
50 |         return 'COMPLIANT'
51 |     else:
52 |         print('NON_COMPLIANT')
53 |         return 'NON_COMPLIANT'
54 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesCreateTable.py:
--------------------------------------------------------------------------------
 1 | import boto3
 2 | 
 3 | dynamodb = boto3.resource('dynamodb')
 4 | 
 5 | 
 6 | table = dynamodb.create_table(
 7 |     TableName='Movies',
 8 |     KeySchema=[
 9 |         {
10 |             'AttributeName': 'year',
11 |             'KeyType': 'HASH'  # Partition key
12 |         },
13 |         {
14 |             'AttributeName': 'title',
15 |             'KeyType': 'RANGE'  # Sort key
16 |         }
17 |     ],
18 |     AttributeDefinitions=[
19 |         {
20 |             'AttributeName': 'year',
21 |             'AttributeType': 'N'
22 |         },
23 |         {
24 |             'AttributeName': 'title',
25 |             'AttributeType': 'S'
26 |         },
27 | 
28 |     ],
29 |     ProvisionedThroughput={
30 |         'ReadCapacityUnits': 10,
31 |         'WriteCapacityUnits': 10
32 |     }
33 | )
34 | 
35 | print('Table status:', table.table_status)
36 | 
37 | print('Waiting for', table.name, 'to complete creating...')
38 | table.meta.client.get_waiter('table_exists').wait(TableName='Movies')
39 | print('Table status:', dynamodb.Table('Movies').table_status)
40 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesDeleteTable.py:
--------------------------------------------------------------------------------
1 | import boto3
2 | 
3 | dynamodb = boto3.resource('dynamodb')
4 | 
5 | table = dynamodb.Table('Movies')
6 | 
7 | table.delete()
8 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesItemOps01.py:
--------------------------------------------------------------------------------
 1 | import decimal
 2 | import json
 3 | 
 4 | import boto3
 5 | 
 6 | 
 7 | class DecimalEncoder(json.JSONEncoder):
 8 |     '''Helper class to convert a DynamoDB item to JSON'''
 9 | 
10 |     def default(self, o):
11 |         if isinstance(o, decimal.Decimal):
12 |             if abs(o) % 1 > 0:
13 |                 return float(o)
14 |             else:
15 |                 return int(o)
16 |         return super(DecimalEncoder, self).default(o)
17 | 
18 | 
19 | dynamodb = boto3.resource('dynamodb')
20 | 
21 | table = dynamodb.Table('Movies')
22 | 
23 | title = "The Big New Movie"
24 | year = 2015
25 | 
26 | response = table.put_item(
27 |     Item={
28 |         'year': year,
29 |         'title': title,
30 |         'info': {
31 |             'plot': "Nothing happens at all.",
32 |             'rating': decimal.Decimal(0)
33 |         }
34 |     }
35 | )
36 | 
37 | print("PutItem succeeded:")
38 | print(json.dumps(response, indent=4, cls=DecimalEncoder))
39 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesItemOps02.py:
--------------------------------------------------------------------------------
 1 | import decimal
 2 | import json
 3 | 
 4 | import boto3
 5 | from boto3.dynamodb.conditions import Attr, Key
 6 | from botocore.exceptions import ClientError
 7 | 
 8 | 
 9 | class DecimalEncoder(json.JSONEncoder):
10 |     '''Helper class to convert a DynamoDB item to JSON'''
11 | 
12 |     def default(self, o):
13 |         if isinstance(o, decimal.Decimal):
14 |             if o % 1 > 0:
15 |                 return float(o)
16 |             else:
17 |                 return int(o)
18 |         return super(DecimalEncoder, self).default(o)
19 | 
20 | 
21 | dynamodb = boto3.resource('dynamodb')
22 | 
23 | table = dynamodb.Table('Movies')
24 | 
25 | title = "The Big New Movie"
26 | year = 2015
27 | 
28 | try:
29 |     response = table.get_item(
30 |         Key={
31 |             'year': year,
32 |             'title': title
33 |         }
34 |     )
35 | except ClientError as e:
36 |     print(e.response['Error']['Message'])
37 | else:
38 |     item = response['Item']
39 |     print("GetItem succeeded:")
40 |     print(json.dumps(item, indent=4, cls=DecimalEncoder))
41 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesItemOps03.py:
--------------------------------------------------------------------------------
 1 | import decimal
 2 | import json
 3 | 
 4 | import boto3
 5 | 
 6 | 
 7 | class DecimalEncoder(json.JSONEncoder):
 8 |     '''Helper class to convert a DynamoDB item to JSON'''
 9 | 
10 |     def default(self, o):
11 |         if isinstance(o, decimal.Decimal):
12 |             if o % 1 > 0:
13 |                 return float(o)
14 |             else:
15 |                 return int(o)
16 |         return super(DecimalEncoder, self).default(o)
17 | 
18 | 
19 | dynamodb = boto3.resource('dynamodb')
20 | 
21 | table = dynamodb.Table('Movies')
22 | 
23 | title = "The Big New Movie"
24 | year = 2015
25 | 
26 | response = table.update_item(
27 |     Key={
28 |         'year': year,
29 |         'title': title
30 |     },
31 |     UpdateExpression="set info.rating = :r, info.plot=:p, info.actors=:a",
32 |     ExpressionAttributeValues={
33 |         ':r': decimal.Decimal(5.5),
34 |         ':p': "Everything happens all at once.",
35 |         ':a': ["Larry", "Moe", "Curly"]
36 |     },
37 |     ReturnValues="UPDATED_NEW"
38 | )
39 | 
40 | print("UpdateItem succeeded:")
41 | print(json.dumps(response, indent=4, cls=DecimalEncoder))
42 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesItemOps04.py:
--------------------------------------------------------------------------------
 1 | import decimal
 2 | import json
 3 | 
 4 | import boto3
 5 | 
 6 | 
 7 | class DecimalEncoder(json.JSONEncoder):
 8 |     '''Helper class to convert a DynamoDB item to JSON'''
 9 | 
10 |     def default(self, o):
11 |         if isinstance(o, decimal.Decimal):
12 |             if o % 1 > 0:
13 |                 return float(o)
14 |             else:
15 |                 return int(o)
16 |         return super(DecimalEncoder, self).default(o)
17 | 
18 | 
19 | dynamodb = boto3.resource('dynamodb')
20 | 
21 | table = dynamodb.Table('Movies')
22 | 
23 | title = "The Big New Movie"
24 | year = 2015
25 | 
26 | response = table.update_item(
27 |     Key={
28 |         'year': year,
29 |         'title': title
30 |     },
31 |     UpdateExpression="set info.rating = info.rating + :val",
32 |     ExpressionAttributeValues={
33 |         ':val': decimal.Decimal(1)
34 |     },
35 |     ReturnValues="UPDATED_NEW"
36 | )
37 | 
38 | print("UpdateItem succeeded:")
39 | print(json.dumps(response, indent=4, cls=DecimalEncoder))
40 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesItemOps05.py:
--------------------------------------------------------------------------------
 1 | import decimal
 2 | import json
 3 | 
 4 | import boto3
 5 | from botocore.exceptions import ClientError
 6 | 
 7 | 
 8 | class DecimalEncoder(json.JSONEncoder):
 9 |     '''Helper class to convert a DynamoDB item to JSON'''
10 | 
11 |     def default(self, o):
12 |         if isinstance(o, decimal.Decimal):
13 |             if o % 1 > 0:
14 |                 return float(o)
15 |             else:
16 |                 return int(o)
17 |         return super(DecimalEncoder, self).default(o)
18 | 
19 | 
20 | dynamodb = boto3.resource('dynamodb')
21 | 
22 | table = dynamodb.Table('Movies')
23 | 
24 | title = "The Big New Movie"
25 | year = 2015
26 | 
27 | # Conditional update (will fail)
28 | print("Attempting conditional update...")
29 | 
30 | try:
31 |     response = table.update_item(
32 |         Key={
33 |             'year': year,
34 |             'title': title
35 |         },
36 |         UpdateExpression="remove info.actors[0]",
37 |         ConditionExpression="size(info.actors) >= :num",
38 |         ExpressionAttributeValues={
39 |             ':num': 3
40 |         },
41 |         ReturnValues="UPDATED_NEW"
42 |     )
43 | except ClientError as e:
44 |     if e.response['Error']['Code'] == "ConditionalCheckFailedException":
45 |         print(e.response['Error']['Message'])
46 |     else:
47 |         raise
48 | else:
49 |     print("UpdateItem succeeded:")
50 |     print(json.dumps(response, indent=4, cls=DecimalEncoder))
51 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesItemOps06.py:
--------------------------------------------------------------------------------
 1 | import decimal
 2 | import json
 3 | 
 4 | import boto3
 5 | from botocore.exceptions import ClientError
 6 | 
 7 | 
 8 | class DecimalEncoder(json.JSONEncoder):
 9 |     '''Helper class to convert a DynamoDB item to JSON'''
10 | 
11 |     def default(self, o):
12 |         if isinstance(o, decimal.Decimal):
13 |             if o % 1 > 0:
14 |                 return float(o)
15 |             else:
16 |                 return int(o)
17 |         return super(DecimalEncoder, self).default(o)
18 | 
19 | 
20 | dynamodb = boto3.resource('dynamodb')
21 | 
22 | table = dynamodb.Table('Movies')
23 | 
24 | title = "The Big New Movie"
25 | year = 2015
26 | 
27 | print("Attempting a conditional delete...")
28 | 
29 | try:
30 |     response = table.delete_item(
31 |         Key={
32 |             'year': year,
33 |             'title': title
34 |         }
35 |     )
36 | except ClientError as e:
37 |     if e.response['Error']['Code'] == "ConditionalCheckFailedException":
38 |         print(e.response['Error']['Message'])
39 |     else:
40 |         raise
41 | else:
42 |     print("DeleteItem succeeded:")
43 |     print(json.dumps(response, indent=4, cls=DecimalEncoder))
44 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesLoadData.py:
--------------------------------------------------------------------------------
 1 | import decimal
 2 | import json
 3 | 
 4 | import boto3
 5 | 
 6 | dynamodb = boto3.resource('dynamodb')
 7 | 
 8 | table = dynamodb.Table('Movies')
 9 | 
10 | with open("moviedata.json") as json_file:
11 |     movies = json.load(json_file, parse_float=decimal.Decimal)
12 |     for movie in movies:
13 |         year = int(movie['year'])
14 |         title = movie['title']
15 |         info = movie['info']
16 | 
17 |         print("Adding movie:", year, title)
18 | 
19 |         table.put_item(
20 |             Item={
21 |                 'year': year,
22 |                 'title': title,
23 |                 'info': info,
24 |             }
25 |         )
26 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesQuery01.py:
--------------------------------------------------------------------------------
 1 | import decimal
 2 | import json
 3 | 
 4 | import boto3
 5 | from boto3.dynamodb.conditions import Key
 6 | 
 7 | 
 8 | class DecimalEncoder(json.JSONEncoder):
 9 |     '''Helper class to convert a DynamoDB item to JSON'''
10 | 
11 |     def default(self, o):
12 |         if isinstance(o, decimal.Decimal):
13 |             if o % 1 > 0:
14 |                 return float(o)
15 |             else:
16 |                 return int(o)
17 |         return super(DecimalEncoder, self).default(o)
18 | 
19 | 
20 | dynamodb = boto3.resource('dynamodb')
21 | 
22 | table = dynamodb.Table('Movies')
23 | 
24 | print("Movies from 1985")
25 | 
26 | response = table.query(
27 |     KeyConditionExpression=Key('year').eq(1985)
28 | )
29 | 
30 | for i in response['Items']:
31 |     print(i['year'], ":", i['title'])
32 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesQuery02.py:
--------------------------------------------------------------------------------
 1 | import decimal
 2 | import json
 3 | 
 4 | import boto3
 5 | from boto3.dynamodb.conditions import Key
 6 | 
 7 | 
 8 | class DecimalEncoder(json.JSONEncoder):
 9 |     '''Helper class to convert a DynamoDB item to JSON'''
10 | 
11 |     def default(self, o):
12 |         if isinstance(o, decimal.Decimal):
13 |             return str(o)
14 |         return super(DecimalEncoder, self).default(o)
15 | 
16 | 
17 | dynamodb = boto3.resource('dynamodb')
18 | 
19 | table = dynamodb.Table('Movies')
20 | 
21 | print("Movies from 1992 - titles A-L, with genres and lead actor")
22 | 
23 | response = table.query(
24 |     ProjectionExpression="#yr, title, info.genres, info.actors[0]",
25 |     # Expression Attribute Names for Projection Expression only.
26 |     ExpressionAttributeNames={"#yr": "year"},
27 |     KeyConditionExpression=Key('year').eq(
28 |         1992) & Key('title').between('A', 'L')
29 | )
30 | 
31 | for i in response[u'Items']:
32 |     print(json.dumps(i, cls=DecimalEncoder))
33 | 


--------------------------------------------------------------------------------
/DynamoDB/MoviesScan.py:
--------------------------------------------------------------------------------
 1 | import decimal
 2 | import json
 3 | 
 4 | import boto3
 5 | from boto3.dynamodb.conditions import Key
 6 | 
 7 | 
 8 | class DecimalEncoder(json.JSONEncoder):
 9 |     '''Helper class to convert a DynamoDB item to JSON'''
10 | 
11 |     def default(self, o):
12 |         if isinstance(o, decimal.Decimal):
13 |             if o % 1 > 0:
14 |                 return float(o)
15 |             else:
16 |                 return int(o)
17 |         return super(DecimalEncoder, self).default(o)
18 | 
19 | 
20 | dynamodb = boto3.resource('dynamodb')
21 | 
22 | table = dynamodb.Table('Movies')
23 | 
24 | fe = Key('year').between(1950, 1959)
25 | pe = "#yr, title, info.rating"
26 | # Expression Attribute Names for Projection Expression only.
27 | ean = {"#yr": "year", }
28 | esk = None
29 | 
30 | response = table.scan(
31 |     FilterExpression=fe,
32 |     ProjectionExpression=pe,
33 |     ExpressionAttributeNames=ean
34 | )
35 | 
36 | for i in response['Items']:
37 |     print(json.dumps(i, cls=DecimalEncoder))
38 | 
39 | while 'LastEvaluatedKey' in response:
40 |     response = table.scan(
41 |         ProjectionExpression=pe,
42 |         FilterExpression=fe,
43 |         ExpressionAttributeNames=ean,
44 |         ExclusiveStartKey=response['LastEvaluatedKey']
45 |     )
46 | 
47 |     for i in response['Items']:
48 |         print(json.dumps(i, cls=DecimalEncoder))
49 | 


--------------------------------------------------------------------------------
/DynamoDB/README.md:
--------------------------------------------------------------------------------
 1 | # DynamoDB
 2 | 
 3 | If you are using a fresh [Cloud9 IDE](https://aws.amazon.com/cloud9/) to follow along with this lesson, you'll need to enable Python 3. In the Cloud9 preferences, go to **Python Support > Python Version** and select **Python 3**.
 4 | 
 5 | Install the `boto3` package as follows:
 6 | 
 7 | ```sh
 8 | sudo pip-3.6 install boto3
 9 | ```
10 | 
11 | ## Walkthrough
12 | 
13 | ### Create a Table
14 | 
15 | `python3 MoviesCreateTable.py`
16 | 
17 | ### Load Sample Data
18 | 
19 | `python3 MoviesLoadData.py`
20 | 
21 | ### Create, Read, Update, and Delete an Item
22 | 
23 | 1. Create a New Item
24 | 
25 |     `python3 MoviesItemOps01.py`
26 | 
27 | 2. Read an Item
28 | 
29 |     `python3 MoviesItemOps02.py`
30 | 
31 | 3. Update an Item
32 | 
33 |     `python3 MoviesItemOps03.py`
34 | 
35 | 4. Increment an Atomic Counter
36 | 
37 |     `python3 MoviesItemOps04.py`
38 | 
39 | 5. Update an Item (Conditionally)
40 | 
41 |     `python3 MoviesItemOps05.py`
42 | 
43 | 6. Delete an Item
44 | 
45 |     `python3 MoviesItemOps06.py`
46 | 
47 | ### Query and Scan the Data
48 | 
49 | 1. Query - All Movies Released in a Year
50 | 
51 |     `python3 MoviesQuery01.py`
52 | 
53 | 1. Query - All Movies Released in a Year with Certain Titles
54 | 
55 |     `python3 MoviesQuery02.py`
56 | 
57 | 1. Scan
58 | 
59 |     `python3 MoviesScan.py`
60 | 
61 | ### Delete the Table
62 | 
63 | `python3 MoviesDeleteTable.py`


--------------------------------------------------------------------------------
/EC2/AWS-Instance-Scheduler/README.md:
--------------------------------------------------------------------------------
 1 | # AWS Instance Scheduler
 2 | 
 3 | The AWS Instance Scheduler is a solution that automates the starting and stopping of EC2 and RDS instances.
 4 | 
 5 | The Instance Scheduler leverages resource tags and Lambda to automatically stop and restart instances across multiple AWS Regions and accounts on a customer-defined schedule.
 6 | 
 7 | The solution is easy to deploy and can help reduce operational costs. For example, an organization can use the Instance Scheduler in a non-production environment to automatically stop instances every day, outside of business hours. For customers who leave all of their instances running at full utilization, this solution can result in up to 70% cost savings for those instances that are only necessary during regular business hours (weekly utilization reduced from 168 hours to 50 hours).
 8 | 
 9 | ## Deployment
10 | 
11 | Sign in to the AWS Management Console and click the button below to launch the `aws-instance-scheduler.json` AWS CloudFormation template.
12 | 
13 | [![Stack](https://s3.amazonaws.com/cloudformation-examples/cloudformation-launch-stack.png)](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?templateURL=https:%2F%2Fs3.amazonaws.com%2Fsolutions-reference%2Faws-instance-scheduler%2Flatest%2Finstance-scheduler.template)
14 | 
15 | You can also [download the template](https://raw.githubusercontent.com/linuxacademy/content-lambda-boto3/master/EC2/AWS-Instance-Scheduler/aws-instance-scheduler.json) as a starting point for your own implementation.
16 | 


--------------------------------------------------------------------------------
/EC2/Backing-Up-EC2-Instances/Create-Backups/iam.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "ec2:CreateSnapshot",
16 |         "ec2:CreateTags",
17 |         "ec2:DeleteSnapshot",
18 |         "ec2:Describe*",
19 |         "ec2:ModifySnapshotAttribute",
20 |         "ec2:ResetSnapshotAttribute"
21 |       ],
22 |       "Resource": "*"
23 |     }
24 |   ]
25 | }


--------------------------------------------------------------------------------
/EC2/Backing-Up-EC2-Instances/Create-Backups/lambda_handler.py:
--------------------------------------------------------------------------------
 1 | from datetime import datetime
 2 | 
 3 | import boto3
 4 | 
 5 | 
 6 | def lambda_handler(event, context):
 7 | 
 8 |     ec2_client = boto3.client('ec2')
 9 |     regions = [region['RegionName']
10 |                for region in ec2_client.describe_regions()['Regions']]
11 | 
12 |     for region in regions:
13 | 
14 |         print('Instances in EC2 Region {0}:'.format(region))
15 |         ec2 = boto3.resource('ec2', region_name=region)
16 | 
17 |         instances = ec2.instances.filter(
18 |             Filters=[
19 |                 {'Name': 'tag:backup', 'Values': ['true']}
20 |             ]
21 |         )
22 | 
23 |         # ISO 8601 timestamp, i.e. 2019-01-31T14:01:58
24 |         timestamp = datetime.utcnow().replace(microsecond=0).isoformat()
25 | 
26 |         for i in instances.all():
27 |             for v in i.volumes.all():
28 | 
29 |                 desc = 'Backup of {0}, volume {1}, created {2}'.format(
30 |                     i.id, v.id, timestamp)
31 |                 print(desc)
32 | 
33 |                 snapshot = v.create_snapshot(Description=desc)
34 | 
35 |                 print("Created snapshot:", snapshot.id)
36 | 


--------------------------------------------------------------------------------
/EC2/Backing-Up-EC2-Instances/Prune-Backups/iam.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "ec2:CreateSnapshot",
16 |         "ec2:CreateTags",
17 |         "ec2:DeleteSnapshot",
18 |         "ec2:Describe*",
19 |         "ec2:ModifySnapshotAttribute",
20 |         "ec2:ResetSnapshotAttribute"
21 |       ],
22 |       "Resource": "*"
23 |     }
24 |   ]
25 | }


--------------------------------------------------------------------------------
/EC2/Backing-Up-EC2-Instances/Prune-Backups/lambda_handler.py:
--------------------------------------------------------------------------------
 1 | import boto3
 2 | 
 3 | 
 4 | def lambda_handler(event, context):
 5 | 
 6 |     account_id = boto3.client('sts').get_caller_identity().get('Account')
 7 |     ec2 = boto3.client('ec2')
 8 |     regions = [region['RegionName']
 9 |                for region in ec2.describe_regions()['Regions']]
10 | 
11 |     for region in regions:
12 |         print("Region:", region)
13 |         ec2 = boto3.client('ec2', region_name=region)
14 |         response = ec2.describe_snapshots(OwnerIds=[account_id])
15 |         snapshots = response["Snapshots"]
16 | 
17 |         # Sort snapshots by date ascending
18 |         snapshots.sort(key=lambda x: x["StartTime"])
19 | 
20 |         # Remove snapshots we want to keep (i.e. 3 most recent)
21 |         snapshots = snapshots[:-3]
22 | 
23 |         for snapshot in snapshots:
24 |             id = snapshot['SnapshotId']
25 |             try:
26 |                 print("Deleting snapshot:", id)
27 |                 ec2.delete_snapshot(SnapshotId=id)
28 |             except Exception as e:
29 |                 print("Snapshot {} in use, skipping.".format(id))
30 |                 continue
31 | 


--------------------------------------------------------------------------------
/EC2/Deregistering-Old-AMIs/iam.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "ec2:DescribeImages",
16 |         "ec2:DescribeRegions",
17 |         "ec2:DeregisterImage"
18 |       ],
19 |       "Resource": "*"
20 |     }
21 |   ]
22 | }
23 | 


--------------------------------------------------------------------------------
/EC2/Deregistering-Old-AMIs/lambda_handler.py:
--------------------------------------------------------------------------------
 1 | import datetime
 2 | from dateutil.parser import parse
 3 | 
 4 | import boto3
 5 | 
 6 | 
 7 | def days_old(date):
 8 |     parsed = parse(date).replace(tzinfo=None)
 9 |     diff = datetime.datetime.now() - parsed
10 |     return diff.days
11 | 
12 | 
13 | def lambda_handler(event, context):
14 | 
15 |     # Get list of regions
16 |     ec2_client = boto3.client('ec2')
17 |     regions = [region['RegionName']
18 |                for region in ec2_client.describe_regions()['Regions']]
19 | 
20 |     for region in regions:
21 |         ec2 = boto3.client('ec2', region_name=region)
22 |         print("Region:", region)
23 | 
24 |         amis = ec2.describe_images(Owners=['self'])['Images']
25 | 
26 |         for ami in amis:
27 |             creation_date = ami['CreationDate']
28 |             age_days = days_old(creation_date)
29 |             image_id = ami['ImageId']
30 |             print('ImageId: {}, CreationDate: {} ({} days old)'.format(
31 |                 image_id, creation_date, age_days))
32 | 
33 |             if age_days >= 2:
34 |                 print('Deleting ImageId:', image_id)
35 | 
36 |                 # Deregister the AMI
37 |                 ec2.deregister_image(ImageId=image_id)
38 | 


--------------------------------------------------------------------------------
/EC2/Removing-Unattached-EBS-Volumes/README.md:
--------------------------------------------------------------------------------
 1 | # Removing Unattached EBS Volumes
 2 | 
 3 | When an instance is terminated, EC2 uses the value of the `DeleteOnTermination` attribute for each attached EBS volume to determine whether to preserve or delete the volume when the instance is terminated.
 4 | 
 5 | By default, the `DeleteOnTermination` attribute for the root volume of an instance is set to `true`, but it is set to `false` for all other volume types.
 6 | 
 7 | To preserve the root volume when an instance is terminated, change the `DeleteOnTermination` attribute for the root volume to `false`.
 8 | 
 9 | ## Changing the root volume of a running instance to persist
10 | 
11 | 1. Edit `mapping.json`, setting the value for `DeviceName` to your block device name.
12 | 
13 | 2. Using the AWS CLI, modify the `DeleteOnTermination` attribute:
14 | 
15 |     ```sh
16 |     aws ec2 modify-instance-attribute --instance-id i-1234567890abcdef0 --block-device-mappings file://mapping.json
17 |     ```
18 | 
19 | More info: [Preserving Amazon EBS Volumes on Instance Termination](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/terminating-instances.html#preserving-volumes-on-termination)


--------------------------------------------------------------------------------
/EC2/Removing-Unattached-EBS-Volumes/iam.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "ec2:DeleteVolume",
16 |         "ec2:DescribeRegions",
17 |         "ec2:DescribeVolumes"
18 |       ],
19 |       "Resource": "*"
20 |     }
21 |   ]
22 | }
23 | 


--------------------------------------------------------------------------------
/EC2/Removing-Unattached-EBS-Volumes/lambda_handler.py:
--------------------------------------------------------------------------------
 1 | import boto3
 2 | 
 3 | 
 4 | def lambda_handler(object, context):
 5 | 
 6 |     # Get list of regions
 7 |     ec2_client = boto3.client('ec2')
 8 |     regions = [region['RegionName']
 9 |                for region in ec2_client.describe_regions()['Regions']]
10 | 
11 |     for region in regions:
12 |         ec2 = boto3.resource('ec2', region_name=region)
13 |         print("Region:", region)
14 | 
15 |         # List only unattached volumes ('available' vs. 'in-use')
16 |         volumes = ec2.volumes.filter(
17 |             Filters=[{'Name': 'status', 'Values': ['available']}])
18 | 
19 |         for volume in volumes:
20 |             v = ec2.Volume(volume.id)
21 |             print("Deleting EBS volume: {}, Size: {} GiB".format(v.id, v.size))
22 |             v.delete()
23 | 


--------------------------------------------------------------------------------
/EC2/Removing-Unattached-EBS-Volumes/mapping.json:
--------------------------------------------------------------------------------
1 | [{
2 |   "DeviceName": "/dev/xvda",
3 |   "Ebs": {
4 |     "DeleteOnTermination": false
5 |   }
6 | }]
7 | 


--------------------------------------------------------------------------------
/EC2/Stopping-EC2-Instances-Nightly/README.md:
--------------------------------------------------------------------------------
 1 | # Stopping EC2 Instances Nightly
 2 | 
 3 | ## Notes
 4 | 
 5 | ### Lambda Function
 6 | 
 7 | Be sure to set the Lambda function timeout high enough (i.e. 1 minute) so that it can iterate through every instance in every region.
 8 | 
 9 | ### CloudWatch Event Rule
10 | 
11 | Cron expression: `0 23 ? * MON-FRI *`
12 | 
13 | 6:00pm EST (UTC-5) == 11:00pm (23:00) UTC


--------------------------------------------------------------------------------
/EC2/Stopping-EC2-Instances-Nightly/iam.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [
 4 |     {
 5 |       "Effect": "Allow",
 6 |       "Action": [
 7 |         "logs:CreateLogGroup",
 8 |         "logs:CreateLogStream",
 9 |         "logs:PutLogEvents"
10 |       ],
11 |       "Resource": "arn:aws:logs:*:*:*"
12 |     },
13 |     {
14 |       "Effect": "Allow",
15 |       "Action": [
16 |         "ec2:DescribeInstances",
17 |         "ec2:DescribeRegions",
18 |         "ec2:StartInstances",
19 |         "ec2:StopInstances"
20 |       ],
21 |       "Resource": "*"
22 |     }
23 |   ]
24 | }


--------------------------------------------------------------------------------
/EC2/Stopping-EC2-Instances-Nightly/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import boto3
 2 | 
 3 | 
 4 | def lambda_handler(event, context):
 5 | 
 6 |     # Get list of regions
 7 |     ec2_client = boto3.client('ec2')
 8 |     regions = [region['RegionName']
 9 |                for region in ec2_client.describe_regions()['Regions']]
10 | 
11 |     # Iterate over each region
12 |     for region in regions:
13 |         ec2 = boto3.resource('ec2', region_name=region)
14 | 
15 |         print("Region:", region)
16 | 
17 |         # Get only running instances
18 |         instances = ec2.instances.filter(
19 |             Filters=[{'Name': 'instance-state-name',
20 |                       'Values': ['running']}])
21 | 
22 |         # Stop the instances
23 |         for instance in instances:
24 |             instance.stop()
25 |             print('Stopped instance: ', instance.id)
26 | 


--------------------------------------------------------------------------------
/Lab-Create-an-EC2-Instance-Using-Lambda/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Action": [
14 |         "ec2:RunInstances"
15 |       ],
16 |       "Effect": "Allow",
17 |       "Resource": "*"
18 |     }
19 |   ]
20 | }


--------------------------------------------------------------------------------
/Lab-Create-an-EC2-Instance-Using-Lambda/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import os
 2 | import boto3
 3 | 
 4 | AMI = os.environ['AMI']
 5 | INSTANCE_TYPE = os.environ['INSTANCE_TYPE']
 6 | KEY_NAME = os.environ['KEY_NAME']
 7 | SUBNET_ID = os.environ['SUBNET_ID']
 8 | 
 9 | ec2 = boto3.resource('ec2')
10 | 
11 | 
12 | def lambda_handler(event, context):
13 | 
14 |     instance = ec2.create_instances(
15 |         ImageId=AMI,
16 |         InstanceType=INSTANCE_TYPE,
17 |         KeyName=KEY_NAME,
18 |         SubnetId=SUBNET_ID,
19 |         MaxCount=1,
20 |         MinCount=1
21 |     )
22 | 
23 |     print("New instance created:", instance[0].id)
24 | 


--------------------------------------------------------------------------------
/Lambda/CodeCommit-Change-Notification/README.md:
--------------------------------------------------------------------------------
 1 | # Automating CodeCommit Change Notifications
 2 | 
 3 | In this lesson, we'll demonstrate how to receive detailed email notifications
 4 | about file changes and commit messages when a code update is pushed to
 5 | CodeCommit. A code reviewer may subscribe to the SNS topic and recieve updates
 6 | for any changes.
 7 | 
 8 | ## Create the CodeCommit Repository
 9 | 
10 | ```sh
11 | aws codecommit create-repository --repository-name ChangeNotification
12 | ```
13 | 
14 | Note the `cloneUrlHttp` and `Arn` values in the response.
15 | 
16 | ## Create and Subscribe to the SNS Topic
17 | 
18 | ```sh
19 | aws sns create-topic --name CodeCommitChangeNotification
20 | 
21 | aws sns subscribe \
22 | --topic-arn arn:aws:sns:us-east-1:123456789012:CodeCommitChangeNotification \
23 | --protocol email \
24 | --notification-endpoint my-email@example.com
25 | ```
26 | 
27 | ## Create IAM Lambda Execution Role
28 | 
29 | 1. Add `AWSLambdaBasicExecutionRole`
30 | 2. Add the following policy `LambdaCodeCommitSnsPolicy`:
31 | 
32 |     ```json
33 |     {
34 |         "Version": "2012-10-17",
35 |         "Statement": [{
36 |             "Effect": "Allow",
37 |             "Action": [
38 |             "codecommit:*",
39 |             "sns:*"
40 |             ],
41 |             "Resource": "*"
42 |         }]
43 |     }
44 |     ```
45 | 
46 | ## Create the Lambda Function
47 | 
48 | Name: **CodeCommitChangeNotification**
49 | 
50 | Set the following enviornment variables:
51 | 
52 | `REPOSITORY_NAME` = `ChangeNotification`
53 | 
54 | `SNS_TOPIC_ARN` = `arn:aws:sns:us-east-1:123456789012:CodeCommitChangeNotification`
55 | 
56 | ## Create the CloudWatch Event Rule
57 | 
58 | This rule will detect branch or repository changes:
59 | 
60 | 1. Choose **Event Pattern**.
61 | 2. Service Name: **CodeCommit**
62 | 3. Event Type: **CodeCommit Repository State Change**
63 | 4. Specific resource(s) by ARN: **CodeCommit Repository ARN**
64 | 
65 |     Select the **referenceCreated** and **referenceUpdated** events.
66 | 
67 |     Event Pattern:
68 | 
69 |     ```json
70 |     {
71 |     "source": [
72 |         "aws.codecommit"
73 |     ],
74 |     "detail-type": [
75 |         "CodeCommit Repository State Change"
76 |     ],
77 |     "resources": [
78 |         "arn:aws:codecommit:us-east-1:123456789012:ChangeNotification"
79 |     ]
80 |     }
81 |     ```
82 | 
83 | 5. Target: **CodeCommitChangeNotification**
84 | 
85 | ## Commit a Change
86 | 
87 | 1. Create and commit a file.
88 | 2. Edit the file and commit it.


--------------------------------------------------------------------------------
/Lambda/CodeCommit-Change-Notification/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |     "Effect": "Allow",
 5 |     "Action": [
 6 |       "codecommit:*",
 7 |       "sns:*"
 8 |     ],
 9 |     "Resource": "*"
10 |   }]
11 | }
12 | 


--------------------------------------------------------------------------------
/Lambda/CodeCommit-Change-Notification/lambda_function.py:
--------------------------------------------------------------------------------
  1 | import datetime
  2 | import os
  3 | 
  4 | import boto3
  5 | 
  6 | AWS_DEFAULT_REGION = os.environ["AWS_DEFAULT_REGION"]
  7 | MAIN_BRANCH_NAME = os.getenv('MAIN_BRANCH_NAME', 'master')
  8 | REPOSITORY_NAME = os.environ['REPOSITORY_NAME']
  9 | SNS_TOPIC_ARN = os.environ['SNS_TOPIC_ARN']
 10 | 
 11 | codecommit = boto3.client('codecommit')
 12 | sns = boto3.client('sns')
 13 | 
 14 | 
 15 | def get_diff(repository_name, last_commit_id, previous_commit_id):
 16 |     differences = []
 17 |     response_iterator = None
 18 | 
 19 |     paginator = codecommit.get_paginator('get_differences')
 20 | 
 21 |     if previous_commit_id is None:
 22 |         # This was the first commit (no previous, omit beforeCommitSpecifier)
 23 |         response_iterator = paginator.paginate(
 24 |             repositoryName=repository_name,
 25 |             afterCommitSpecifier=last_commit_id,
 26 |         )
 27 |     else:
 28 |         response_iterator = paginator.paginate(
 29 |             repositoryName=repository_name,
 30 |             beforeCommitSpecifier=previous_commit_id,
 31 |             afterCommitSpecifier=last_commit_id,
 32 |         )
 33 | 
 34 |     for response in response_iterator:
 35 |         differences += response["differences"]
 36 | 
 37 |     return differences
 38 | 
 39 | 
 40 | def get_diff_change_message_type(change_type):
 41 |     type = {
 42 |         'M': 'Modification',
 43 |         'D': 'Deletion',
 44 |         'A': 'Addition'
 45 |     }
 46 |     return type[change_type]
 47 | 
 48 | 
 49 | def get_last_commit_id(repository, branch):
 50 |     response = codecommit.get_branch(
 51 |         repositoryName=repository,
 52 |         branchName=branch
 53 |     )
 54 |     commit_id = response['branch']['commitId']
 55 |     return commit_id
 56 | 
 57 | 
 58 | def get_last_commit_log(repository, commit_id):
 59 |     response = codecommit.get_commit(
 60 |         repositoryName=repository, commitId=commit_id)
 61 | 
 62 |     return response['commit']
 63 | 
 64 | 
 65 | def get_message_text(differences, last_commit):
 66 |     text = ''
 67 |     commit_id = last_commit['commitId']
 68 |     text += f'commit ID: {commit_id}\n'
 69 |     text += 'author: {0} ({1})\n'.format(
 70 |         last_commit['author']['name'],
 71 |         last_commit['author']['email'])
 72 |     date = last_commit['author']['date'].split()[0]
 73 |     t_utc = datetime.datetime.utcfromtimestamp(int(date))
 74 |     timestamp = t_utc.strftime('%Y-%m-%d %H:%M:%S UTC')
 75 |     text += f'date: {timestamp}\n'
 76 |     text += f"message: {last_commit['message']}\n"
 77 |     for diff in differences:
 78 |         if 'afterBlob' in diff:
 79 |             text += 'After - File: {0} {1} - Blob ID: {2}\n'.format(
 80 |                 diff['afterBlob']['path'],
 81 |                 get_diff_change_message_type(diff['changeType']),
 82 |                 diff['afterBlob']['blobId'])
 83 |         if 'beforeBlob' in diff:
 84 |             text += 'Before - File: {0} {1} - Blob ID: {2}\n'.format(
 85 |                 diff['beforeBlob']['path'],
 86 |                 get_diff_change_message_type(diff['changeType']),
 87 |                 diff['beforeBlob']['blobId'])
 88 | 
 89 |     text += (f'Commit: '
 90 |              f'https://{AWS_DEFAULT_REGION}.console.aws.amazon.com/codesuite/'
 91 |              f'codecommit/repositories/{REPOSITORY_NAME}/commit/{commit_id}?'
 92 |              f'region={AWS_DEFAULT_REGION}')
 93 | 
 94 |     return text
 95 | 
 96 | 
 97 | def publish(repository, message):
 98 |     sns.publish(
 99 |         TopicArn=SNS_TOPIC_ARN,
100 |         Subject=f'CodeCommit Update - Repository: {repository}',
101 |         Message=message
102 |     )
103 | 
104 | 
105 | def lambda_handler(event, context):
106 | 
107 |     try:
108 |         last_commit_id = get_last_commit_id(REPOSITORY_NAME, MAIN_BRANCH_NAME)
109 |         last_commit = get_last_commit_log(REPOSITORY_NAME, last_commit_id)
110 | 
111 |         previous_commit_id = None
112 |         if len(last_commit['parents']) > 0:
113 |             previous_commit_id = last_commit['parents'][0]
114 | 
115 |         print(f'Last commit ID: {last_commit_id}')
116 |         print(f'Previous commit ID: {previous_commit_id}')
117 | 
118 |         differences = get_diff(
119 |             REPOSITORY_NAME, last_commit_id, previous_commit_id)
120 |         message_text = get_message_text(differences, last_commit)
121 | 
122 |         print(message_text)
123 | 
124 |         return publish(REPOSITORY_NAME, message_text)
125 | 
126 |     except Exception as e:
127 |         import traceback
128 |         print(e)
129 |         traceback.print_exc()
130 |         print(f'Error getting repository {REPOSITORY_NAME}. Ensure it exists '
131 |               'in the same region as this function.')
132 |         raise e
133 | 


--------------------------------------------------------------------------------
/Lambda/CodeCommit-Change-Notification/state_change.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "version": "0",
 3 |   "id": "c795db7d-0239-f083-da1e-6d3ba7ab8c9e",
 4 |   "detail-type": "CodeCommit Repository State Change",
 5 |   "source": "aws.codecommit",
 6 |   "account": "123456789012",
 7 |   "time": "2019-03-15T14:40:40Z",
 8 |   "region": "us-east-1",
 9 |   "resources": ["arn:aws:codecommit:us-east-2:123456789012:ChangeNotification"],
10 |   "detail": {
11 |     "referenceFullName": "refs/heads/master",
12 |     "repositoryId": "a2d1f4ae-02d0-4c1c-8bd3-cba39b73ed90",
13 |     "referenceType": "branch",
14 |     "commitId": "91bf2aa7c2d04523df8b7cfbfee20c53d7be77e4",
15 |     "event": "referenceUpdated",
16 |     "repositoryName": "ChangeNotification",
17 |     "callerUserArn": "arn:aws:iam::123456789012:user/mrichman",
18 |     "oldCommitId": "b4940d6b9ac85469a351b4da1769e4301c9c3fc",
19 |     "referenceName": "master"
20 |   }
21 | }
22 | 


--------------------------------------------------------------------------------
/Lambda/Working-with-Lambda-Layers/.gitignore:
--------------------------------------------------------------------------------
1 | Pipfile
2 | Pipfile.lock
3 | requirements.txt
4 | *.zip


--------------------------------------------------------------------------------
/Lambda/Working-with-Lambda-Layers/README.md:
--------------------------------------------------------------------------------
 1 | # Working with Lambda Layers
 2 | 
 3 | Create a new virtual environment using `pipenv` and install the required libraries:
 4 | 
 5 | ```sh
 6 | pipenv --python 3.7
 7 | pipenv shell
 8 | pipenv install requests
 9 | ```
10 | 
11 | Note: If you are on macOS, you can install `pipenv` using Homebrew:
12 | 
13 | ```sh
14 | brew install pipenv
15 | ```
16 | 
17 | on Amazon Linux, or another environment, you can install using `pip`:
18 | 
19 | ```sh
20 | pip3 install pipenv --user
21 | ```
22 | 
23 | Create the ZIP deployment package:
24 | 
25 | ```sh
26 | PY_DIR='build/python/lib/python3.7/site-packages'
27 | # Create temporary build directory
28 | mkdir -p $PY_DIR
29 | # Generate requirements file
30 | pipenv lock -r > requirements.txt
31 | # Install packages into the target directory
32 | pip install -r requirements.txt --no-deps -t $PY_DIR
33 | cd build
34 | # Zip files
35 | zip -r ../requests_layer.zip .
36 | cd ..
37 | # Remove temporary directory
38 | rm -r build
39 | ```
40 | 
41 | Create the Lambda Layer
42 | 
43 | ```sh
44 | aws lambda publish-layer-version \
45 | --layer-name requests \
46 | --compatible-runtimes python3.7 \
47 | --zip-file fileb://requests_layer.zip
48 | ```
49 | 
50 | Note the `LayerArn` in the output.
51 | 


--------------------------------------------------------------------------------
/Lambda/Working-with-Lambda-Layers/list_packages.py:
--------------------------------------------------------------------------------
 1 | import pkg_resources
 2 | 
 3 | 
 4 | def lambda_handler(event, context):
 5 |     pkgs = pkg_resources.working_set
 6 |     pkgs_list = sorted([f'{i.key}=={i.version}' for i in pkgs])
 7 |     print("\n".join(pkgs_list))
 8 | 
 9 | # Log output will resemble:
10 | 
11 | # START RequestId: 430a0232-8c13-4788-90e0-c24e7ac3d7c4 Version: $LATEST
12 | # boto3==1.9.42
13 | # botocore==1.12.42
14 | # docutils==0.14
15 | # jmespath==0.9.3
16 | # pip==18.1
17 | # python-dateutil==2.7.5
18 | # s3transfer==0.1.13
19 | # setuptools==40.6.2
20 | # six==1.11.0
21 | # urllib3==1.24.1
22 | # END RequestId: 430a0232-8c13-4788-90e0-c24e7ac3d7c4
23 | # REPORT RequestId: 430a0232-8c13-4788-90e0-c24e7ac3d7c4	Duration: 39.76 ms	Billed Duration: 100 ms 	Memory Size: 128 MB	Max Memory Used: 70 MB
24 | 


--------------------------------------------------------------------------------
/Lambda/Working-with-Lambda-Layers/test_requests.py:
--------------------------------------------------------------------------------
 1 | import requests
 2 | 
 3 | 
 4 | def lambda_handler(event, context):
 5 | 
 6 |     response = requests.get('https://linuxacademy.com')
 7 |     if response:
 8 |         print('Success!')
 9 |     else:
10 |         print('An error has occurred.')
11 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/CloudWatch-Custom-Metrics/.gitignore:
--------------------------------------------------------------------------------
  1 | shopping-cart-app/.aws-sam
  2 | shopping-cart-app/packaged.yaml
  3 | results.bin
  4 | 
  5 | # Created by https://www.gitignore.io/api/osx,linux,python,windows,pycharm,visualstudiocode
  6 | 
  7 | ### Linux ###
  8 | *~
  9 | 
 10 | # temporary files which can be created if a process still has a handle open of a deleted file
 11 | .fuse_hidden*
 12 | 
 13 | # KDE directory preferences
 14 | .directory
 15 | 
 16 | # Linux trash folder which might appear on any partition or disk
 17 | .Trash-*
 18 | 
 19 | # .nfs files are created when an open file is removed but is still being accessed
 20 | .nfs*
 21 | 
 22 | ### OSX ###
 23 | *.DS_Store
 24 | .AppleDouble
 25 | .LSOverride
 26 | 
 27 | # Icon must end with two \r
 28 | Icon
 29 | 
 30 | # Thumbnails
 31 | ._*
 32 | 
 33 | # Files that might appear in the root of a volume
 34 | .DocumentRevisions-V100
 35 | .fseventsd
 36 | .Spotlight-V100
 37 | .TemporaryItems
 38 | .Trashes
 39 | .VolumeIcon.icns
 40 | .com.apple.timemachine.donotpresent
 41 | 
 42 | # Directories potentially created on remote AFP share
 43 | .AppleDB
 44 | .AppleDesktop
 45 | Network Trash Folder
 46 | Temporary Items
 47 | .apdisk
 48 | 
 49 | ### PyCharm ###
 50 | # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm
 51 | # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
 52 | 
 53 | # User-specific stuff:
 54 | .idea/**/workspace.xml
 55 | .idea/**/tasks.xml
 56 | .idea/dictionaries
 57 | 
 58 | # Sensitive or high-churn files:
 59 | .idea/**/dataSources/
 60 | .idea/**/dataSources.ids
 61 | .idea/**/dataSources.xml
 62 | .idea/**/dataSources.local.xml
 63 | .idea/**/sqlDataSources.xml
 64 | .idea/**/dynamic.xml
 65 | .idea/**/uiDesigner.xml
 66 | 
 67 | # Gradle:
 68 | .idea/**/gradle.xml
 69 | .idea/**/libraries
 70 | 
 71 | # CMake
 72 | cmake-build-debug/
 73 | 
 74 | # Mongo Explorer plugin:
 75 | .idea/**/mongoSettings.xml
 76 | 
 77 | ## File-based project format:
 78 | *.iws
 79 | 
 80 | ## Plugin-specific files:
 81 | 
 82 | # IntelliJ
 83 | /out/
 84 | 
 85 | # mpeltonen/sbt-idea plugin
 86 | .idea_modules/
 87 | 
 88 | # JIRA plugin
 89 | atlassian-ide-plugin.xml
 90 | 
 91 | # Cursive Clojure plugin
 92 | .idea/replstate.xml
 93 | 
 94 | # Ruby plugin and RubyMine
 95 | /.rakeTasks
 96 | 
 97 | # Crashlytics plugin (for Android Studio and IntelliJ)
 98 | com_crashlytics_export_strings.xml
 99 | crashlytics.properties
100 | crashlytics-build.properties
101 | fabric.properties
102 | 
103 | ### PyCharm Patch ###
104 | # Comment Reason: https://github.com/joeblau/gitignore.io/issues/186#issuecomment-215987721
105 | 
106 | # *.iml
107 | # modules.xml
108 | # .idea/misc.xml
109 | # *.ipr
110 | 
111 | # Sonarlint plugin
112 | .idea/sonarlint
113 | 
114 | ### Python ###
115 | # Byte-compiled / optimized / DLL files
116 | __pycache__/
117 | *.py[cod]
118 | *$py.class
119 | 
120 | # C extensions
121 | *.so
122 | 
123 | # Distribution / packaging
124 | .Python
125 | build/
126 | develop-eggs/
127 | dist/
128 | downloads/
129 | eggs/
130 | .eggs/
131 | lib/
132 | lib64/
133 | parts/
134 | sdist/
135 | var/
136 | wheels/
137 | *.egg-info/
138 | .installed.cfg
139 | *.egg
140 | 
141 | # PyInstaller
142 | #  Usually these files are written by a python script from a template
143 | #  before PyInstaller builds the exe, so as to inject date/other infos into it.
144 | *.manifest
145 | *.spec
146 | 
147 | # Installer logs
148 | pip-log.txt
149 | pip-delete-this-directory.txt
150 | 
151 | # Unit test / coverage reports
152 | htmlcov/
153 | .tox/
154 | .coverage
155 | .coverage.*
156 | .cache
157 | .pytest_cache/
158 | nosetests.xml
159 | coverage.xml
160 | *.cover
161 | .hypothesis/
162 | 
163 | # Translations
164 | *.mo
165 | *.pot
166 | 
167 | # Flask stuff:
168 | instance/
169 | .webassets-cache
170 | 
171 | # Scrapy stuff:
172 | .scrapy
173 | 
174 | # Sphinx documentation
175 | docs/_build/
176 | 
177 | # PyBuilder
178 | target/
179 | 
180 | # Jupyter Notebook
181 | .ipynb_checkpoints
182 | 
183 | # pyenv
184 | .python-version
185 | 
186 | # celery beat schedule file
187 | celerybeat-schedule.*
188 | 
189 | # SageMath parsed files
190 | *.sage.py
191 | 
192 | # Environments
193 | .env
194 | .venv
195 | env/
196 | venv/
197 | ENV/
198 | env.bak/
199 | venv.bak/
200 | 
201 | # Spyder project settings
202 | .spyderproject
203 | .spyproject
204 | 
205 | # Rope project settings
206 | .ropeproject
207 | 
208 | # mkdocs documentation
209 | /site
210 | 
211 | # mypy
212 | .mypy_cache/
213 | 
214 | ### VisualStudioCode ###
215 | .vscode/*
216 | !.vscode/settings.json
217 | !.vscode/tasks.json
218 | !.vscode/launch.json
219 | !.vscode/extensions.json
220 | .history
221 | 
222 | ### Windows ###
223 | # Windows thumbnail cache files
224 | Thumbs.db
225 | ehthumbs.db
226 | ehthumbs_vista.db
227 | 
228 | # Folder config file
229 | Desktop.ini
230 | 
231 | # Recycle Bin used on file shares
232 | $RECYCLE.BIN/
233 | 
234 | # Windows Installer files
235 | *.cab
236 | *.msi
237 | *.msm
238 | *.msp
239 | 
240 | # Windows shortcuts
241 | *.lnk
242 | 
243 | # Build folder
244 | 
245 | */build/*
246 | 
247 | # End of https://www.gitignore.io/api/osx,linux,python,windows,pycharm,visualstudiocode
248 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/CloudWatch-Custom-Metrics/README.md:
--------------------------------------------------------------------------------
 1 | # Publishing Custom Metrics from Lambda
 2 | 
 3 | Install the demo app using the [AWS Serverless Application Model](https://aws.amazon.com/serverless/sam/). You can find instructions to install the AWS SAM CLI [here](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-cli-install.html).
 4 | 
 5 | ## Create the Lambda deployment package
 6 | 
 7 | `cd shopping-cart-app`
 8 | 
 9 | Create an S3 bucket in the location where you want to save the packaged code. If you want to use an existing S3 bucket, skip this step.
10 | 
11 | ```sh
12 | aws s3 mb s3://123456789012-shopping-cart-app
13 | ```
14 | 
15 | Create the deployment artifacts with dependencies
16 | 
17 | ```sh
18 | sam build
19 | ```
20 | 
21 | Create the Lambda function deployment package by running the following `package` AWS SAM CLI command at the command prompt.
22 | 
23 | ```sh
24 | sam package \
25 |     --output-template-file packaged.yaml \
26 |     --s3-bucket 123456789012-shopping-cart-app
27 | ```
28 | 
29 | In the AWS SAM CLI, use the `deploy` command to deploy all of the resources that you defined in the template.
30 | 
31 | ```sh
32 | sam deploy \
33 |     --template-file packaged.yaml \
34 |     --stack-name shopping-cart-app \
35 |     --capabilities CAPABILITY_IAM
36 | ```
37 | 
38 | ## Locate API Gateway Endpoint URLs
39 | 
40 | 1. Open the AWS CloudFormation console at <https://console.aws.amazon.com/cloudformation>.
41 | 1. Choose the AWS CloudFormation stack that you created in the preceding step from the list shown\.
42 | 1. Under **Outputs**, note the API Gateway endpoint URLs.
43 | 1. Browse each and observe the JSON responses.
44 | 
45 | ## Generate Traffic
46 | 
47 | Using the API Gateway endpoint URLs in the previous step, generate traffic against each of these endpoints.
48 | 
49 | Run an HTTP testing tool like [vegeta](https://github.com/tsenart/vegeta) to generate traffic to your API gateway endpoints:
50 | 
51 | Modify `URLs.txt` to use the endpoint URLs in your account.
52 | 
53 | Run a test for 60 minutes:
54 | 
55 | ```sh
56 | cat URLS.txt | vegeta attack -duration=60m | tee results.bin | vegeta report
57 | ```
58 | 
59 | ## View Custom Metrics
60 | 
61 | You may view custom metric data while a load test is in progress.
62 | 
63 | 1. Open the CloudWatch console at <https://console.aws.amazon.com/cloudwatch>.
64 | 1. Navigate to **Metrics**.
65 | 1. Under **All metrics**, select **ShoppingCartApp**.
66 | 1. Select **Metrics with no dimensions**.
67 | 1. Select **ItemsAddedToCart**, **OrderTotal**, and **ViewProduct**.
68 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/CloudWatch-Custom-Metrics/URLs.txt:
--------------------------------------------------------------------------------
1 | GET https://q4mss37szc.execute-api.us-east-2.amazonaws.com/Prod/cart/add
2 | GET https://q4mss37szc.execute-api.us-east-2.amazonaws.com/Prod/cart/purchase
3 | GET https://q4mss37szc.execute-api.us-east-2.amazonaws.com/Prod/products/123456
4 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/CloudWatch-Custom-Metrics/shopping-cart-app/add_to_cart/app.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | import random
 3 | 
 4 | import boto3
 5 | 
 6 | cloudwatch = boto3.client('cloudwatch')
 7 | 
 8 | 
 9 | def lambda_handler(event, context):
10 | 
11 |     cloudwatch.put_metric_data(
12 |         MetricData=[
13 |             {
14 |                 'MetricName': 'ItemsAddedToCart',
15 |                 'Value': random.randint(1, 20)
16 |             },
17 |         ],
18 |         Namespace='ShoppingCartApp'
19 |     )
20 | 
21 |     return {
22 |         "statusCode": 200,
23 |         "body": json.dumps(
24 |             [
25 |                 {"itemID": "123456"},
26 |                 {"itemID": "234567"},
27 |                 {"itemID": "345678"}
28 |             ]
29 |         ),
30 |     }
31 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/CloudWatch-Custom-Metrics/shopping-cart-app/add_to_cart/requirements.txt:
--------------------------------------------------------------------------------
1 | boto3


--------------------------------------------------------------------------------
/Monitoring-Debugging/CloudWatch-Custom-Metrics/shopping-cart-app/purchase/app.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | import decimal
 3 | import random
 4 | 
 5 | import boto3
 6 | 
 7 | cloudwatch = boto3.client('cloudwatch')
 8 | 
 9 | 
10 | def lambda_handler(event, context):
11 | 
12 |     cloudwatch.put_metric_data(
13 |         MetricData=[
14 |             {
15 |                 'MetricName': 'OrderTotal',
16 |                 'Value': decimal.Decimal(random.randrange(100, 50000))/100
17 |             },
18 |         ],
19 |         Namespace='ShoppingCartApp'
20 |     )
21 | 
22 |     return {
23 |         "statusCode": 200,
24 |         "body": json.dumps({
25 |             "OrderID": "123456",
26 |             "OrderTotal": "543.21",
27 |         }),
28 |     }
29 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/CloudWatch-Custom-Metrics/shopping-cart-app/purchase/requirements.txt:
--------------------------------------------------------------------------------
1 | boto3


--------------------------------------------------------------------------------
/Monitoring-Debugging/CloudWatch-Custom-Metrics/shopping-cart-app/template.yaml:
--------------------------------------------------------------------------------
 1 | AWSTemplateFormatVersion: '2010-09-09'
 2 | Transform: AWS::Serverless-2016-10-31
 3 | Description: Shopping cart app
 4 | 
 5 | Globals:
 6 |   Function:
 7 |     Handler: app.lambda_handler
 8 |     Runtime: python3.7
 9 |     Tracing: Active
10 |     Timeout: 3
11 | 
12 | Resources:
13 |  
14 |   AddToCartFunction:
15 |     Type: AWS::Serverless::Function
16 |     Properties:
17 |       CodeUri: add_to_cart/
18 |       Events:
19 |         AddToCart:
20 |           Type: Api
21 |           Properties:
22 |             Path: /cart/add
23 |             Method: get
24 |       Policies:
25 |       - CloudWatchPutMetricPolicy: {}
26 | 
27 |   PurchaseFunction:
28 |     Type: AWS::Serverless::Function
29 |     Properties:
30 |       CodeUri: purchase/
31 |       Events:
32 |         Purchase:
33 |           Type: Api
34 |           Properties:
35 |             Path: /cart/purchase
36 |             Method: get
37 |       Policies:
38 |       - CloudWatchPutMetricPolicy: {}
39 | 
40 |   ViewProductFunction:
41 |     Type: AWS::Serverless::Function
42 |     Properties:
43 |       CodeUri: view_product/
44 |       Events:
45 |         ViewProduct:
46 |           Type: Api
47 |           Properties:
48 |             Path: /products/123456
49 |             Method: get
50 |       Policies:
51 |       - CloudWatchPutMetricPolicy: {}
52 | 
53 | Outputs:
54 |   AddToCartApi:
55 |     Description: "API Gateway endpoint URL for Prod stage for AddToCart function"
56 |     Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/cart/add"
57 |   AddToCartFunction:
58 |     Description: "AddToCart Lambda Function ARN"
59 |     Value: !GetAtt AddToCartFunction.Arn
60 |   AddToCartFunctionIamRole:
61 |     Description: "Implicit IAM Role created for AddToCart function"
62 |     Value: !GetAtt AddToCartFunctionRole.Arn
63 |   PurchaseApi:
64 |     Description: "API Gateway endpoint URL for Prod stage for Purchase function"
65 |     Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/cart/purchase"
66 |   PurchaseFunction:
67 |     Description: "Purchase Lambda Function ARN"
68 |     Value: !GetAtt PurchaseFunction.Arn
69 |   PurchaseFunctionIamRole:
70 |     Description: "Implicit IAM Role created for Purchase function"
71 |     Value: !GetAtt PurchaseFunctionRole.Arn
72 |   ViewProductApi:
73 |     Description: "API Gateway endpoint URL for Prod stage for ViewProduct function"
74 |     Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/products/123456"
75 |   ViewProductFunction:
76 |     Description: "ViewProduct Lambda Function ARN"
77 |     Value: !GetAtt ViewProductFunction.Arn
78 |   ViewProductFunctionIamRole:
79 |     Description: "Implicit IAM Role created for ViewProduct function"
80 |     Value: !GetAtt ViewProductFunctionRole.Arn
81 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/CloudWatch-Custom-Metrics/shopping-cart-app/view_product/app.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | 
 3 | import boto3
 4 | 
 5 | cloudwatch = boto3.client('cloudwatch')
 6 | 
 7 | 
 8 | def lambda_handler(event, context):
 9 | 
10 |     cloudwatch.put_metric_data(
11 |         MetricData=[
12 |             {
13 |                 'MetricName': 'ViewProduct',
14 |                 'Value': 1
15 |             },
16 |         ],
17 |         Namespace='ShoppingCartApp'
18 |     )
19 | 
20 |     return {
21 |         "statusCode": 200,
22 |         "body": json.dumps({
23 |             "ProductID": "123456",
24 |         }),
25 |     }
26 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/CloudWatch-Custom-Metrics/shopping-cart-app/view_product/requirements.txt:
--------------------------------------------------------------------------------
1 | boto3


--------------------------------------------------------------------------------
/Monitoring-Debugging/Tracing-with-X-Ray/README.md:
--------------------------------------------------------------------------------
 1 | # Tracing with X-Ray
 2 | 
 3 | ## Create DynamoDB Table
 4 | 
 5 | Create table `Flask` with primary partition key `key`:
 6 | 
 7 | ```sh
 8 | aws dynamodb create-table --table-name Flask \
 9 |   --attribute-definitions AttributeName=key,AttributeType=S \
10 |   --key-schema AttributeName=key,KeyType=HASH \
11 |   --billing-mode=PAY_PER_REQUEST
12 | ```
13 | 
14 | ## Configure [Zappa](https://github.com/Miserlou/Zappa)
15 | 
16 | ```sh
17 | cd example
18 | pipenv --python 3.7
19 | pipenv shell
20 | pipenv install aws-xray-sdk flask zappa requests
21 | pipenv lock -r > requirements.txt
22 | zappa init
23 | ```
24 | 
25 | Add the following property to `zappa_settings.json`:
26 | 
27 | ```json
28 | "xray_tracing": true
29 | ```
30 | 
31 | Deploy the application:
32 | 
33 | ```sh
34 | zappa deploy
35 | ```
36 | 
37 | ## Enable X-Ray Tracing for API Gateway
38 | 
39 | In this step you will interact with the API Gateway console to enable X\-Ray tracing\.
40 | 
41 | 1. Sign in to the AWS Management Console and open the API Gateway console at <https://console\.aws\.amazon\.com/apigateway/>.
42 | 1. Select your API, i.e. `example-dev`.
43 | 1. Choose **Stages**.
44 | 1. Choose the name of your deployment stage, i.e. `dev`.
45 | 1. On the **Logs/Tracing** tab, select the **Enable X-Ray Tracing** box.
46 | 1. Choose **Save Changes**.
47 | 1. Access the endpoint in your browser.
48 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/Tracing-with-X-Ray/example/Pipfile:
--------------------------------------------------------------------------------
 1 | [[source]]
 2 | name = "pypi"
 3 | url = "https://pypi.org/simple"
 4 | verify_ssl = true
 5 | 
 6 | [dev-packages]
 7 | 
 8 | [packages]
 9 | aws-xray-sdk = "*"
10 | flask = "*"
11 | zappa = "*"
12 | requests = "*"
13 | 
14 | [requires]
15 | python_version = "3.7"
16 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/Tracing-with-X-Ray/example/Pipfile.lock:
--------------------------------------------------------------------------------
  1 | {
  2 |     "_meta": {
  3 |         "hash": {
  4 |             "sha256": "5d5a7441ba49a1d3d281d79941b2ba93e75d307b09a0c659175de412210d3b98"
  5 |         },
  6 |         "pipfile-spec": 6,
  7 |         "requires": {
  8 |             "python_version": "3.7"
  9 |         },
 10 |         "sources": [
 11 |             {
 12 |                 "name": "pypi",
 13 |                 "url": "https://pypi.org/simple",
 14 |                 "verify_ssl": true
 15 |             }
 16 |         ]
 17 |     },
 18 |     "default": {
 19 |         "argcomplete": {
 20 |             "hashes": [
 21 |                 "sha256:c079ceb0b72d4d4e03531ed77e6071babb9d42c3f790d7def2c41295b4990b44",
 22 |                 "sha256:d97b7f3cfaa4e494ad59ed6d04c938fc5ed69b590bd8f53274e258fb1119bd1b"
 23 |             ],
 24 |             "version": "==1.9.3"
 25 |         },
 26 |         "aws-xray-sdk": {
 27 |             "hashes": [
 28 |                 "sha256:75cbce8c777b7d8055719ee1a0db6043e53c44e8f1a62a956bd84db87c4a4c7c",
 29 |                 "sha256:ce4adb60fe67ebe91f2fc57d5067b4e44df6e233652987be4fb2e549688cf9fe"
 30 |             ],
 31 |             "index": "pypi",
 32 |             "version": "==2.4.2"
 33 |         },
 34 |         "boto3": {
 35 |             "hashes": [
 36 |                 "sha256:25bf66529b94fc9b89928fd5fd004d4a15c7e9603b44692e9652b8fc526699c3",
 37 |                 "sha256:60b6f8ce0f2213b070ad67851466b7e8467061efe9536df467f61402c2110a9f"
 38 |             ],
 39 |             "version": "==1.9.119"
 40 |         },
 41 |         "botocore": {
 42 |             "hashes": [
 43 |                 "sha256:22e8c1a52aea4511a276926400bc2a2209c6cd96e75d144696c5e5b405775914",
 44 |                 "sha256:92e8cf18e220aadef3db0ef724537a8b3414f2836d99a972e09b9c9bd4001295"
 45 |             ],
 46 |             "version": "==1.12.119"
 47 |         },
 48 |         "certifi": {
 49 |             "hashes": [
 50 |                 "sha256:59b7658e26ca9c7339e00f8f4636cdfe59d34fa37b9b04f6f9e9926b3cece1a5",
 51 |                 "sha256:b26104d6835d1f5e49452a26eb2ff87fe7090b89dfcaee5ea2212697e1e1d7ae"
 52 |             ],
 53 |             "version": "==2019.3.9"
 54 |         },
 55 |         "cfn-flip": {
 56 |             "hashes": [
 57 |                 "sha256:0b3378255f331b2b987cb7ec99e44b1c51a7cdf51e9e0a8e49df85cd8caa0d9f",
 58 |                 "sha256:9371be744f202af907c9d39cc3ffd3c6014013ae66e75eba32005b2e650c209b"
 59 |             ],
 60 |             "version": "==1.1.0.post1"
 61 |         },
 62 |         "chardet": {
 63 |             "hashes": [
 64 |                 "sha256:84ab92ed1c4d4f16916e05906b6b75a6c0fb5db821cc65e70cbd64a3e2a5eaae",
 65 |                 "sha256:fc323ffcaeaed0e0a02bf4d117757b98aed530d9ed4531e3e15460124c106691"
 66 |             ],
 67 |             "version": "==3.0.4"
 68 |         },
 69 |         "click": {
 70 |             "hashes": [
 71 |                 "sha256:2335065e6395b9e67ca716de5f7526736bfa6ceead690adf616d925bdc622b13",
 72 |                 "sha256:5b94b49521f6456670fdb30cd82a4eca9412788a93fa6dd6df72c94d5a8ff2d7"
 73 |             ],
 74 |             "version": "==7.0"
 75 |         },
 76 |         "docutils": {
 77 |             "hashes": [
 78 |                 "sha256:02aec4bd92ab067f6ff27a38a38a41173bf01bed8f89157768c1573f53e474a6",
 79 |                 "sha256:51e64ef2ebfb29cae1faa133b3710143496eca21c530f3f71424d77687764274",
 80 |                 "sha256:7a4bd47eaf6596e1295ecb11361139febe29b084a87bf005bf899f9a42edc3c6"
 81 |             ],
 82 |             "version": "==0.14"
 83 |         },
 84 |         "durationpy": {
 85 |             "hashes": [
 86 |                 "sha256:5ef9416b527b50d722f34655becfb75e49228eb82f87b855ed1911b3314b5408"
 87 |             ],
 88 |             "version": "==0.5"
 89 |         },
 90 |         "flask": {
 91 |             "hashes": [
 92 |                 "sha256:2271c0070dbcb5275fad4a82e29f23ab92682dc45f9dfbc22c02ba9b9322ce48",
 93 |                 "sha256:a080b744b7e345ccfcbc77954861cb05b3c63786e93f2b3875e0913d44b43f05"
 94 |             ],
 95 |             "index": "pypi",
 96 |             "version": "==1.0.2"
 97 |         },
 98 |         "future": {
 99 |             "hashes": [
100 |                 "sha256:e39ced1ab767b5936646cedba8bcce582398233d6a627067d4c6a454c90cfedb"
101 |             ],
102 |             "version": "==0.16.0"
103 |         },
104 |         "hjson": {
105 |             "hashes": [
106 |                 "sha256:1d1727faa6aaef2973921877125a3ab7c5f6d34b93233179d01770f41fab51f9"
107 |             ],
108 |             "version": "==3.0.1"
109 |         },
110 |         "idna": {
111 |             "hashes": [
112 |                 "sha256:c357b3f628cf53ae2c4c05627ecc484553142ca23264e593d327bcde5e9c3407",
113 |                 "sha256:ea8b7f6188e6fa117537c3df7da9fc686d485087abf6ac197f9c46432f7e4a3c"
114 |             ],
115 |             "version": "==2.8"
116 |         },
117 |         "itsdangerous": {
118 |             "hashes": [
119 |                 "sha256:321b033d07f2a4136d3ec762eac9f16a10ccd60f53c0c91af90217ace7ba1f19",
120 |                 "sha256:b12271b2047cb23eeb98c8b5622e2e5c5e9abd9784a153e9d8ef9cb4dd09d749"
121 |             ],
122 |             "version": "==1.1.0"
123 |         },
124 |         "jinja2": {
125 |             "hashes": [
126 |                 "sha256:74c935a1b8bb9a3947c50a54766a969d4846290e1e788ea44c1392163723c3bd",
127 |                 "sha256:f84be1bb0040caca4cea721fcbbbbd61f9be9464ca236387158b0feea01914a4"
128 |             ],
129 |             "version": "==2.10"
130 |         },
131 |         "jmespath": {
132 |             "hashes": [
133 |                 "sha256:6a81d4c9aa62caf061cb517b4d9ad1dd300374cd4706997aff9cd6aedd61fc64",
134 |                 "sha256:f11b4461f425740a1d908e9a3f7365c3d2e569f6ca68a2ff8bc5bcd9676edd63"
135 |             ],
136 |             "version": "==0.9.3"
137 |         },
138 |         "jsonpickle": {
139 |             "hashes": [
140 |                 "sha256:0231d6f7ebc4723169310141352d9c9b7bbbd6f3be110cf634575d2bf2af91f0",
141 |                 "sha256:625098cc8e5854b8c23b587aec33bc8e33e0e597636bfaca76152249c78fe5c1"
142 |             ],
143 |             "version": "==1.1"
144 |         },
145 |         "kappa": {
146 |             "hashes": [
147 |                 "sha256:4b5b372872f25d619e427e04282551048dc975a107385b076b3ffc6406a15833",
148 |                 "sha256:4d6b7b3accce4a0aaaac92b36237a6304f0f2fffbbe3caea3f7c9f52d12c9989"
149 |             ],
150 |             "version": "==0.6.0"
151 |         },
152 |         "lambda-packages": {
153 |             "hashes": [
154 |                 "sha256:b5e3b81ecef5f7c1b0903b5c40813536ba2343a33868a567e4e4ff1e26243406"
155 |             ],
156 |             "version": "==0.20.0"
157 |         },
158 |         "markupsafe": {
159 |             "hashes": [
160 |                 "sha256:00bc623926325b26bb9605ae9eae8a215691f33cae5df11ca5424f06f2d1f473",
161 |                 "sha256:09027a7803a62ca78792ad89403b1b7a73a01c8cb65909cd876f7fcebd79b161",
162 |                 "sha256:09c4b7f37d6c648cb13f9230d847adf22f8171b1ccc4d5682398e77f40309235",
163 |                 "sha256:1027c282dad077d0bae18be6794e6b6b8c91d58ed8a8d89a89d59693b9131db5",
164 |                 "sha256:24982cc2533820871eba85ba648cd53d8623687ff11cbb805be4ff7b4c971aff",
165 |                 "sha256:29872e92839765e546828bb7754a68c418d927cd064fd4708fab9fe9c8bb116b",
166 |                 "sha256:43a55c2930bbc139570ac2452adf3d70cdbb3cfe5912c71cdce1c2c6bbd9c5d1",
167 |                 "sha256:46c99d2de99945ec5cb54f23c8cd5689f6d7177305ebff350a58ce5f8de1669e",
168 |                 "sha256:500d4957e52ddc3351cabf489e79c91c17f6e0899158447047588650b5e69183",
169 |                 "sha256:535f6fc4d397c1563d08b88e485c3496cf5784e927af890fb3c3aac7f933ec66",
170 |                 "sha256:62fe6c95e3ec8a7fad637b7f3d372c15ec1caa01ab47926cfdf7a75b40e0eac1",
171 |                 "sha256:6dd73240d2af64df90aa7c4e7481e23825ea70af4b4922f8ede5b9e35f78a3b1",
172 |                 "sha256:717ba8fe3ae9cc0006d7c451f0bb265ee07739daf76355d06366154ee68d221e",
173 |                 "sha256:79855e1c5b8da654cf486b830bd42c06e8780cea587384cf6545b7d9ac013a0b",
174 |                 "sha256:7c1699dfe0cf8ff607dbdcc1e9b9af1755371f92a68f706051cc8c37d447c905",
175 |                 "sha256:88e5fcfb52ee7b911e8bb6d6aa2fd21fbecc674eadd44118a9cc3863f938e735",
176 |                 "sha256:8defac2f2ccd6805ebf65f5eeb132adcf2ab57aa11fdf4c0dd5169a004710e7d",
177 |                 "sha256:98c7086708b163d425c67c7a91bad6e466bb99d797aa64f965e9d25c12111a5e",
178 |                 "sha256:9add70b36c5666a2ed02b43b335fe19002ee5235efd4b8a89bfcf9005bebac0d",
179 |                 "sha256:9bf40443012702a1d2070043cb6291650a0841ece432556f784f004937f0f32c",
180 |                 "sha256:ade5e387d2ad0d7ebf59146cc00c8044acbd863725f887353a10df825fc8ae21",
181 |                 "sha256:b00c1de48212e4cc9603895652c5c410df699856a2853135b3967591e4beebc2",
182 |                 "sha256:b1282f8c00509d99fef04d8ba936b156d419be841854fe901d8ae224c59f0be5",
183 |                 "sha256:b2051432115498d3562c084a49bba65d97cf251f5a331c64a12ee7e04dacc51b",
184 |                 "sha256:ba59edeaa2fc6114428f1637ffff42da1e311e29382d81b339c1817d37ec93c6",
185 |                 "sha256:c8716a48d94b06bb3b2524c2b77e055fb313aeb4ea620c8dd03a105574ba704f",
186 |                 "sha256:cd5df75523866410809ca100dc9681e301e3c27567cf498077e8551b6d20e42f",
187 |                 "sha256:e249096428b3ae81b08327a63a485ad0878de3fb939049038579ac0ef61e17e7"
188 |             ],
189 |             "version": "==1.1.1"
190 |         },
191 |         "placebo": {
192 |             "hashes": [
193 |                 "sha256:03157f8527bbc2965b71b88f4a139ef8038618b346787f20d63e3c5da541b047"
194 |             ],
195 |             "version": "==0.9.0"
196 |         },
197 |         "python-dateutil": {
198 |             "hashes": [
199 |                 "sha256:891c38b2a02f5bb1be3e4793866c8df49c7d19baabf9c1bad62547e0b4866aca",
200 |                 "sha256:95511bae634d69bc7329ba55e646499a842bc4ec342ad54a8cdb65645a0aad3c"
201 |             ],
202 |             "markers": "python_version >= '2.7'",
203 |             "version": "==2.6.1"
204 |         },
205 |         "python-slugify": {
206 |             "hashes": [
207 |                 "sha256:57a385df7a1c6dbd15f7666eaff0ff29d3f60363b228b1197c5308ed3ba5f824",
208 |                 "sha256:c3733135d3b184196fdb8844f6a74bbfb9cf6720d1dcce3254bdc434353f938f"
209 |             ],
210 |             "version": "==1.2.4"
211 |         },
212 |         "pyyaml": {
213 |             "hashes": [
214 |                 "sha256:1adecc22f88d38052fb787d959f003811ca858b799590a5eaa70e63dca50308c",
215 |                 "sha256:436bc774ecf7c103814098159fbb84c2715d25980175292c648f2da143909f95",
216 |                 "sha256:460a5a4248763f6f37ea225d19d5c205677d8d525f6a83357ca622ed541830c2",
217 |                 "sha256:5a22a9c84653debfbf198d02fe592c176ea548cccce47553f35f466e15cf2fd4",
218 |                 "sha256:7a5d3f26b89d688db27822343dfa25c599627bc92093e788956372285c6298ad",
219 |                 "sha256:9372b04a02080752d9e6f990179a4ab840227c6e2ce15b95e1278456664cf2ba",
220 |                 "sha256:a5dcbebee834eaddf3fa7366316b880ff4062e4bcc9787b78c7fbb4a26ff2dd1",
221 |                 "sha256:aee5bab92a176e7cd034e57f46e9df9a9862a71f8f37cad167c6fc74c65f5b4e",
222 |                 "sha256:c51f642898c0bacd335fc119da60baae0824f2cde95b0330b56c0553439f0673",
223 |                 "sha256:c68ea4d3ba1705da1e0d85da6684ac657912679a649e8868bd850d2c299cce13",
224 |                 "sha256:e23d0cc5299223dcc37885dae624f382297717e459ea24053709675a976a3e19"
225 |             ],
226 |             "version": "==5.1"
227 |         },
228 |         "requests": {
229 |             "hashes": [
230 |                 "sha256:502a824f31acdacb3a35b6690b5fbf0bc41d63a24a45c4004352b0242707598e",
231 |                 "sha256:7bf2a778576d825600030a110f3c0e3e8edc51dfaafe1c146e39a2027784957b"
232 |             ],
233 |             "index": "pypi",
234 |             "version": "==2.21.0"
235 |         },
236 |         "s3transfer": {
237 |             "hashes": [
238 |                 "sha256:7b9ad3213bff7d357f888e0fab5101b56fa1a0548ee77d121c3a3dbfbef4cb2e",
239 |                 "sha256:f23d5cb7d862b104401d9021fc82e5fa0e0cf57b7660a1331425aab0c691d021"
240 |             ],
241 |             "version": "==0.2.0"
242 |         },
243 |         "six": {
244 |             "hashes": [
245 |                 "sha256:3350809f0555b11f552448330d0b52d5f24c91a322ea4a15ef22629740f3761c",
246 |                 "sha256:d16a0141ec1a18405cd4ce8b4613101da75da0e9a7aec5bdd4fa804d0e0eba73"
247 |             ],
248 |             "version": "==1.12.0"
249 |         },
250 |         "toml": {
251 |             "hashes": [
252 |                 "sha256:229f81c57791a41d65e399fc06bf0848bab550a9dfd5ed66df18ce5f05e73d5c",
253 |                 "sha256:235682dd292d5899d361a811df37e04a8828a5b1da3115886b73cf81ebc9100e"
254 |             ],
255 |             "version": "==0.10.0"
256 |         },
257 |         "tqdm": {
258 |             "hashes": [
259 |                 "sha256:ba650e08b8b102923a05896bf9d7e1c9cdc20b484156df0511a4bbf1f6b6f89b",
260 |                 "sha256:fa6d2ea6285f56e75d7efe9259805deadc450f16066a1f82ad0629ea9be2cd0f"
261 |             ],
262 |             "version": "==4.19.1"
263 |         },
264 |         "troposphere": {
265 |             "hashes": [
266 |                 "sha256:05c0be560a58cca3a15cb9a88eea6557cb484459993aef0a4b959eb7bb475f6a"
267 |             ],
268 |             "version": "==2.4.6"
269 |         },
270 |         "unidecode": {
271 |             "hashes": [
272 |                 "sha256:092cdf7ad9d1052c50313426a625b717dab52f7ac58f859e09ea020953b1ad8f",
273 |                 "sha256:8b85354be8fd0c0e10adbf0675f6dc2310e56fda43fa8fe049123b6c475e52fb"
274 |             ],
275 |             "version": "==1.0.23"
276 |         },
277 |         "urllib3": {
278 |             "hashes": [
279 |                 "sha256:61bf29cada3fc2fbefad4fdf059ea4bd1b4a86d2b6d15e1c7c0b582b9752fe39",
280 |                 "sha256:de9529817c93f27c8ccbfead6985011db27bd0ddfcdb2d86f3f663385c6a9c22"
281 |             ],
282 |             "markers": "python_version >= '3.4'",
283 |             "version": "==1.24.1"
284 |         },
285 |         "werkzeug": {
286 |             "hashes": [
287 |                 "sha256:96da23fa8ccecbc3ae832a83df5c722c11547d021637faacb0bec4dd2f4666c8",
288 |                 "sha256:ca5c2dcd367d6c0df87185b9082929d255358f5391923269335782b213d52655"
289 |             ],
290 |             "version": "==0.15.1"
291 |         },
292 |         "wheel": {
293 |             "hashes": [
294 |                 "sha256:66a8fd76f28977bb664b098372daef2b27f60dc4d1688cfab7b37a09448f0e9d",
295 |                 "sha256:8eb4a788b3aec8abf5ff68d4165441bc57420c9f64ca5f471f58c3969fe08668"
296 |             ],
297 |             "version": "==0.33.1"
298 |         },
299 |         "wrapt": {
300 |             "hashes": [
301 |                 "sha256:4aea003270831cceb8a90ff27c4031da6ead7ec1886023b80ce0dfe0adf61533"
302 |             ],
303 |             "version": "==1.11.1"
304 |         },
305 |         "wsgi-request-logger": {
306 |             "hashes": [
307 |                 "sha256:445d7ec52799562f812006394d0b4a7064b37084c6ea6bd74ea7a2136c97ed83"
308 |             ],
309 |             "version": "==0.4.6"
310 |         },
311 |         "zappa": {
312 |             "hashes": [
313 |                 "sha256:621209ceaf2cf5fcc18ed6bb6cf53aeb2315e38989a6929cbb49c66b5454d656",
314 |                 "sha256:86b125c0e9696b177f61bf636ab19ead7aba1bb9281cdba0651825358337008e",
315 |                 "sha256:b7a04172407cdb9277cb166b42920d3c5d745fd50204d1ce7f42769e61b6649e"
316 |             ],
317 |             "index": "pypi",
318 |             "version": "==0.48.2"
319 |         }
320 |     },
321 |     "develop": {}
322 | }
323 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/Tracing-with-X-Ray/example/app.py:
--------------------------------------------------------------------------------
 1 | import logging
 2 | import uuid
 3 | 
 4 | import boto3
 5 | import requests
 6 | from flask import Flask
 7 | 
 8 | from aws_xray_sdk.core import patch_all, xray_recorder
 9 | from aws_xray_sdk.ext.flask.middleware import XRayMiddleware
10 | 
11 | # Patch all supported modules to enable automatic instrumentation
12 | patch_all()
13 | 
14 | app = Flask(__name__)
15 | logging.basicConfig()
16 | logger = logging.getLogger(__name__)
17 | logger.setLevel(logging.DEBUG)
18 | 
19 | # Configure the X-Ray recorder to generate segments with our service name
20 | xray_recorder.configure(service='Example Flask App')
21 | 
22 | # Instrument the Flask application
23 | XRayMiddleware(app, xray_recorder)
24 | 
25 | # Boto3 resources
26 | dynamodb = boto3.resource('dynamodb')
27 | table = dynamodb.Table('Flask')
28 | 
29 | 
30 | @app.route('/')
31 | def hello_world():
32 |     r = requests.get("https://linuxacademy.com")
33 | 
34 |     logger.debug(r.text)
35 | 
36 |     xray_recorder.begin_subsegment('DynamoDB PutItem')
37 |     table.put_item(
38 |         Item={
39 |             'key': str(uuid.uuid1()),
40 |             'response': r.text
41 |         }
42 |     )
43 |     xray_recorder.end_subsegment()
44 | 
45 |     return 'Hello, World: %s' % r.url
46 | 
47 | 
48 | if __name__ == '__main__':
49 |     app.run(debug=True)
50 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/Tracing-with-X-Ray/example/requirements.txt:
--------------------------------------------------------------------------------
 1 | -i https://pypi.org/simple
 2 | argcomplete==1.9.3
 3 | aws-xray-sdk==2.4.2
 4 | boto3==1.9.119
 5 | botocore==1.12.119
 6 | certifi==2019.3.9
 7 | cfn-flip==1.1.0.post1
 8 | chardet==3.0.4
 9 | click==7.0
10 | docutils==0.14
11 | durationpy==0.5
12 | flask==1.0.2
13 | future==0.16.0
14 | hjson==3.0.1
15 | idna==2.8
16 | itsdangerous==1.1.0
17 | jinja2==2.10
18 | jmespath==0.9.3
19 | jsonpickle==1.1
20 | kappa==0.6.0
21 | lambda-packages==0.20.0
22 | markupsafe==1.1.1
23 | placebo==0.9.0
24 | python-dateutil==2.6.1 ; python_version >= '2.7'
25 | python-slugify==1.2.4
26 | pyyaml==5.1
27 | requests==2.21.0
28 | s3transfer==0.2.0
29 | six==1.12.0
30 | toml==0.10.0
31 | tqdm==4.19.1
32 | troposphere==2.4.6
33 | unidecode==1.0.23
34 | urllib3==1.24.1 ; python_version >= '3.4'
35 | werkzeug==0.15.1
36 | wheel==0.33.1
37 | wrapt==1.11.1
38 | wsgi-request-logger==0.4.6
39 | zappa==0.48.2
40 | 


--------------------------------------------------------------------------------
/Monitoring-Debugging/Tracing-with-X-Ray/example/zappa_settings.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "dev": {
 3 |     "app_function": "app.app",
 4 |     "aws_region": "us-east-2",
 5 |     "profile_name": "default",
 6 |     "project_name": "example",
 7 |     "runtime": "python3.7",
 8 |     "s3_bucket": "zappa-kh2jm4it1",
 9 |     "xray_tracing": true
10 |   }
11 | }
12 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # Automating AWS with Lambda, Python, and Boto3
2 | 
3 | Course: <https://linuxacademy.com/cp/modules/view/id/313>
4 | 


--------------------------------------------------------------------------------
/S3/Detecting-Faces-with-Rekognition/README.md:
--------------------------------------------------------------------------------
 1 | # Detecting Faces with Rekognition
 2 | 
 3 | ## DynamoDB
 4 | 
 5 | Create table `Faces` with primary partition key `key`:
 6 | 
 7 | ```sh
 8 | aws dynamodb create-table --table-name Faces \
 9 |   --attribute-definitions AttributeName=key,AttributeType=S \
10 |   --key-schema AttributeName=key,KeyType=HASH \
11 |   --billing-mode=PAY_PER_REQUEST
12 | ```
13 | 
14 | ## Extracting detected face names from the response JSON
15 | 
16 | ```sh
17 | `jq '.CelebrityFaces[].Name' response.json` > names.txt
18 | ```
19 | 
20 | More info on `jq` is [here](https://stedolan.github.io/jq/).
21 | 


--------------------------------------------------------------------------------
/S3/Detecting-Faces-with-Rekognition/iam.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "s3:GetObject"
16 |       ],
17 |       "Resource": "arn:aws:s3:::__YOUR_BUCKET_NAME_HERE__/*"
18 |     },
19 |     {
20 |       "Effect": "Allow",
21 |       "Action": [
22 |         "dynamodb:PutItem"
23 |       ],
24 |       "Resource": "*"
25 |     },
26 |     {
27 |       "Effect": "Allow",
28 |       "Action": [
29 |         "rekognition:*"
30 |       ],
31 |       "Resource": "*"
32 |     }
33 |   ]
34 | }
35 | 


--------------------------------------------------------------------------------
/S3/Detecting-Faces-with-Rekognition/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import os
 2 | 
 3 | import boto3
 4 | 
 5 | TABLE_NAME = os.environ['TABLE_NAME']
 6 | 
 7 | dynamodb = boto3.resource('dynamodb')
 8 | table = dynamodb.Table(TABLE_NAME)
 9 | s3 = boto3.resource('s3')
10 | rekognition = boto3.client('rekognition')
11 | 
12 | 
13 | def lambda_handler(event, context):
14 | 
15 |     # Get the object from the event
16 |     bucket = event['Records'][0]['s3']['bucket']['name']
17 |     key = event['Records'][0]['s3']['object']['key']
18 | 
19 |     obj = s3.Object(bucket, key)
20 |     image = obj.get()['Body'].read()
21 |     print('Recognizing celebrities...')
22 |     response = rekognition.recognize_celebrities(Image={'Bytes': image})
23 | 
24 |     names = []
25 | 
26 |     for celebrity in response['CelebrityFaces']:
27 |         name = celebrity['Name']
28 |         print('Name: ' + name)
29 |         names.append(name)
30 | 
31 |     print(names)
32 | 
33 |     print('Saving face data to DynamoDB table:', TABLE_NAME)
34 |     response = table.put_item(
35 |         Item={
36 |             'key': key,
37 |             'names': names,
38 |         }
39 |     )
40 |     print(response)
41 | 


--------------------------------------------------------------------------------
/S3/Detecting-Faces-with-Rekognition/names.txt:
--------------------------------------------------------------------------------
 1 | "Grover Cleveland"
 2 | "Bill Clinton"
 3 | "Woodrow Wilson"
 4 | "Richard Nixon"
 5 | "Ronald Reagan"
 6 | "Lyndon B. Johnson"
 7 | "Andrew Jackson"
 8 | "Ulysses S. Grant"
 9 | "Thomas Jefferson"
10 | "George W. Bush"
11 | "John F. Kennedy"
12 | "Andrew Johnson"
13 | "Calvin Coolidge"
14 | 


--------------------------------------------------------------------------------
/S3/Detecting-Faces-with-Rekognition/presidents.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/linuxacademy/content-lambda-boto3/c037e4a1583c32f1ae81bb16d3ce880a1292df02/S3/Detecting-Faces-with-Rekognition/presidents.jpg


--------------------------------------------------------------------------------
/S3/Importing-CSV-Files/README.md:
--------------------------------------------------------------------------------
1 | # Transforming CSV to JSON for DynamoDB
2 | 
3 | 


--------------------------------------------------------------------------------
/S3/Importing-CSV-Files/iam.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "s3:GetObject"
16 |       ],
17 |       "Resource": "arn:aws:s3:::__YOUR_BUCKET_NAME_HERE__/*"
18 |     },
19 |     {
20 |       "Effect": "Allow",
21 |       "Action": [
22 |         "dynamodb:*"
23 |       ],
24 |       "Resource": "arn:aws:dynamodb:__YOUR_REGION__:__YOUR_ACCOUNT_ID__:table/Movies"
25 |     }
26 |   ]
27 | }
28 | 


--------------------------------------------------------------------------------
/S3/Importing-CSV-Files/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import csv
 2 | import os
 3 | import tempfile
 4 | 
 5 | import boto3
 6 | 
 7 | dynamodb = boto3.resource('dynamodb')
 8 | table = dynamodb.Table('Movies')
 9 | s3 = boto3.client('s3')
10 | 
11 | 
12 | def lambda_handler(event, context):
13 | 
14 |     for record in event['Records']:
15 |         source_bucket = record['s3']['bucket']['name']
16 |         key = record['s3']['object']['key']
17 |         with tempfile.TemporaryDirectory() as tmpdir:
18 |             download_path = os.path.join(tmpdir, key)
19 |             s3.download_file(source_bucket, key, download_path)
20 |             items = read_csv(download_path)
21 | 
22 |             with table.batch_writer() as batch:
23 |                 for item in items:
24 |                     batch.put_item(Item=item)
25 | 
26 | 
27 | def read_csv(file):
28 |     items = []
29 |     with open(file) as csvfile:
30 |         reader = csv.DictReader(csvfile)
31 |         for row in reader:
32 |             data = {}
33 |             data['Meta'] = {}
34 |             data['Year'] = int(row['Year'])
35 |             data['Title'] = row['Title'] or None
36 |             data['Meta']['Length'] = int(row['Length'] or 0)
37 |             data['Meta']['Subject'] = row['Subject'] or None
38 |             data['Meta']['Actor'] = row['Actor'] or None
39 |             data['Meta']['Actress'] = row['Actress'] or None
40 |             data['Meta']['Director'] = row['Director'] or None
41 |             data['Meta']['Popularity'] = row['Popularity'] or None
42 |             data['Meta']['Awards'] = row['Awards'] == 'Yes'
43 |             data['Meta']['Image'] = row['Image'] or None
44 |             data['Meta'] = {k: v for k,
45 |                             v in data['Meta'].items() if v is not None}
46 |             items.append(data)
47 |     return items
48 | 


--------------------------------------------------------------------------------
/S3/Resizing-Images/.gitignore:
--------------------------------------------------------------------------------
1 | PIL/**
2 | **/*.whl*
3 | lambda.zip
4 | 


--------------------------------------------------------------------------------
/S3/Resizing-Images/README.md:
--------------------------------------------------------------------------------
 1 | # Resizing Images
 2 | 
 3 | ## Pillow - Python Imaging Library (Fork)
 4 | 
 5 | Download the `Pillow-5.4.1-cp37-cp37m-manylinux1_x86_64.whl` package from <https://pypi.org/project/Pillow/>. Direct download [here](https://files.pythonhosted.org/packages/ae/2a/0a0ab2833e5270664fb5fae590717f867ac6319b124160c09f1d3291de28/Pillow-5.4.1-cp37-cp37m-manylinux1_x86_64.whl).
 6 | 
 7 | Download using `wget`:
 8 | 
 9 | ```sh
10 | wget https://files.pythonhosted.org/packages/ae/2a/0a0ab2833e5270664fb5fae590717f867ac6319b124160c09f1d3291de28/Pillow-5.4.1-cp37-cp37m-manylinux1_x86_64.whl
11 | ```
12 | 
13 | Extract the wheel file in the same folder as `lambda_handler.py`:
14 | 
15 | ```sh
16 | unzip Pillow-5.4.1-cp37-cp37m-manylinux1_x86_64.whl
17 | ```
18 | 
19 | The `Pillow-5.4.1.dist-info` isn't needed:
20 | 
21 | ```sh
22 | rm -rf Pillow-5.4.1.dist-info
23 | ```
24 | 
25 | Zip the `PIL` directory along with `lambda_handler.py`:
26 | 
27 | ```sh
28 | zip -r9 lambda.zip PIL lambda_handler.py
29 | ```
30 | 
31 | Upload `lambda.zip` to AWS Lambda.


--------------------------------------------------------------------------------
/S3/Resizing-Images/blue-marble.jpg:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/linuxacademy/content-lambda-boto3/c037e4a1583c32f1ae81bb16d3ce880a1292df02/S3/Resizing-Images/blue-marble.jpg


--------------------------------------------------------------------------------
/S3/Resizing-Images/iam.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "s3:GetObject"
16 |       ],
17 |       "Resource": "arn:aws:s3:::__YOUR_SOURCE_BUCKET_NAME_HERE__/*"
18 |     },
19 |     {
20 |       "Effect": "Allow",
21 |       "Action": [
22 |         "s3:PutObject"
23 |       ],
24 |       "Resource": "arn:aws:s3:::__YOUR_DESTINATION_BUCKET_NAME_HERE__/*"
25 |     }
26 |   ]
27 | }
28 | 


--------------------------------------------------------------------------------
/S3/Resizing-Images/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import os
 2 | import tempfile
 3 | 
 4 | import boto3
 5 | from PIL import Image
 6 | 
 7 | s3 = boto3.client('s3')
 8 | DEST_BUCKET = os.environ['DEST_BUCKET']
 9 | SIZE = 128, 128
10 | 
11 | 
12 | def lambda_handler(event, context):
13 | 
14 |     for record in event['Records']:
15 |         source_bucket = record['s3']['bucket']['name']
16 |         key = record['s3']['object']['key']
17 |         thumb = 'thumb-' + key
18 |         with tempfile.TemporaryDirectory() as tmpdir:
19 |             download_path = os.path.join(tmpdir, key)
20 |             upload_path = os.path.join(tmpdir, thumb)
21 |             s3.download_file(source_bucket, key, download_path)
22 |             generate_thumbnail(download_path, upload_path)
23 |             s3.upload_file(upload_path, DEST_BUCKET, thumb)
24 | 
25 |         print('Thumbnail image saved at {}/{}'.format(DEST_BUCKET, thumb))
26 | 
27 | 
28 | def generate_thumbnail(source_path, dest_path):
29 |     print('Generating thumbnail from:', source_path)
30 |     with Image.open(source_path) as image:
31 |         image.thumbnail(SIZE)
32 |         image.save(dest_path)
33 | 


--------------------------------------------------------------------------------
/S3/Transcribing-Audio/InauguralAddress-1981.mp3:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/linuxacademy/content-lambda-boto3/c037e4a1583c32f1ae81bb16d3ce880a1292df02/S3/Transcribing-Audio/InauguralAddress-1981.mp3


--------------------------------------------------------------------------------
/S3/Transcribing-Audio/ParseTranscription/iam.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "s3:PutObject"
16 |       ],
17 |       "Resource": "arn:aws:s3:::__YOUR_BUCKET_NAME_HERE__/*"
18 |     },
19 |     {
20 |       "Effect": "Allow",
21 |       "Action": [
22 |         "transcribe:*"
23 |       ],
24 |       "Resource": "*"
25 |     }
26 |   ]
27 | }
28 | 


--------------------------------------------------------------------------------
/S3/Transcribing-Audio/ParseTranscription/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | import os
 3 | import urllib.request
 4 | 
 5 | import boto3
 6 | 
 7 | 
 8 | BUCKET_NAME = os.environ['BUCKET_NAME']
 9 | 
10 | s3 = boto3.resource('s3')
11 | transcribe = boto3.client('transcribe')
12 | 
13 | 
14 | def lambda_handler(event, context):
15 |     job_name = event['detail']['TranscriptionJobName']
16 |     job = transcribe.get_transcription_job(TranscriptionJobName=job_name)
17 |     uri = job['TranscriptionJob']['Transcript']['TranscriptFileUri']
18 |     print(uri)
19 | 
20 |     content = urllib.request.urlopen(uri).read().decode('UTF-8')
21 | 
22 |     print(json.dumps(content))
23 | 
24 |     data = json.loads(content)
25 | 
26 |     text = data['results']['transcripts'][0]['transcript']
27 | 
28 |     object = s3.Object(BUCKET_NAME, job_name + '-asrOutput.txt')
29 |     object.put(Body=text)
30 | 


--------------------------------------------------------------------------------
/S3/Transcribing-Audio/README.md:
--------------------------------------------------------------------------------
1 | # Transcribing Audio
2 | 
3 | To extract the raw text transcript from the JSON file at the command line:
4 | 
5 | ```sh
6 | jq '.results.transcripts[0].transcript' -r asrOutput.json > transcript.txt
7 | ```
8 | 
9 | More info on `jq` is [here](https://stedolan.github.io/jq/).


--------------------------------------------------------------------------------
/S3/Transcribing-Audio/TranscribeAudio/iam.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "s3:GetObject"
16 |       ],
17 |       "Resource": "arn:aws:s3:::__YOUR_BUCKET_NAME_HERE__/*"
18 |     },
19 |     {
20 |       "Effect": "Allow",
21 |       "Action": [
22 |         "transcribe:StartTranscriptionJob"
23 |       ],
24 |       "Resource": "*"
25 |     }
26 |   ]
27 | }
28 | 


--------------------------------------------------------------------------------
/S3/Transcribing-Audio/TranscribeAudio/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import boto3
 2 | 
 3 | s3 = boto3.client('s3')
 4 | transcribe = boto3.client('transcribe')
 5 | 
 6 | 
 7 | def lambda_handler(event, context):
 8 | 
 9 |     for record in event['Records']:
10 |         source_bucket = record['s3']['bucket']['name']
11 |         key = record['s3']['object']['key']
12 |         object_url = "https://s3.amazonaws.com/{0}/{1}".format(
13 |             source_bucket, key)
14 |         response = transcribe.start_transcription_job(
15 |             TranscriptionJobName='MyTranscriptionJob',
16 |             Media={'MediaFileUri': object_url},
17 |             MediaFormat='mp3',
18 |             LanguageCode='en-US'
19 |         )
20 |         print(response)
21 | 


--------------------------------------------------------------------------------
/SQS/Creating-Queue-Using-Cross-Account-Permissions/.gitignore:
--------------------------------------------------------------------------------
1 | output.txt


--------------------------------------------------------------------------------
/SQS/Creating-Queue-Using-Cross-Account-Permissions/README.md:
--------------------------------------------------------------------------------
 1 | # Creating a Queue Using Cross-Account Permissions
 2 | 
 3 | SQS does not allow API calls such as [`CreateQueue`](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/APIReference/API_CreateQueue.html) using [cross-account permissions](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-authentication-and-access-control.html#access-control). A workaround is to create and invoke a Lambda function in another account, in order to call that API.)
 4 | 
 5 | ## Create AWS CLI profiles
 6 | 
 7 | Development account admin
 8 | 
 9 | ```sh
10 | aws configure --profile devadmin
11 | ```
12 | 
13 | Production account admin
14 | 
15 | ```sh
16 | aws configure --profile prodadmin
17 | ```
18 | 
19 | ## Create Lambda function in production account
20 | 
21 | Function name: `CreateSQSQueue`
22 | 
23 | See [`lambda_function.py`](lambda_function.py) and assign role [`lambda_execution_role.json`](lambda_execution_role.json).
24 | 
25 | ## Assign permissions to Lambda function
26 | 
27 | Add permissions to the production Lambda function allowing it to be invoked by the development account user:
28 | 
29 | ```sh
30 | aws lambda add-permission \
31 | --function-name CreateSQSQueue \
32 | --statement-id DevAccountAccess \
33 | --action 'lambda:InvokeFunction' \
34 | --principal 'arn:aws:iam::__DEVELOPMENT_ACCOUNT_NUMBER__:user/devadmin' \
35 | --region us-east-2 \
36 | --profile prodadmin
37 | ```
38 | 
39 | To view the policy:
40 | 
41 | ```sh
42 | aws lambda get-policy \
43 | --function-name CreateSQSQueue \
44 | --region us-east-2 \
45 | --profile prodadmin
46 | ```
47 | 
48 | To remove the policy:
49 | 
50 | ```sh
51 | aws lambda remove-permission \
52 | --function-name CreateSQSQueue \
53 | --statement-id DevAccountAccess \
54 | --region us-east-2 \
55 | --profile prodadmin
56 | ```
57 | 
58 | ## Invoke the production Lambda function from the development account
59 | 
60 | ```sh
61 | aws lambda invoke \
62 | --function-name '__LAMBDA_FUNCTION_ARN__' \
63 | --payload '{"QueueName": "MyQueue" }' \
64 | --invocation-type RequestResponse \
65 | --profile devadmin \
66 | --region us-east-2 \
67 | output.txt
68 | ```


--------------------------------------------------------------------------------
/SQS/Creating-Queue-Using-Cross-Account-Permissions/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Action": [
14 |         "sqs:CreateQueue"
15 |       ],
16 |       "Effect": "Allow",
17 |       "Resource": "*"
18 |     }
19 |   ]
20 | }
21 | 


--------------------------------------------------------------------------------
/SQS/Creating-Queue-Using-Cross-Account-Permissions/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import boto3
 2 | 
 3 | sqs = boto3.resource('sqs')
 4 | 
 5 | 
 6 | def lambda_handler(event, context):
 7 | 
 8 |     queue = sqs.create_queue(QueueName=event['QueueName'])
 9 |     print('Queue URL', queue.url)
10 | 


--------------------------------------------------------------------------------
/SQS/Triggering-Lambda-from-SQS/README.md:
--------------------------------------------------------------------------------
 1 | # Triggering Lambda from SQS
 2 | 
 3 | ## Create DynamoDB Table
 4 | 
 5 | ```sh
 6 | aws dynamodb create-table --table-name Message \
 7 |   --attribute-definitions AttributeName=MessageId,AttributeType=S \
 8 |   --key-schema AttributeName=MessageId,KeyType=HASH \
 9 |   --billing-mode=PAY_PER_REQUEST
10 | ```
11 | 
12 | ## Create SQS Queue
13 | 
14 | ```sh
15 | aws sqs create-queue --queue-name Messages
16 | ```
17 | 
18 | ## Sending messages to SQS
19 | 
20 | Run the provided script `send_message.py` to send messages to SQS
21 | 
22 | **Example**: Send a message containing random text to the `Messages` queue every 0.1 second (10 messages per second):
23 | 
24 | `./send_message.py -q Messages -i 0.1`
25 | 
26 | Press `Ctrl+C` to quit.
27 | 


--------------------------------------------------------------------------------
/SQS/Triggering-Lambda-from-SQS/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Action": [
14 |         "dynamodb:PutItem"
15 |       ],
16 |       "Effect": "Allow",
17 |       "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Message"
18 |     },
19 |     {
20 |       "Action": [
21 |         "sqs:Describe*",
22 |         "sqs:Get*",
23 |         "sqs:List*",
24 |         "sqs:DeleteMessage",
25 |         "sqs:ReceiveMessage"
26 |       ],
27 |       "Effect": "Allow",
28 |       "Resource": "arn:aws:sqs:us-east-1:123456789012:Messages"
29 |     }
30 |   ]
31 | }
32 | 


--------------------------------------------------------------------------------
/SQS/Triggering-Lambda-from-SQS/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | import os
 3 | from datetime import datetime
 4 | 
 5 | import boto3
 6 | 
 7 | QUEUE_NAME = os.environ['QUEUE_NAME']
 8 | MAX_QUEUE_MESSAGES = os.environ['MAX_QUEUE_MESSAGES']
 9 | DYNAMODB_TABLE = os.environ['DYNAMODB_TABLE']
10 | 
11 | sqs = boto3.resource('sqs')
12 | dynamodb = boto3.resource('dynamodb')
13 | 
14 | 
15 | def lambda_handler(event, context):
16 | 
17 |     # Receive messages from SQS queue
18 |     queue = sqs.get_queue_by_name(QueueName=QUEUE_NAME)
19 | 
20 |     print("ApproximateNumberOfMessages:",
21 |           queue.attributes.get('ApproximateNumberOfMessages'))
22 | 
23 |     for message in queue.receive_messages(
24 |             MaxNumberOfMessages=int(MAX_QUEUE_MESSAGES)):
25 | 
26 |         print(message)
27 | 
28 |         # Write message to DynamoDB
29 |         table = dynamodb.Table(DYNAMODB_TABLE)
30 | 
31 |         response = table.put_item(
32 |             Item={
33 |                 'MessageId': message.message_id,
34 |                 'Body': message.body,
35 |                 'Timestamp': datetime.now().isoformat()
36 |             }
37 |         )
38 |         print("Wrote message to DynamoDB:", json.dumps(response))
39 | 
40 |         # Delete SQS message
41 |         message.delete()
42 |         print("Deleted message:", message.message_id)
43 | 


--------------------------------------------------------------------------------
/SQS/Triggering-Lambda-from-SQS/send_message.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python3.7
 2 | # -*- coding: utf-8 -*-
 3 | import argparse
 4 | import logging
 5 | import sys
 6 | from time import sleep
 7 | 
 8 | import boto3
 9 | from faker import Faker
10 | 
11 | parser = argparse.ArgumentParser()
12 | parser.add_argument("--queue-name", "-q", required=True,
13 |                     help="SQS queue name")
14 | parser.add_argument("--interval", "-i", required=True,
15 |                     help="timer interval", type=float)
16 | parser.add_argument("--message", "-m", help="message to send")
17 | parser.add_argument("--log", "-l", default="INFO",
18 |                     help="logging level")
19 | args = parser.parse_args()
20 | 
21 | if args.log:
22 |     logging.basicConfig(
23 |         format='[%(levelname)s] %(message)s', level=args.log)
24 | 
25 | else:
26 |     parser.print_help(sys.stderr)
27 | 
28 | sqs = boto3.client('sqs')
29 | 
30 | response = sqs.get_queue_url(QueueName=args.queue_name)
31 | 
32 | queue_url = response['QueueUrl']
33 | 
34 | logging.info(queue_url)
35 | 
36 | while True:
37 |     message = args.message
38 |     if not args.message:
39 |         fake = Faker()
40 |         message = fake.text()
41 | 
42 |     logging.info('Sending message: ' + message)
43 | 
44 |     response = sqs.send_message(
45 |         QueueUrl=queue_url, MessageBody=message)
46 | 
47 |     logging.info('MessageId: ' + response['MessageId'])
48 |     sleep(args.interval)
49 | 


--------------------------------------------------------------------------------
/Scheduling-DynamoDB-Backups/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Action": [
14 |         "dynamodb:CreateBackup",
15 |         "dynamodb:DeleteBackup",
16 |         "dynamodb:ListBackups"
17 |       ],
18 |       "Effect": "Allow",
19 |       "Resource": "*"
20 |     }
21 |   ]
22 | }
23 | 


--------------------------------------------------------------------------------
/Scheduling-DynamoDB-Backups/lambda_function.py:
--------------------------------------------------------------------------------
 1 | from datetime import datetime
 2 | 
 3 | import boto3
 4 | 
 5 | MAX_BACKUPS = 3  # maximum number of backups to retain
 6 | 
 7 | dynamo = boto3.client('dynamodb')
 8 | 
 9 | 
10 | def lambda_handler(event, context):
11 |     if 'TableName' not in event:
12 |         raise Exception("No table name specified.")
13 |     table_name = event['TableName']
14 | 
15 |     create_backup(table_name)
16 |     delete_old_backups(table_name)
17 | 
18 | 
19 | def create_backup(table_name):
20 |     print("Backing up table:", table_name)
21 |     backup_name = table_name + '-' + datetime.now().strftime('%Y%m%d%H%M%S')
22 | 
23 |     response = dynamo.create_backup(
24 |         TableName=table_name, BackupName=backup_name)
25 | 
26 |     print(f"Created backup {response['BackupDetails']['BackupName']}")
27 | 
28 | 
29 | def delete_old_backups(table_name):
30 |     print("Deleting old backups for table:", table_name)
31 | 
32 |     backups = dynamo.list_backups(TableName=table_name)
33 | 
34 |     backup_count = len(backups['BackupSummaries'])
35 |     print('Total backup count:', backup_count)
36 | 
37 |     if backup_count <= MAX_BACKUPS:
38 |         print("No stale backups. Exiting.")
39 |         return
40 | 
41 |     # Backups in date descending order (newest to oldest)
42 |     sorted_list = sorted(backups['BackupSummaries'],
43 |                          key=lambda k: k['BackupCreationDateTime'], reverse=True)
44 | 
45 |     old_backups = sorted_list[MAX_BACKUPS:]
46 | 
47 |     print(f'Old backups: {old_backups}')
48 | 
49 |     for backup in old_backups:
50 |         arn = backup['BackupArn']
51 |         print("ARN to delete: " + arn)
52 |         deleted_arn = dynamo.delete_backup(BackupArn=arn)
53 |         backup_name = deleted_arn['BackupDescription']['BackupDetails']['BackupName']
54 |         status = deleted_arn['BackupDescription']['BackupDetails']['BackupStatus']
55 |         print(f'BackupName: {backup_name}, Status: {status}')
56 | 
57 |     return
58 | 
59 | 
60 | if __name__ == "__main__":
61 |     event = {"TableName": "Movies"}
62 |     lambda_handler(event, {})
63 | 


--------------------------------------------------------------------------------
/Security/Automating-Resource-Tagging/README.md:
--------------------------------------------------------------------------------
 1 | # Automating Resource Tagging
 2 | 
 3 | Automate the tagging of EC2 instances and their corresponding resources using a Lambda function with CloudTrail and CloudWatch. The function will ensure that users can work only on those resources that they have created based on resource tags. This is enforced via an IAM policy.
 4 | 
 5 | ## Create the IAM Policy
 6 | 
 7 | This policy allows Start/Stop/Reboot/Terminate for EC2 instances where the tag 'Owner' matches the current requester's user ID.
 8 | 
 9 | ```sh
10 | aws iam create-policy \
11 | --policy-name TagBasedEC2RestrictionsPolicy \
12 | --policy-document file://TagBasedEC2RestrictionsPolicy.json
13 | ```
14 | 
15 | Note the policy ARN.
16 | 
17 | ## Attach IAM Policy to Group
18 | 
19 | Create a group called **developers**:
20 | 
21 | ```sh
22 | aws iam create-group --group-name developers
23 | ```
24 | 
25 | Attach the policy to the group:
26 | 
27 | ```sh
28 | aws iam attach-group-policy \
29 | --policy-arn arn:aws:iam::123456789012:policy/TagBasedEC2RestrictionsPolicy \
30 | --group-name developers
31 | ```
32 | 
33 | ## Create IAM Role for Lambda Function
34 | 
35 | Create IAM role:
36 | 
37 | ```sh
38 | aws iam create-role \
39 | --role-name LambdaAllowTaggingEC2Role \
40 | --assume-role-policy-document file://trust_policy.json
41 | ```
42 | 
43 | Define the access policy:
44 | 
45 | ```sh
46 | aws iam put-role-policy \
47 | --role-name LambdaAllowTaggingEC2Role \
48 | --policy-name LambdaAllowTaggingEC2Policy \
49 | --policy-document file://access_policy.json
50 | ```
51 | 
52 | ## Create Lambda Function
53 | 
54 | Create function `TagEC2Resources`.
55 | 
56 | ## Create CloudWatch Rule
57 | 
58 | Create rule:
59 | 
60 | ```sh
61 | aws events put-rule \
62 | --name AutoTagResources \
63 | --event-pattern file://event_pattern.json
64 | ```
65 | 
66 | Set Lambda function as the target:
67 | 
68 | ```sh
69 | aws events put-targets \
70 | --rule AutoTagResources \
71 | --targets Id=1,Arn=arn:aws:lambda:us-east-2:123456789012:function:TagEC2Resources
72 | ```
73 | 
74 | ## Create EC2 Instance as User
75 | 
76 | Create an EC2 instance as an administrative/root user. Observe the `Owner` tag.
77 | 
78 | Try working with EC2 instances owned by other users or untagged, and observe access denied errors.
79 | 
80 | ## What next?
81 | 
82 | Now that you know you can tag resources with a Lambda function in response to events, you can apply the same logic to other resources such as RDS databases or S3 buckets. With resource groups, each user can focus on just their resources, and the IAM policy provided in this lesson assures that no unauthorized action is possible on someone else's instance.
83 | 
84 | Additionally, tags are useful in custom billing reports to project costs and determine how much money each individual owner is spending. You can activate the `Owner` tag in the billing console from the Cost Allocation Tags of your billing console to include it in your detailed billing reports. For more information, see [Applying Tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/billing-what-is.html).


--------------------------------------------------------------------------------
/Security/Automating-Resource-Tagging/TagBasedEC2RestrictionsPolicy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Sid": "LaunchEC2Instances",
 5 |       "Effect": "Allow",
 6 |       "Action": [
 7 |         "ec2:Describe*",
 8 |         "ec2:RunInstances",
 9 |         "ec2:CreateSecurityGroup",
10 |         "ec2:AuthorizeSecurityGroupEgress",
11 |         "ec2:AuthorizeSecurityGroupIngress",
12 |         "ec2:DeleteSecurityGroup",
13 |         "ec2:RevokeSecurityGroupEgress",
14 |         "ec2:RevokeSecurityGroupIngress"
15 |       ],
16 |       "Resource": [
17 |         "*"
18 |       ]
19 |     },
20 |     {
21 |       "Sid": "AllowActionsIfYouAreTheOwner",
22 |       "Effect": "Allow",
23 |       "Action": [
24 |         "ec2:StopInstances",
25 |         "ec2:StartInstances",
26 |         "ec2:RebootInstances",
27 |         "ec2:TerminateInstances",
28 |         "ec2:AttachVolume",
29 |         "ec2:DetachVolume",
30 |         "ec2:DeleteVolume"
31 |       ],
32 |       "Resource": [
33 |         "*"
34 |       ],
35 |       "Condition": {
36 |         "StringEquals": {
37 |           "ec2:ResourceTag/Owner": "${aws:username}"
38 |         }
39 |       }
40 |     }
41 |   ]
42 | }
43 | 


--------------------------------------------------------------------------------
/Security/Automating-Resource-Tagging/access_policy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |     "Effect": "Allow",
 5 |     "Action": [
 6 |       "logs:CreateLogGroup",
 7 |       "logs:CreateLogStream",
 8 |       "logs:PutLogEvents"
 9 |     ],
10 |     "Resource": "arn:aws:logs:*:*:*"
11 |   },
12 |   {
13 |     "Effect": "Allow",
14 |     "Action": [
15 |       "ec2:CreateTags",
16 |       "ec2:Describe*"
17 |     ],
18 |     "Resource": "*"
19 |   }]
20 | }
21 | 


--------------------------------------------------------------------------------
/Security/Automating-Resource-Tagging/event_pattern.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "source": [
 3 |     "aws.ec2"
 4 |   ],
 5 |   "detail-type": [
 6 |     "AWS API Call via CloudTrail"
 7 |   ],
 8 |   "detail": {
 9 |     "eventSource": [
10 |       "ec2.amazonaws.com"
11 |     ],
12 |     "eventName": [
13 |       "CreateImage",
14 |       "CreateSnapshot",
15 |       "CreateVolume",
16 |       "RunInstances"
17 |     ]
18 |   }
19 | }
20 | 


--------------------------------------------------------------------------------
/Security/Automating-Resource-Tagging/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | 
 3 | import boto3
 4 | 
 5 | ec2 = boto3.resource('ec2')
 6 | 
 7 | 
 8 | def lambda_handler(event, context):
 9 |     print('Event: ' + str(event))
10 |     print(json.dumps(event))
11 | 
12 |     # Contain all the identifiers of EC2 resources found in a given event.
13 |     # IDs could be EC2 instances, EBS volumes, EBS snapshots, ENIs, or AMIs.
14 |     ids = []
15 | 
16 |     try:
17 |         region = event['region']
18 |         detail = event['detail']
19 |         eventname = detail['eventName']
20 |         arn = detail['userIdentity']['arn']
21 |         principal = detail['userIdentity']['principalId']
22 |         user_type = detail['userIdentity']['type']
23 | 
24 |         if user_type == 'IAMUser':
25 |             user = detail['userIdentity']['userName']
26 |         else:
27 |             # Could be a web federated user or assumed roles
28 |             user = principal.split(': ')[1]
29 | 
30 |         print('arn: ' + arn)
31 |         print('principalId: ' + principal)
32 |         print('region: ' + region)
33 |         print('eventName: ' + eventname)
34 |         print('detail: ' + str(detail))
35 |         print('user: ' + user)
36 | 
37 |         if not detail['responseElements']:
38 |             print('No responseElements found')
39 |             if detail['errorCode']:
40 |                 print('errorCode: ' + detail['errorCode'])
41 |             if detail['errorMessage']:
42 |                 print('errorMessage: ' + detail['errorMessage'])
43 |             return False
44 | 
45 |         if eventname == 'CreateVolume':
46 |             ids.append(detail['responseElements']['volumeId'])
47 |             print(ids)
48 | 
49 |         elif eventname == 'RunInstances':
50 |             items = detail['responseElements']['instancesSet']['items']
51 |             for item in items:
52 |                 ids.append(item['instanceId'])
53 |             print(ids)
54 |             print('number of instances: ' + str(len(ids)))
55 | 
56 |             base = ec2.instances.filter(InstanceIds=ids)
57 | 
58 |             # loop through the instances
59 |             for instance in base:
60 |                 for vol in instance.volumes.all():
61 |                     ids.append(vol.id)
62 |                 for eni in instance.network_interfaces:
63 |                     ids.append(eni.id)
64 | 
65 |         elif eventname == 'CreateImage':
66 |             ids.append(detail['responseElements']['imageId'])
67 |             print(ids)
68 | 
69 |         elif eventname == 'CreateSnapshot':
70 |             ids.append(detail['responseElements']['snapshotId'])
71 |             print(ids)
72 |         else:
73 |             print('Not supported action')
74 | 
75 |         if ids:
76 |             for resourceid in ids:
77 |                 print('Tagging resource ' + resourceid)
78 |             ec2.create_tags(Resources=ids, Tags=[
79 |                 {'Key': 'Owner', 'Value': user},
80 |                 {'Key': 'PrincipalId', 'Value': principal}])
81 | 
82 |         print('Done tagging.')
83 | 
84 |         return True
85 |     except Exception as e:
86 |         print('Something went wrong: ' + str(e))
87 |         return False
88 | 


--------------------------------------------------------------------------------
/Security/Automating-Resource-Tagging/trust_policy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |     "Effect": "Allow",
 5 |     "Principal": {
 6 |       "Service": "lambda.amazonaws.com"
 7 |     },
 8 |     "Action": "sts:AssumeRole"
 9 |   }]
10 | }
11 | 


--------------------------------------------------------------------------------
/Security/Enabling-VPC-Flow-Logs/README.md:
--------------------------------------------------------------------------------
 1 | # Enabling VPC Flow Logs
 2 | 
 3 | [VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) enable you to capture information about the IP traffic going to and from network interfaces in your VPC.
 4 | 
 5 | By default, VPC Flow Logs are not enabled. However, in our scenario, let's say you have a policy that requires they be enabled for any new VPC that gets created in your account.
 6 | 
 7 | In this lesson, we will automate the creation of VPC Flow Logs whenever a new VPC is created.
 8 | 
 9 | - `lambda_function.py` creates VPC Flow Logs for the VPC ID in the event
10 | - `event-pattern.json` is the CloudWatch Rule event pattern for monitoring the `CreateVpc` API call.
11 | - `test-event.json` is a sample CloudTrail event that can be used with the Lambda function, as it contains the VPC ID
12 | 
13 | ## Create IAM role with permission to log to CloudWatch Logs
14 | 
15 | Allow the VPC Flow Logs service to assume this role:
16 | 
17 | ```sh
18 | aws iam create-role --role-name VPCFlowLogsRole --assume-role-policy-document file://trust-policy.json
19 | ```
20 | 
21 | **Note the ARN for `VPCFlowLogsRole`.**
22 | 
23 | Example: `arn:aws:iam::123456789012:role/VPCFlowLogsRole`
24 | 
25 | Grant this role permission to CloudWatch Logs:
26 | 
27 | ```sh
28 | aws iam put-role-policy --role-name VPCFlowLogsRole --policy-name VPCFlowLogsPolicy --policy-document file://vpc-flow-logs-iam-role.json
29 | ```
30 | 
31 | ## Create the Lambda Function
32 | 
33 | Name: `EnableVPCFlowLogs`  
34 | Runtime: `Python 3.7`  
35 | Role: `Create a custom role` (use `lambda_execution_role.json`)  
36 | Code: `lambda_function.py`
37 | 
38 | ## Create a CloudWatch Event Rule to Trigger Lambda
39 | 
40 | Select **Event Pattern**.  
41 | Service Name: `EC2`  
42 | Event Type: `AWS API Call via CloudTrail`  
43 | Specific operation(s): `CreateVpc`
44 | 
45 | Event Pattern:
46 | 
47 | ```json
48 | {
49 |     "source": [
50 |         "aws.ec2"
51 |     ],
52 |     "detail-type": [
53 |         "AWS API Call via CloudTrail"
54 |     ],
55 |     "detail": {
56 |         "eventSource": [
57 |             "ec2.amazonaws.com"
58 |         ],
59 |         "eventName": [
60 |             "CreateVpc"
61 |         ]
62 |     }
63 | }
64 | ```
65 | 
66 | **Add target** and select the `EnableVpcFlowLogs` Lambda function.
67 | 
68 | Click **Configure details**.
69 | 
70 | ## Create a new VPC
71 | 
72 | ```sh
73 | aws ec2 create-vpc --cidr-block 172.20.0.0/16 --region us-east-2`
74 | ```
75 | 
76 | Wait up to a minute for the CloudWatch rule to invoke the Lambda function.
77 | 


--------------------------------------------------------------------------------
/Security/Enabling-VPC-Flow-Logs/event-pattern.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "source": [
 3 |       "aws.ec2"
 4 |   ],
 5 |   "detail-type": [
 6 |       "AWS API Call via CloudTrail"
 7 |   ],
 8 |   "detail": {
 9 |       "eventSource": [
10 |           "ec2.amazonaws.com"
11 |       ],
12 |       "eventName": [
13 |           "CreateVpc"
14 |       ]
15 |   }
16 | }
17 | 


--------------------------------------------------------------------------------
/Security/Enabling-VPC-Flow-Logs/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "ec2:CreateFlowLogs",
16 |         "ec2:DescribeFlowLogs",
17 |         "iam:PassRole"
18 |       ],
19 |       "Resource": "*"
20 |     }
21 |   ]
22 | }
23 | 


--------------------------------------------------------------------------------
/Security/Enabling-VPC-Flow-Logs/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import os
 2 | 
 3 | import boto3
 4 | from botocore.exceptions import ClientError
 5 | 
 6 | ROLE_ARN = os.environ['ROLE_ARN']
 7 | 
 8 | ec2 = boto3.client('ec2')
 9 | logs = boto3.client('logs')
10 | 
11 | 
12 | def lambda_handler(event, context):
13 | 
14 |     try:
15 |         # Extract the VPC ID from the event
16 |         vpc_id = event['detail']['responseElements']['vpc']['vpcId']
17 | 
18 |         flow_logs_group = 'VPCFlowLogs-' + vpc_id
19 | 
20 |         print('VPC: ' + vpc_id)
21 | 
22 |         try:
23 |             response = logs.create_log_group(
24 |                 logGroupName=flow_logs_group)
25 |         except ClientError:
26 |             print(f"Log group '{flow_logs_group}' already exists.")
27 | 
28 |         # Get Flow Logs status
29 |         response = ec2.describe_flow_logs(
30 |             Filter=[
31 |                 {
32 |                     'Name': 'resource-id',
33 |                     'Values': [
34 |                         vpc_id,
35 |                     ]
36 |                 },
37 |             ],
38 |         )
39 | 
40 |         if len(response['FlowLogs']) > 0:
41 |             print('VPC Flow Logs are ENABLED')
42 |         else:
43 |             print('VPC Flow Logs are DISABLED. Enabling...')
44 | 
45 |             response = ec2.create_flow_logs(
46 |                 ResourceIds=[vpc_id],
47 |                 ResourceType='VPC',
48 |                 TrafficType='ALL',
49 |                 LogGroupName=flow_logs_group,
50 |                 DeliverLogsPermissionArn=ROLE_ARN,
51 |             )
52 | 
53 |             print('Created Flow Logs:' + response['FlowLogIds'][0])
54 | 
55 |     except Exception as e:
56 |         print('Error - reason "%s"' % str(e))
57 | 


--------------------------------------------------------------------------------
/Security/Enabling-VPC-Flow-Logs/test-event.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "version": "0",
 3 |   "id": "e3f9c65c-6b72-3ce4-b1f3-20494cbc87e0",
 4 |   "detail-type": "AWS API Call via CloudTrail",
 5 |   "source": "aws.ec2",
 6 |   "account": "111111111111",
 7 |   "time": "2019-02-25T15:33:07Z",
 8 |   "region": "us-east-1",
 9 |   "resources": [],
10 |   "detail": {
11 |     "eventVersion": "1.05",
12 |     "userIdentity": {
13 |       "type": "Root",
14 |       "principalId": "111111111111",
15 |       "arn": "arn:aws:iam::111111111111:root",
16 |       "accountId": "111111111111",
17 |       "accessKeyId": "...",
18 |       "sessionContext": {
19 |         "attributes": {
20 |           "mfaAuthenticated": "false",
21 |           "creationDate": "2019-02-25T14:13:11Z"
22 |         }
23 |       },
24 |       "invokedBy": "signin.amazonaws.com"
25 |     },
26 |     "eventTime": "2019-02-25T15:33:07Z",
27 |     "eventSource": "ec2.amazonaws.com",
28 |     "eventName": "CreateVpc",
29 |     "awsRegion": "us-east-1",
30 |     "sourceIPAddress": "73.125.25.100",
31 |     "userAgent": "signin.amazonaws.com",
32 |     "requestParameters": {
33 |       "cidrBlock": "10.0.0.0/16",
34 |       "instanceTenancy": "default"
35 |     },
36 |     "responseElements": {
37 |       "requestId": "ee1f6203-3e40-4669-a50b-17c52abc69b7",
38 |       "vpc": {
39 |         "vpcId": "vpc-0a71e831cb5152c43",
40 |         "state": "pending",
41 |         "cidrBlock": "10.0.0.0/16",
42 |         "cidrBlockAssociationSet": {
43 |           "items": [
44 |             {
45 |               "cidrBlock": "10.0.0.0/16",
46 |               "associationId": "vpc-cidr-assoc-07ba205e048b7798a",
47 |               "cidrBlockState": {
48 |                 "state": "associated"
49 |               }
50 |             }
51 |           ]
52 |         },
53 |         "ipv6CidrBlockAssociationSet": {},
54 |         "dhcpOptionsId": "dopt-c0bf6fbb",
55 |         "instanceTenancy": "default",
56 |         "tagSet": {},
57 |         "isDefault": false
58 |       }
59 |     },
60 |     "requestID": "ee1f6203-3e40-4669-a50b-17c52abc69b7",
61 |     "eventID": "9be08716-256d-4286-9378-8137d661109b",
62 |     "eventType": "AwsApiCall"
63 |   }
64 | }
65 | 


--------------------------------------------------------------------------------
/Security/Enabling-VPC-Flow-Logs/trust-policy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |     "Effect": "Allow",
 5 |     "Principal": {
 6 |       "Service": [
 7 |         "vpc-flow-logs.amazonaws.com"
 8 |       ]
 9 |     },
10 |     "Action": "sts:AssumeRole"
11 |   }]
12 | }
13 | 


--------------------------------------------------------------------------------
/Security/Enabling-VPC-Flow-Logs/vpc-flow-logs-iam-role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |     "Action": [
 5 |       "logs:CreateLogGroup",
 6 |       "logs:CreateLogStream",
 7 |       "logs:PutLogEvents",
 8 |       "logs:DescribeLogGroups",
 9 |       "logs:DescribeLogStreams"
10 |     ],
11 |     "Resource": "*",
12 |     "Effect": "Allow"
13 |   }]
14 | }
15 | 


--------------------------------------------------------------------------------
/Security/Making-Public-S3-Objects-Private/.gitignore:
--------------------------------------------------------------------------------
1 | *.zip


--------------------------------------------------------------------------------
/Security/Making-Public-S3-Objects-Private/README.md:
--------------------------------------------------------------------------------
  1 | # Making Public S3 Objects Private
  2 | 
  3 | In this lesson, you'll learn how to detect unintended public access permissions in the ACL of an S3 object and how to revoke them automatically using Lambda, boto3, and CloudWatch Events.
  4 | 
  5 | ## Create an S3 bucket
  6 | 
  7 | ```sh
  8 | aws s3 mb s3://123456789012-everything-must-be-private
  9 | aws s3 mb s3://123456789012-bucket-for-my-object-level-s3-trail
 10 | ```
 11 | 
 12 | Apply bucket policy:
 13 | 
 14 | ```sh
 15 | aws s3api put-bucket-policy \
 16 | --bucket 123456789012-bucket-for-my-object-level-s3-trail \
 17 | --policy file://bucket_policy.json
 18 | ```
 19 | 
 20 | ## Create a CloudTrail trail and start logging
 21 | 
 22 | ```sh
 23 | aws cloudtrail create-trail \
 24 | --name my-object-level-s3-trail \
 25 | --s3-bucket-name 123456789012-bucket-for-my-object-level-s3-trail
 26 | 
 27 | aws cloudtrail start-logging --name my-object-level-s3-trail
 28 | ```
 29 | 
 30 | Create event selectors:
 31 | 
 32 | ```sh
 33 | aws cloudtrail put-event-selectors \
 34 | --trail-name my-object-level-s3-trail \
 35 | --event-selectors file://event_selectors.json
 36 | ```
 37 | 
 38 | ## Create IAM execution role for Lambda
 39 | 
 40 | Create IAM role:
 41 | 
 42 | ```sh
 43 | aws iam create-role \
 44 | --role-name AllowLogsAndS3ACL \
 45 | --assume-role-policy-document file://trust_policy.json
 46 | ```
 47 | 
 48 | Define the access policy:
 49 | 
 50 | ```sh
 51 | aws iam put-role-policy \
 52 | --role-name AllowLogsAndS3ACL \
 53 | --policy-name AllowLogsAndS3ACL \
 54 | --policy-document file://access_policy.json
 55 | ```
 56 | 
 57 | ## Create Lambda function
 58 | 
 59 | For a `PutObjectAcl` API Event, the function gets the bucket and key name from the event. If the object is not private, then it makes the object private by making a `PutObjectAcl` call.
 60 | 
 61 | Zip Lambda function:
 62 | 
 63 | ```sh
 64 | zip -r9 RemediateObjectACL.zip lambda_function.py
 65 | ```
 66 | 
 67 | Create Lambda function:
 68 | 
 69 | ```sh
 70 | aws lambda create-function \
 71 | --function-name RemediateObjectACL \
 72 | --zip-file fileb://RemediateObjectACL.zip \
 73 | --role arn:aws:iam::123456789012:role/AllowLogsAndS3ACL \
 74 | --handler lambda_function.lambda_handler \
 75 | --runtime python3.7 \
 76 | --environment Variables={BUCKET_NAME=123456789012-everything-must-be-private}
 77 | ```
 78 | 
 79 | Allow CloudWatch Events to invoke Lambda:
 80 | 
 81 | ```sh
 82 | aws lambda add-permission \
 83 | --function-name RemediateObjectACL \
 84 | --statement-id AllowCloudWatchEventsToInvoke \
 85 | --action 'lambda:InvokeFunction' \
 86 | --principal events.amazonaws.com \
 87 | --source-arn arn:aws:events:us-east-2:123456789012:rule/S3ObjectACLAutoRemediate
 88 | ```
 89 | 
 90 | ## Create CloudWatch Events rule
 91 | 
 92 | Create rule:
 93 | 
 94 | ```sh
 95 | aws events put-rule \
 96 | --name S3ObjectACLAutoRemediate \
 97 | --event-pattern file://event_pattern.json
 98 | ```
 99 | 
100 | Set Lambda function as the target:
101 | 
102 | ```sh
103 | aws events put-targets \
104 | --rule S3ObjectACLAutoRemediate \
105 | --targets Id=1,Arn=arn:aws:lambda:us-east-2:123456789012:function:RemediateObjectACL
106 | ```
107 | 
108 | ## Testing
109 | 
110 | ```sh
111 | aws s3api put-object \
112 | --bucket 123456789012-everything-must-be-private \
113 | --key MyPersonalInfo
114 | 
115 | aws s3api get-object-acl \
116 | --bucket 123456789012-everything-must-be-private \
117 | --key MyPersonalInfo
118 | ```
119 | 
120 | The above should return 1 grantee, the owner (you). This indicates that the object is private.
121 | 
122 | Add public read access, violating our policy:
123 | 
124 | ```sh
125 | aws s3api put-object-acl \
126 | --bucket 123456789012-everything-must-be-private \
127 | --key MyPersonalInfo \
128 | --acl public-read
129 | ```
130 | 
131 | **Quickly check access again:**
132 | 
133 | ```sh
134 | aws s3api get-object-acl \
135 | --bucket 123456789012-everything-must-be-private \
136 | --key MyPersonalInfo
137 | ```
138 | 
139 | You will see another grantee, allowing everyone to read the object:
140 | 
141 | ```json
142 | {
143 |   "Grantee": {
144 |     "Type": "Group",
145 |     "URI": "http://acs.amazonaws.com/groups/global/AllUsers"
146 |   },
147 |   "Permission": "READ"
148 | }
149 | ```
150 | 
151 | Describe the ACL again, and you'll see the Lambda function has removed public read access. Verify in CloudWatch Logs.
152 | 
153 | ## Cleanup
154 | 
155 | ```sh
156 | aws events remove-targets --rule S3ObjectACLAutoRemediate --ids "1"
157 | aws events delete-rule --name S3ObjectACLAutoRemediate
158 | aws lambda delete-function --function-name RemediateObjectACL
159 | aws iam delete-role-policy --role-name AllowLogsAndS3ACL --policy-name AllowLogsAndS3ACL
160 | aws iam delete-role --role-name AllowLogsAndS3ACL
161 | aws cloudtrail delete-trail --name my-object-level-s3-trail
162 | aws s3 rb s3://123456789012-bucket-for-my-object-level-s3-trail --force
163 | aws s3 rb s3://123456789012-everything-must-be-private --force
164 | ```


--------------------------------------------------------------------------------
/Security/Making-Public-S3-Objects-Private/access_policy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |     "Effect": "Allow",
 5 |     "Action": [
 6 |       "s3:GetObjectAcl",
 7 |       "s3:PutObjectAcl"
 8 |     ],
 9 |     "Resource": "arn:aws:s3:::123456789012-everything-must-be-private/*"
10 |   }, {
11 |     "Effect": "Allow",
12 |     "Action": [
13 |       "logs:CreateLogGroup",
14 |       "logs:CreateLogStream",
15 |       "logs:PutLogEvents"
16 |     ],
17 |     "Resource": "arn:aws:logs:*:*:*"
18 |   }]
19 | }
20 | 


--------------------------------------------------------------------------------
/Security/Making-Public-S3-Objects-Private/bucket_policy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Principal": {
 6 |           "Service": "cloudtrail.amazonaws.com"
 7 |       },
 8 |       "Action": "s3:GetBucketAcl",
 9 |       "Resource": "arn:aws:s3:::123456789012-bucket-for-my-object-level-s3-trail"
10 |   }, {
11 |       "Effect": "Allow",
12 |       "Principal": {
13 |           "Service": "cloudtrail.amazonaws.com"
14 |       },
15 |       "Action": "s3:PutObject",
16 |       "Resource": "arn:aws:s3:::123456789012-bucket-for-my-object-level-s3-trail/*",
17 |       "Condition": {
18 |           "StringEquals": {
19 |               "s3:x-amz-acl": "bucket-owner-full-control"
20 |           }
21 |       }
22 |   }]
23 | }
24 | 


--------------------------------------------------------------------------------
/Security/Making-Public-S3-Objects-Private/event_pattern.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "detail-type": [
 3 |     "AWS API Call via CloudTrail"
 4 |   ],
 5 |   "detail": {
 6 |     "eventSource": [
 7 |       "s3.amazonaws.com"
 8 |     ],
 9 |     "eventName": [
10 |       "PutObjectAcl",
11 |       "PutObject"
12 |     ],
13 |     "requestParameters": {
14 |       "bucketName": [
15 |         "123456789012-everything-must-be-private"
16 |       ]
17 |     }
18 |   }
19 | }
20 | 


--------------------------------------------------------------------------------
/Security/Making-Public-S3-Objects-Private/event_selectors.json:
--------------------------------------------------------------------------------
 1 | [{
 2 |   "IncludeManagementEvents": false,
 3 |   "DataResources": [{
 4 |     "Values": [
 5 |       "arn:aws:s3:::123456789012-everything-must-be-private/"
 6 |     ],
 7 |     "Type": "AWS::S3::Object"
 8 |   }],
 9 |   "ReadWriteType": "All"
10 | }]
11 | 


--------------------------------------------------------------------------------
/Security/Making-Public-S3-Objects-Private/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import os
 2 | 
 3 | import boto3
 4 | 
 5 | s3 = boto3.client('s3')
 6 | 
 7 | BUCKET_NAME = os.environ['BUCKET_NAME']
 8 | 
 9 | 
10 | def lambda_handler(event, context):
11 |     """Lambda entry point"""
12 |     # Get bucket name from the event
13 |     bucket = event['detail']['requestParameters']['bucketName']
14 |     if (bucket != BUCKET_NAME):
15 |         print(f"Doing nothing for bucket {bucket}.")
16 |         return
17 | 
18 |     # Get key name from the event
19 |     key = event['detail']['requestParameters']['key']
20 | 
21 |     # If object is not private then make it private
22 |     if not (is_private(bucket, key)):
23 |         print(f"Object with key {key} in bucket {bucket} is not private!")
24 |         make_private(bucket, key)
25 |     else:
26 |         print(f"Object with key {key} in bucket {bucket} is already private.")
27 | 
28 | 
29 | def is_private(bucket, key):
30 |     """Check if an S3 object is private"""
31 |     # Get the object ACL from S3
32 |     acl = s3.get_object_acl(Bucket=bucket, Key=key)
33 | 
34 |     # Private object should have only one grant which is the object owner
35 |     if (len(acl['Grants']) > 1):
36 |         return False
37 | 
38 |     # If owner and grantee ids do no match, then the object is not private
39 |     owner_id = acl['Owner']['ID']
40 |     grantee_id = acl['Grants'][0]['Grantee']['ID']
41 |     if (owner_id != grantee_id):
42 |         return False
43 |     return True
44 | 
45 | 
46 | def make_private(bucket, key):
47 |     """Make an object private"""
48 |     s3.put_object_acl(Bucket=bucket, Key=key, ACL="private")
49 |     print(f"Object with key {key} in bucket {bucket} is marked as private.")
50 | 


--------------------------------------------------------------------------------
/Security/Making-Public-S3-Objects-Private/trust_policy.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |     "Effect": "Allow",
 5 |     "Principal": {
 6 |       "Service": "lambda.amazonaws.com"
 7 |     },
 8 |     "Action": "sts:AssumeRole"
 9 |   }]
10 | }
11 | 


--------------------------------------------------------------------------------
/Security/Remediating-Inspector-Findings/README.md:
--------------------------------------------------------------------------------
 1 | # Remediating Inspector Findings
 2 | 
 3 | Common Vulnerabilities and Exposures (CVE): <https://cve.mitre.org>
 4 | 
 5 | ## EC2 Instance Role
 6 | 
 7 | Policy: `arn:aws:iam::aws:policy/AmazonSSMFullAccess`
 8 | 
 9 | ## Lambda Execution Role
10 | 
11 | Policies:
12 | 
13 | * `arn:aws:iam::aws:policy/AmazonSSMFullAccess`
14 | * `arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole`
15 | 
16 | Additional statement for Inspector:
17 | 
18 | ```json
19 | {
20 |   "Version": "2012-10-17",
21 |   "Statement": [
22 |     {
23 |       "Effect": "Allow",
24 |       "Action": [
25 |         "inspector:DescribeFindings"
26 |       ],
27 |       "Resource": "*"
28 |     }
29 |   ]
30 | }
31 | ```
32 | 
33 | ## SNS Topic
34 | 
35 | Create an SNS topic.
36 | 
37 | Grant the regional Inspector account permission to publish to the SNS topic.
38 | 
39 | These users are listed here: <https://docs.aws.amazon.com/inspector/latest/userguide/inspector_assessments.html#sns-topic>
40 | 
41 | Examples:
42 | 
43 | * US East (Northern Virginia) - `arn:aws:iam::316112463485:root`
44 | * US East (Ohio) - `arn:aws:iam::646659390643:root`
45 | 
46 | ## Lambda Function
47 | 
48 | Adapted from <https://github.com/awslabs/amazon-inspector-auto-remediate>.
49 | 
50 | The Lambda function will automatically patch EC2 instances when an Inspector assessment generates a CVE finding.
51 | 
52 | The function requires that the EC2 instance to be patched have the Systems Manager (SSM) agent installed, and the agent must have a role attached with necessary SSM permissions. For details on this, see <https://docs.aws.amazon.com/systems-manager/latest/APIReference/Welcome.html>.
53 | 
54 | ### SNS Trigger
55 | 
56 | The Lambda function is triggered by an SNS notification of a new finding from Inspector. The function checks to make sure that the finding is a CVE missing patch finding, and if so, it checks to ensure tha the SSM agent is running. It then uses SSM to issue the appropriate patch-and-reboot commands to either Ubuntu or Amazon Linux.
57 | 
58 | ## Run Inspector
59 | 
60 | Ensure that you've tagged the EC2 instance(s) you want to scan.
61 | 
62 | ### Create Assessment Target
63 | 
64 | 1. Click **Create**
65 | 2. Choose a name
66 | 3. Use tags, selecting the EC2 instance(s) you've tagged for inspection.
67 | 4. Click **Save**
68 | 
69 | ### Create Assessment Template
70 | 
71 | 1. Click **Create**
72 | 2. Choose a name, i.e. "All Assessments"
73 | 3. Select the Assessment Target created in the previous step
74 | 4. Select all rules packages
75 | 5. Duration: 1 hour
76 | 6. Select the SNS topic created previously
77 | 7. Deselect **Assessment Schedule**
78 | 8. Click **Create and run**
79 | 
80 | ### Assessment Runs
81 | 
82 | Watch the assessment run progress, periodically refreshing for the full hour to update the **Findings** count.
83 | 
84 | If there are any findings, check the CloudWatch Log for the Lambda function to observe that SSM ran the update script against the EC2 instance. For example, `yum update -q -y; yum upgrade -y`.
85 | 
86 | 


--------------------------------------------------------------------------------
/Security/Remediating-Inspector-Findings/finding-details.json:
--------------------------------------------------------------------------------
  1 | {
  2 |   "arn": "arn:aws:inspector:us-east-2:123456789012:target/0-j7k6kbKM/template/0-zfQemawC/run/0-BTVkArU2/finding/0-PB3jAlHR",
  3 |   "assetAttributes": {
  4 |     "agentId": "i-059cc55d140dfba1d",
  5 |     "amiId": "ami-d80c35bd",
  6 |     "hostname": "ec2-18-218-215-57.us-east-2.compute.amazonaws.com",
  7 |     "ipv4Addresses": [],
  8 |     "networkInterfaces": [{
  9 |       "ipv6Addresses": [],
 10 |       "networkInterfaceId": "eni-0ebdc0e0ae7d5387c",
 11 |       "privateDnsName": "ip-172-31-38-109.us-east-2.compute.internal",
 12 |       "privateIpAddress": "172.31.38.109",
 13 |       "privateIpAddresses": [{
 14 |         "privateDnsName": "ip-172-31-38-109.us-east-2.compute.internal",
 15 |         "privateIpAddress": "172.31.38.109"
 16 |       }],
 17 |       "publicDnsName": "ec2-18-218-215-57.us-east-2.compute.amazonaws.com",
 18 |       "publicIp": "18.218.215.57",
 19 |       "securityGroups": [{
 20 |         "groupId": "sg-014c0919b70bfde82",
 21 |         "groupName": "launch-wizard-6"
 22 |       }],
 23 |       "subnetId": "subnet-8d7b65c0",
 24 |       "vpcId": "vpc-a5c487cd"
 25 |     }],
 26 |     "schemaVersion": 1,
 27 |     "tags": [{
 28 |       "key": "Name",
 29 |       "value": "AmazonLinux2018"
 30 |     }]
 31 |   },
 32 |   "assetType": "ec2-instance",
 33 |   "attributes": [{
 34 |       "key": "CVSS3_SCORE",
 35 |       "value": "7.5"
 36 |     },
 37 |     {
 38 |       "key": "package_name",
 39 |       "value": "kernel-0:4.14.47-64.38.amzn2"
 40 |     },
 41 |     {
 42 |       "key": "CVSS3_VECTOR",
 43 |       "value": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
 44 |     },
 45 |     {
 46 |       "key": "CVE_ID",
 47 |       "value": "CVE-2018-5390"
 48 |     },
 49 |     {
 50 |       "key": "CVSS2_VECTOR",
 51 |       "value": "AV:N/AC:L/Au:N/C:N/I:N/A:C"
 52 |     },
 53 |     {
 54 |       "key": "INSTANCE_ID",
 55 |       "value": "i-059cc55d140dfba1d"
 56 |     },
 57 |     {
 58 |       "key": "CVSS2_SCORE",
 59 |       "value": "7.8"
 60 |     }
 61 |   ],
 62 |   "confidence": 10,
 63 |   "createdAt": 1551666773.399,
 64 |   "description": {
 65 |     "message": "Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service."
 66 |   },
 67 |   "id": "CVE-2018-5390",
 68 |   "indicatorOfCompromise": false,
 69 |   "numericSeverity": 9,
 70 |   "recommendation": {
 71 |     "message": "Use your Operating System's update feature to update package kernel-0:4.14.47-64.38.amzn2. For more information see <a href=\"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5390\" target=\"_blank\">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5390</a>"
 72 |   },
 73 |   "schemaVersion": 1,
 74 |   "service": "Inspector",
 75 |   "serviceAttributes": {
 76 |     "assessmentRunArn": "arn:aws:inspector:us-east-2:123456789012:target/0-j7k6kbKM/template/0-zfQemawC/run/0-BTVkArU2",
 77 |     "rulesPackageArn": "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-JnA8Zp85",
 78 |     "schemaVersion": 1
 79 |   },
 80 |   "severity": "High",
 81 |   "title": {
 82 |     "message": "Instance i-059cc55d140dfba1d is vulnerable to CVE-2018-5390"
 83 |   },
 84 |   "updatedAt": 1551666773.399,
 85 |   "userAttributes": [],
 86 |   "attributesAsHash": {},
 87 |   "CVSS3_SCORE": "7.5",
 88 |   "CVSS3_VECTOR": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
 89 |   "CVSS2_VECTOR": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
 90 |   "CVSS2_SCORE": "7.8",
 91 |   "rulesPackage": {
 92 |     "arn": "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-JnA8Zp85",
 93 |     "description": "The rules in this package help verify whether the EC2 instances in your application are exposed to Common Vulnerabilities and Exposures (CVEs). Attacks can exploit unpatched vulnerabilities to compromise the confidentiality, integrity, or availability of your service or data. The CVE system provides a reference for publicly known information security vulnerabilities and exposures. For more information, see [https://cve.mitre.org/](https://cve.mitre.org/). If a particular CVE appears in one of the produced Findings at the end of a completed Inspector assessment, you can search [https://cve.mitre.org/](https://cve.mitre.org/) using the CVE's ID (for example, \"CVE-2009-0021\") to find detailed information about this CVE, its severity, and how to mitigate it. ",
 94 |     "name": "Common Vulnerabilities and Exposures",
 95 |     "provider": "Amazon Web Services, Inc.",
 96 |     "version": "1.1",
 97 |     "nameWithVersion": "Common Vulnerabilities and Exposures-1.1"
 98 |   },
 99 |   "assessmentRun": {
100 |     "arn": "arn:aws:inspector:us-east-2:123456789012:target/0-j7k6kbKM/template/0-zfQemawC/run/0-BTVkArU2",
101 |     "assessmentTemplateArn": "arn:aws:inspector:us-east-2:123456789012:target/0-j7k6kbKM/template/0-zfQemawC",
102 |     "completedAt": 1551666775.277,
103 |     "createdAt": 1551663022.878,
104 |     "dataCollected": true,
105 |     "durationInSeconds": 3600,
106 |     "findingCounts": {
107 |       "High": 47,
108 |       "Informational": 4,
109 |       "Low": 3,
110 |       "Medium": 44
111 |     },
112 |     "name": "Run - All Assessments - 2019-03-04T01:30:18.220Z",
113 |     "notifications": [{
114 |         "date": 1551666684.823,
115 |         "error": false,
116 |         "event": "ASSESSMENT_RUN_STATE_CHANGED",
117 |         "snsPublishStatusCode": "SUCCESS",
118 |         "snsTopicArn": "arn:aws:sns:us-east-2:123456789012:Inspector"
119 |       },
120 |       {
121 |         "date": 1551666685.073,
122 |         "error": false,
123 |         "event": "ASSESSMENT_RUN_STATE_CHANGED",
124 |         "snsPublishStatusCode": "SUCCESS",
125 |         "snsTopicArn": "arn:aws:sns:us-east-2:123456789012:Inspector"
126 |       },
127 |       {
128 |         "date": 1551666685.849,
129 |         "error": false,
130 |         "event": "ASSESSMENT_RUN_STATE_CHANGED",
131 |         "snsPublishStatusCode": "SUCCESS",
132 |         "snsTopicArn": "arn:aws:sns:us-east-2:123456789012:Inspector"
133 |       },
134 |       {
135 |         "date": 1551666775.371,
136 |         "error": false,
137 |         "event": "ASSESSMENT_RUN_STATE_CHANGED",
138 |         "snsPublishStatusCode": "SUCCESS",
139 |         "snsTopicArn": "arn:aws:sns:us-east-2:123456789012:Inspector"
140 |       },
141 |       {
142 |         "date": 1551666775.406,
143 |         "error": false,
144 |         "event": "ASSESSMENT_RUN_COMPLETED",
145 |         "snsPublishStatusCode": "SUCCESS",
146 |         "snsTopicArn": "arn:aws:sns:us-east-2:123456789012:Inspector"
147 |       }
148 |     ],
149 |     "rulesPackageArns": [
150 |       "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-AxKmMHPX",
151 |       "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-UCYZFKPV",
152 |       "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-m8r61nnh",
153 |       "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-JnA8Zp85",
154 |       "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-cE4kTR30"
155 |     ],
156 |     "startedAt": 1551663023.916,
157 |     "state": "COMPLETED",
158 |     "stateChangedAt": 1551666775.277,
159 |     "stateChanges": [{
160 |         "state": "CREATED",
161 |         "stateChangedAt": 1551663022.878
162 |       },
163 |       {
164 |         "state": "START_DATA_COLLECTION_PENDING",
165 |         "stateChangedAt": 1551663022.976
166 |       },
167 |       {
168 |         "state": "COLLECTING_DATA",
169 |         "stateChangedAt": 1551663023.916
170 |       },
171 |       {
172 |         "state": "DATA_COLLECTED",
173 |         "stateChangedAt": 1551666684.743
174 |       },
175 |       {
176 |         "state": "START_EVALUATING_RULES_PENDING",
177 |         "stateChangedAt": 1551666685.015
178 |       },
179 |       {
180 |         "state": "EVALUATING_RULES",
181 |         "stateChangedAt": 1551666685.787
182 |       },
183 |       {
184 |         "state": "COMPLETED",
185 |         "stateChangedAt": 1551666775.277
186 |       }
187 |     ],
188 |     "userAttributesForFindings": [],
189 |     "attributesAsHash": {},
190 |     "findingCount": {
191 |       "result": 98
192 |     },
193 |     "duration": {
194 |       "value": 3600,
195 |       "label": "1 Hour (Recommended)"
196 |     }
197 |   },
198 |   "assessmentTemplate": {
199 |     "arn": "arn:aws:inspector:us-east-2:123456789012:target/0-j7k6kbKM/template/0-zfQemawC",
200 |     "assessmentRunCount": 1,
201 |     "assessmentTargetArn": "arn:aws:inspector:us-east-2:123456789012:target/0-j7k6kbKM",
202 |     "createdAt": 1551662945.038,
203 |     "durationInSeconds": 3600,
204 |     "lastAssessmentRunArn": "arn:aws:inspector:us-east-2:123456789012:target/0-j7k6kbKM/template/0-zfQemawC/run/0-BTVkArU2",
205 |     "name": "All Assessments",
206 |     "rulesPackageArns": [
207 |       "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-AxKmMHPX",
208 |       "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-UCYZFKPV",
209 |       "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-m8r61nnh",
210 |       "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-JnA8Zp85",
211 |       "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-cE4kTR30"
212 |     ],
213 |     "userAttributesForFindings": [],
214 |     "attributesAsHash": {},
215 |     "duration": {
216 |       "value": 3600,
217 |       "label": "1 Hour (Recommended)"
218 |     },
219 |     "lastAssessmentRunObject": {
220 |       "arn": "arn:aws:inspector:us-east-2:123456789012:target/0-j7k6kbKM/template/0-zfQemawC/run/0-BTVkArU2",
221 |       "assessmentTemplateArn": "arn:aws:inspector:us-east-2:123456789012:target/0-j7k6kbKM/template/0-zfQemawC",
222 |       "completedAt": 1551666775.277,
223 |       "createdAt": 1551663022.878,
224 |       "dataCollected": true,
225 |       "durationInSeconds": 3600,
226 |       "findingCounts": {
227 |         "High": 47,
228 |         "Informational": 4,
229 |         "Low": 3,
230 |         "Medium": 44
231 |       },
232 |       "name": "Run - All Assessments - 2019-03-04T01:30:18.220Z",
233 |       "notifications": [{
234 |           "date": 1551666684.823,
235 |           "error": false,
236 |           "event": "ASSESSMENT_RUN_STATE_CHANGED",
237 |           "snsPublishStatusCode": "SUCCESS",
238 |           "snsTopicArn": "arn:aws:sns:us-east-2:123456789012:Inspector"
239 |         },
240 |         {
241 |           "date": 1551666685.073,
242 |           "error": false,
243 |           "event": "ASSESSMENT_RUN_STATE_CHANGED",
244 |           "snsPublishStatusCode": "SUCCESS",
245 |           "snsTopicArn": "arn:aws:sns:us-east-2:123456789012:Inspector"
246 |         },
247 |         {
248 |           "date": 1551666685.849,
249 |           "error": false,
250 |           "event": "ASSESSMENT_RUN_STATE_CHANGED",
251 |           "snsPublishStatusCode": "SUCCESS",
252 |           "snsTopicArn": "arn:aws:sns:us-east-2:123456789012:Inspector"
253 |         },
254 |         {
255 |           "date": 1551666775.371,
256 |           "error": false,
257 |           "event": "ASSESSMENT_RUN_STATE_CHANGED",
258 |           "snsPublishStatusCode": "SUCCESS",
259 |           "snsTopicArn": "arn:aws:sns:us-east-2:123456789012:Inspector"
260 |         },
261 |         {
262 |           "date": 1551666775.406,
263 |           "error": false,
264 |           "event": "ASSESSMENT_RUN_COMPLETED",
265 |           "snsPublishStatusCode": "SUCCESS",
266 |           "snsTopicArn": "arn:aws:sns:us-east-2:123456789012:Inspector"
267 |         }
268 |       ],
269 |       "rulesPackageArns": [
270 |         "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-AxKmMHPX",
271 |         "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-UCYZFKPV",
272 |         "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-m8r61nnh",
273 |         "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-JnA8Zp85",
274 |         "arn:aws:inspector:us-east-2:646659390643:rulespackage/0-cE4kTR30"
275 |       ],
276 |       "startedAt": 1551663023.916,
277 |       "state": "COMPLETED",
278 |       "stateChangedAt": 1551666775.277,
279 |       "stateChanges": [{
280 |           "state": "CREATED",
281 |           "stateChangedAt": 1551663022.878
282 |         },
283 |         {
284 |           "state": "START_DATA_COLLECTION_PENDING",
285 |           "stateChangedAt": 1551663022.976
286 |         },
287 |         {
288 |           "state": "COLLECTING_DATA",
289 |           "stateChangedAt": 1551663023.916
290 |         },
291 |         {
292 |           "state": "DATA_COLLECTED",
293 |           "stateChangedAt": 1551666684.743
294 |         },
295 |         {
296 |           "state": "START_EVALUATING_RULES_PENDING",
297 |           "stateChangedAt": 1551666685.015
298 |         },
299 |         {
300 |           "state": "EVALUATING_RULES",
301 |           "stateChangedAt": 1551666685.787
302 |         },
303 |         {
304 |           "state": "COMPLETED",
305 |           "stateChangedAt": 1551666775.277
306 |         }
307 |       ],
308 |       "userAttributesForFindings": [],
309 |       "attributesAsHash": {},
310 |       "findingCount": {
311 |         "result": 98
312 |       },
313 |       "duration": {
314 |         "value": 3600,
315 |         "label": "1 Hour (Recommended)"
316 |       }
317 |     }
318 |   },
319 |   "assessmentTarget": {
320 |     "arn": "arn:aws:inspector:us-east-2:123456789012:target/0-j7k6kbKM",
321 |     "createdAt": 1551662750.726,
322 |     "name": "AmazonLinux2018",
323 |     "resourceGroupArn": "arn:aws:inspector:us-east-2:123456789012:resourcegroup/0-YRYehH3N",
324 |     "updatedAt": 1551662750.726,
325 |     "resourceGroup": {
326 |       "arn": "arn:aws:inspector:us-east-2:123456789012:resourcegroup/0-YRYehH3N",
327 |       "createdAt": 1551662750.224,
328 |       "tags": [{
329 |         "key": "Name",
330 |         "value": "AmazonLinux2018"
331 |       }],
332 |       "tagsAsHash": {
333 |         "Name": [
334 |           "AmazonLinux2018"
335 |         ]
336 |       },
337 |       "tagsAsString": "Name:AmazonLinux2018"
338 |     },
339 |     "assessmentTemplatesCount": 1
340 |   }
341 | }
342 | 


--------------------------------------------------------------------------------
/Security/Remediating-Inspector-Findings/lambda_function.py:
--------------------------------------------------------------------------------
  1 | import json
  2 | 
  3 | import boto3
  4 | 
  5 | ssm = boto3.client('ssm')
  6 | inspector = boto3.client('inspector')
  7 | 
  8 | 
  9 | def lambda_handler(event, context):
 10 | 
 11 |     print(json.dumps(event))
 12 | 
 13 |     # extract the message that Inspector sent via SNS
 14 |     message = event['Records'][0]['Sns']['Message']
 15 | 
 16 |     # get inspector notification type
 17 |     notificationType = json.loads(message)['event']
 18 |     print('Inspector SNS message type: ' + notificationType)
 19 | 
 20 |     # skip everything except report_finding notifications
 21 |     if notificationType != "FINDING_REPORTED":
 22 |         print('Skipping notification that is not a new finding: ' +
 23 |               notificationType)
 24 |         return 1
 25 | 
 26 |     # extract finding ARN
 27 |     findingArn = json.loads(message)['finding']
 28 |     print('Finding ARN: ' + findingArn)
 29 | 
 30 |     # get finding and extract detail
 31 |     response = inspector.describe_findings(
 32 |         findingArns=[findingArn], locale='EN_US')
 33 | 
 34 |     finding = response['findings'][0]
 35 | 
 36 |     # skip uninteresting findings
 37 |     title = finding['title']
 38 | 
 39 |     if title == "Unsupported Operating System or Version":
 40 |         print('Skipping finding: ' + title)
 41 |         return 1
 42 | 
 43 |     if title == "No potential security issues found":
 44 |         print('Skipping finding: ' + title)
 45 |         return 1
 46 | 
 47 |     service = finding['service']
 48 | 
 49 |     if service != "Inspector":
 50 |         print('Skipping finding from service: ' + service)
 51 |         return 1
 52 | 
 53 |     cveId = ""
 54 |     for attribute in finding['attributes']:
 55 |         if attribute['key'] == "CVE_ID":
 56 |             cveId = attribute['value']
 57 |             break
 58 |     print('CVE ID: ' + cveId)
 59 | 
 60 |     if cveId == "":
 61 |         print('Skipping non-CVE finding (could not find CVE ID)')
 62 |         return 1
 63 | 
 64 |     assetType = finding['assetType']
 65 | 
 66 |     if assetType != "ec2-instance":
 67 |         print('Skipping non-EC2-instance asset type: ' + assetType)
 68 |         return 1
 69 | 
 70 |     instanceId = finding['assetAttributes']['agentId']
 71 |     print('Instance ID: ' + instanceId)
 72 |     if not instanceId.startswith("i-"):
 73 |         print('Invalid instance ID: ' + instanceId)
 74 |         return 1
 75 | 
 76 |     # if we got here, we have a valid CVE type finding for an EC2 instance
 77 |     # with a well-formed instance ID
 78 | 
 79 |     # query SSM for information about this instance
 80 |     filterList = [{'key': 'InstanceIds', 'valueSet': [instanceId]}]
 81 |     response = ssm.describe_instance_information(
 82 |         InstanceInformationFilterList=filterList, MaxResults=50)
 83 | 
 84 |     instanceInfo = response['InstanceInformationList'][0]
 85 | 
 86 |     pingStatus = instanceInfo['PingStatus']
 87 |     print('SSM status of instance: ' + pingStatus)
 88 | 
 89 |     platformType = instanceInfo['PlatformType']
 90 |     print('OS type: ' + platformType)
 91 | 
 92 |     osName = instanceInfo['PlatformName']
 93 |     print('OS name: ' + osName)
 94 | 
 95 |     osVersion = instanceInfo['PlatformVersion']
 96 |     print('OS version: ' + osVersion)
 97 | 
 98 |     # Terminate if SSM agent is offline
 99 |     if pingStatus != 'Online':
100 |         print('SSM agent for this instance is not online: ' + pingStatus)
101 |         return 1
102 | 
103 |     # This script only supports remediation on Linux
104 |     if platformType != "Linux":
105 |         print('Skipping non-Linux platform: ' + platformType)
106 |         return 1
107 | 
108 |     # Look up the correct command to update this Linux distro
109 |     if osName.startswith('Ubuntu'):
110 |         commandLine = "apt-get update -qq -y; apt-get upgrade -y"
111 |     elif osName.startswith('Amazon Linux'):
112 |         commandLine = "yum update -q -y; yum upgrade -y"
113 |     else:
114 |         print('Unsupported Linux distribution: ' + osName)
115 |         return 1
116 |     print('Command line to execute: ' + commandLine)
117 | 
118 |     # Run command using SSM
119 |     response = ssm.send_command(
120 |         InstanceIds=[instanceId],
121 |         DocumentName='AWS-RunShellScript',
122 |         Comment='Lambda performing Inspector CVE finding auto-remediation',
123 |         Parameters={'commands': [commandLine]}
124 |     )
125 | 
126 |     print('SSM send-command response:')
127 |     print(response)
128 | 


--------------------------------------------------------------------------------
/Security/Responding-to-Invalid-SSH-Logins/README.md:
--------------------------------------------------------------------------------
  1 | # Responding to Invalid SSH Logins
  2 | 
  3 | In this lesson, we'll explore a real-world scenario where an EC2 instance is experiencing multiple failed SSH logins, and we want to automatically take the instance offline in response to this potential security event.
  4 | 
  5 | Use the Web Server Log Group and the Invalid SSH Login metric filter to trigger a CloudWatch alarm set for 2 data points within 1 minute.
  6 | 
  7 | This alarm should publish to an alarm notification SNS topic and send you an email as well as trigger the Lambda function to stop the instance.
  8 | 
  9 | ## Configure EC2 Instance
 10 | 
 11 | EC2 instance must have an IAM role which can communicate with both CloudWatch and Systems Manager.
 12 | 
 13 | ### Create IAM Instance Role
 14 | 
 15 | IAM > Create Role > AWS Service > EC2 > Next: Permissions
 16 | 
 17 | Select `CloudWatchAgentAdminPolicy` managed policy.
 18 | 
 19 | Select `AmazonEC2RoleforSSM` managed policy.
 20 | 
 21 | Name the role `CloudWatchAgentAdminRole`.
 22 | 
 23 | ### Launch EC2 Instance
 24 | 
 25 | Select **Amazon Linux 2**.
 26 | 
 27 | Create or select a security group with SSH (port 22) open to the public (`0.0.0.0/0`).
 28 | 
 29 | ### Attach the IAM Role to the Instance
 30 | 
 31 | Assign the `CloudWatchAgentAdminRole` IAM role to the EC2 instance.
 32 | 
 33 | ### Install CloudWatch Agent using Systems Manager
 34 | 
 35 | Run command: `AWS-ConfigureAWSPackage`  
 36 | Action: `Install`  
 37 | Name: `AmazonCloudWatchAgent`  
 38 | 
 39 | ### Configure the CloudWatch Agent
 40 | 
 41 | Run the CloudWatch Agent Configuration Wizard.
 42 | 
 43 | Create a new session using SSM Session Manager.
 44 | 
 45 | ```sh
 46 | sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard
 47 | ```
 48 | 
 49 | **Note: Do not select CollectD, unless you already installed it using `sudo yum install collectd`.**
 50 | 
 51 | Specify `/var/log/secure` for "Do you want to monitor any log files?"
 52 | 
 53 | ### Validate the configuration
 54 | 
 55 | ```sh
 56 | sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:/opt/aws/amazon-cloudwatch-agent/bin/config.json -s
 57 | ```
 58 | 
 59 | ## Create SNS Topic
 60 | 
 61 | The CloudWatch Alarm will notify this topic, and the topic will trigger the Lambda function.
 62 | 
 63 | Topic name: `AlarmNotificationTopic`
 64 | 
 65 | ## Configure CloudWatch Alarm
 66 | 
 67 | ### Add a metric filter to the web server log group
 68 | 
 69 | Click `secure` log group.
 70 | 
 71 | Click **Create metric filter**.
 72 | 
 73 | Filter pattern: `[Mon, day, timestamp, ip, id, status = Invalid*]`
 74 | 
 75 | Click **Test pattern**.
 76 | 
 77 | Click **Assign metric**.
 78 | 
 79 | Filter name: `InvalidSSHLogin`
 80 | 
 81 | Metric namespace: `SSH`
 82 | 
 83 | Metric name: `InvalidSSHLogin`
 84 | 
 85 | Click **Create filter**.
 86 | 
 87 | ### Create Alarm
 88 | 
 89 | Metric filter: SSH/InvalidSSHLogin
 90 | 
 91 | Click **Create alarm**.
 92 | 
 93 | Name: `InvalidSSHLoginAlarm`  
 94 | Description: `Invalid login attempts >2 in 1 min for instance <append instance ID>`
 95 | 
 96 | **Note: The description is critical, as the instance ID at the end is used by the Lambda function to stop the instance.**
 97 | 
 98 | Whenever `InvalidSSHLogin` >= `2` for 1 out of 1 datapoints
 99 | 
100 | ### Subscribe to SNS Topic
101 | 
102 | Select `AlarmNotificationTopic` and click **Create alarm**.
103 | 
104 | ## Create IAM Role for Lambda Function
105 | 
106 | Create role `LambdaStopInstances` using policy `lambda_execution_role.json`.
107 | 
108 | ## Create Lambda function
109 | 
110 | Name: `StopInstance`  
111 | Role: `StopInstancesRole`  
112 | 
113 | ### Trigger Lambda from SNS
114 | 
115 | Trigger > SNS > `AlarmNotificationTopic`
116 | 
117 | ## Trigger the CloudWatch Alarm
118 | 
119 | Make 3 invalid SSH login attempts within 2 minutes.
120 | 
121 | Observe that the `secure` log contains the `Invalid user` string.
122 | 
123 | Observe that the CloudWatch alarm is set.
124 | 
125 | Observe that the CloudWatch Log for the Lambda function ran.
126 | 
127 | Observe that the EC2 instance is stopped.
128 | 


--------------------------------------------------------------------------------
/Security/Responding-to-Invalid-SSH-Logins/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "ec2:StopInstances"
16 |       ],
17 |       "Resource": "*"
18 |     }
19 |   ]
20 | }
21 | 


--------------------------------------------------------------------------------
/Security/Responding-to-Invalid-SSH-Logins/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | 
 3 | import boto3
 4 | 
 5 | ec2 = boto3.client('ec2')
 6 | 
 7 | 
 8 | def lambda_handler(event, context):
 9 |     sns = event['Records'][0]['Sns']
10 |     json_msg = json.loads(sns['Message'])
11 | 
12 |     # Extract the EC2 instance ID
13 |     instance = json_msg['AlarmDescription'].split()[-1]
14 | 
15 |     ec2.stop_instances(InstanceIds=[instance])
16 | 
17 |     print('Stopped instance: %s' % instance)
18 | 


--------------------------------------------------------------------------------
/Security/Rotating-IAM-Access-Keys/README.md:
--------------------------------------------------------------------------------
 1 | # Rotating IAM Access Keys
 2 | 
 3 | Lambda function that revokes user access keys periodically to enforce rotation and mitigate risk.
 4 | 
 5 | Lambda function:
 6 | 
 7 | - Collects IAM users using pagination
 8 | - Scans each user for existing IAM Access keys older than 90 days
 9 | - Deactivates the keys
10 | - Sends email alert to administrator
11 | 
12 | Scheduled CloudWatch Rule:
13 | 
14 | - Triggers the Lambda to run, i.e. weekly
15 | 
16 | ## Amazon Simple Email Service (Amazon SES)
17 | 
18 | Be sure to use an [SES-verified email address](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/verify-email-addresses.html) to ensure properly delivery of emails.
19 | 
20 | SES API endpoints are not available in all regions. See [here](https://docs.aws.amazon.com/general/latest/gr/rande.html#ses_region) for a list of supported endpoints.
21 | 


--------------------------------------------------------------------------------
/Security/Rotating-IAM-Access-Keys/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "iam:ListAccessKeys",
16 |         "iam:ListUsers",
17 |         "iam:UpdateAccessKey",
18 |         "ses:SendEmail"
19 |       ],
20 |       "Resource": "*"
21 |     }
22 |   ]
23 | }
24 | 


--------------------------------------------------------------------------------
/Security/Rotating-IAM-Access-Keys/lambda_function.py:
--------------------------------------------------------------------------------
 1 | from datetime import datetime, timezone
 2 | 
 3 | import boto3
 4 | from botocore.exceptions import ClientError
 5 | 
 6 | AWS_EMAIL_REGION = 'us-east-1'            # SES isn't available in all regions
 7 | EMAIL_FROM = 'linuxacademylab@gmail.com'  # Use a verified SES email address
 8 | EMAIL_TO = 'linuxacademylab@gmail.com'
 9 | MAX_AGE = 90
10 | 
11 | iam = boto3.client('iam')
12 | ses = boto3.client('ses', region_name=AWS_EMAIL_REGION)
13 | 
14 | 
15 | def lambda_handler(event, context):
16 | 
17 |     paginator = iam.get_paginator('list_users')
18 | 
19 |     for response in paginator.paginate():
20 | 
21 |         for user in response['Users']:
22 |             username = user['UserName']
23 |             res = iam.list_access_keys(UserName=username)
24 | 
25 |             for access_key in res['AccessKeyMetadata']:
26 |                 access_key_id = access_key['AccessKeyId']
27 |                 create_date = access_key['CreateDate']
28 |                 print(f'User: {username} {access_key_id} {create_date}')
29 |                 age = days_old(create_date)
30 |                 if age < MAX_AGE:
31 |                     continue
32 | 
33 |                 # Expire the key
34 |                 print(f'Key {access_key_id} for user {username} is expired '
35 |                       f'(age={age} days).')
36 | 
37 |                 iam.update_access_key(
38 |                     UserName=username,
39 |                     AccessKeyId=access_key_id,
40 |                     Status='Inactive')
41 | 
42 |                 send_email_report(EMAIL_TO, username, age, access_key_id)
43 | 
44 | 
45 | def days_old(create_date):
46 |     now = datetime.now(timezone.utc)
47 |     age = now - create_date
48 |     return age.days
49 | 
50 | 
51 | def send_email_report(email_to, username, age, access_key_id):
52 |     data = (f'Access Key {access_key_id} belonging to user {username} has been '
53 |             f'automatically deactivated due to it being {age} days old.')
54 | 
55 |     try:
56 |         response = ses.send_email(
57 |             Source=EMAIL_FROM,
58 |             Destination={
59 |                 'ToAddresses': [EMAIL_TO]
60 |             },
61 |             Message={
62 |                 'Subject': {
63 |                     'Data': ('AWS IAM Access Key Rotation - Deactivation of '
64 |                              f'Access Keys: {access_key_id}')
65 |                 },
66 |                 'Body': {
67 |                     'Text': {
68 |                         'Data': data
69 |                     }
70 |                 }
71 |             })
72 |     except ClientError as e:
73 |         print(e.response['Error']['Message'])
74 |     else:
75 |         print("Email sent! Message ID:" + response['MessageId'])
76 | 


--------------------------------------------------------------------------------
/ThirdParty/Slack/README.md:
--------------------------------------------------------------------------------
 1 | # Creating Slack Notifications for CloudWatch Alarms
 2 | 
 3 | ## Configure WebHook in Slack
 4 | 
 5 | 1. Create a Slack App: <https://api.slack.com/apps/new>
 6 | 1. Search for and select **Incoming WebHooks**.
 7 | 1. Set **Activate Incoming Webhooks** to **On**.
 8 | 1. Select **Add New Webhook to Workspace**.
 9 | 1. Choose the default channel where messages will be sent and click **Authorize**.
10 | 1. Note the webhook URL from the **Webhook URLs for Your Workspace** section. For example, `https://hooks.slack.com/services/T0HABCGK/BDEFG93SS/BeBSKJHDHmWwyv2SYV4apv1O`
11 | 
12 | ```sh
13 | WEBHOOK_URL=https://hooks.slack.com/services/T0HABCGK/BDEFG93SS/BeBSKJHDHmWwyv2SYV4apv1O
14 | ```
15 | 
16 | Test the webhook:
17 | 
18 | ```sh
19 | curl -X POST -H 'Content-type: application/json' --data '{"text":"Hello, World!"}' $WEBHOOK_URL
20 | ```
21 | 
22 | ## Create an SNS Topic
23 | 
24 | ```sh
25 | aws sns create-topic --name high-cpu-alarm
26 | ```
27 | 
28 | Note the `TopicArn`.
29 | 
30 | ## Create CloudWatch Alarm
31 | 
32 | Send notification to SNS topic when CPU utilization > 40%:
33 | 
34 | ```sh
35 | aws cloudwatch put-metric-alarm \
36 |     --alarm-name cpu-mon \
37 |     --alarm-description "Alarm when CPU exceeds 40%" \
38 |     --metric-name CPUUtilization \
39 |     --namespace AWS/EC2 \
40 |     --statistic Average \
41 |     --period 60 \
42 |     --evaluation-periods 1 \
43 |     --threshold 40 \
44 |     --comparison-operator GreaterThanThreshold \
45 |     --dimensions Name=InstanceId,Value=i-12345678901234567 \
46 |     --alarm-actions arn:aws:sns:us-east-1:123456789012:high-cpu-alarm \
47 |     --unit Percent
48 | ```
49 | 
50 | ## Create SSM Parameter
51 | 
52 | ```sh
53 | aws ssm put-parameter --cli-input-json '{"Type": "SecureString", "KeyId": "alias/aws/ssm", "Name": "SlackWebHookURL", "Value": "'"$WEBHOOK_URL"'"}'
54 | ```
55 | 
56 | ## Create Lambda Execution Role
57 | 
58 | Attach the following managed policies:
59 | 
60 | - AmazonSSMFullAccess
61 | - AWSLambdaBasicExecutionRole
62 | 
63 | ## Create Lambda Function
64 | 
65 | Use the SNS topic as a trigger.
66 | 
67 | ## Stress the CPU
68 | 
69 | ```sh
70 | # Install Extra Packages for Enterprise Linux
71 | sudo amazon-linux-extras install epel
72 | # Install stress
73 | sudo yum install -y stress
74 | # Beat it up for 5 mins
75 | stress --cpu 2 --timeout 300s
76 | ```
77 | 


--------------------------------------------------------------------------------
/ThirdParty/Slack/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |     "Effect": "Allow",
 5 |     "Action": [
 6 |       "kms:Decrypt"
 7 |     ],
 8 |     "Resource": [
 9 |       "<your KMS key ARN>"
10 |     ]
11 |   }]
12 | }
13 | 


--------------------------------------------------------------------------------
/ThirdParty/Slack/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import json
 2 | from urllib.error import HTTPError, URLError
 3 | from urllib.request import Request, urlopen
 4 | 
 5 | import boto3
 6 | 
 7 | ssm = boto3.client('ssm')
 8 | 
 9 | 
10 | def lambda_handler(event, context):
11 |     print(json.dumps(event))
12 | 
13 |     message = json.loads(event['Records'][0]['Sns']['Message'])
14 |     print(json.dumps(message))
15 | 
16 |     alarm_name = message['AlarmName']
17 |     new_state = message['NewStateValue']
18 |     reason = message['NewStateReason']
19 | 
20 |     slack_message = {
21 |         'text': f':fire: {alarm_name} state is now {new_state}: {reason}\n'
22 |                 f'```\n{message}```'
23 |     }
24 | 
25 |     webhook_url = ssm.get_parameter(
26 |         Name='SlackWebHookURL', WithDecryption=True)
27 | 
28 |     req = Request(webhook_url['Parameter']['Value'],
29 |                   json.dumps(slack_message).encode('utf-8'))
30 | 
31 |     try:
32 |         response = urlopen(req)
33 |         response.read()
34 |         print(f"Message posted to Slack")
35 |     except HTTPError as e:
36 |         print(f'Request failed: {e.code} {e.reason}')
37 |     except URLError as e:
38 |         print(f'Server connection failed: {e.reason}')
39 | 


--------------------------------------------------------------------------------
/ThirdParty/Slack/sample_alarm.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "AlarmName": "cpu-mon",
 3 |   "AlarmDescription": "Alarm when CPU exceeds 40%",
 4 |   "AWSAccountId": "123456789012",
 5 |   "NewStateValue": "ALARM",
 6 |   "NewStateReason": "Threshold Crossed: 1 datapoint [99.0 (18/03/19 18:06:00)] was greater than or equal to the threshold (40.0).",
 7 |   "StateChangeTime": "2019-03-18T18:11:58.507+0000",
 8 |   "Region": "US East (Ohio)",
 9 |   "OldStateValue": "OK",
10 |   "Trigger": {
11 |     "MetricName": "CPUUtilization",
12 |     "Namespace": "AWS/EC2",
13 |     "StatisticType": "Statistic",
14 |     "Statistic": "AVERAGE",
15 |     "Unit": null,
16 |     "Dimensions": [{
17 |       "value": "i-12345678901234567",
18 |       "name": "InstanceId"
19 |     }],
20 |     "Period": 300,
21 |     "EvaluationPeriods": 1,
22 |     "ComparisonOperator": "GreaterThanOrEqualToThreshold",
23 |     "Threshold": 40,
24 |     "TreatMissingData": "",
25 |     "EvaluateLowSampleCountPercentile": ""
26 |   }
27 | }
28 | 


--------------------------------------------------------------------------------
/ThirdParty/Slack/sample_sns_message.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Records": [{
 3 |     "EventSource": "aws:sns",
 4 |     "EventVersion": "1.0",
 5 |     "EventSubscriptionArn": "arn:aws:sns:us-east-2:123456789012:high-cpu-alarm:37113ff5-bc0f-47e7-93cb-a568393b1cdf",
 6 |     "Sns": {
 7 |       "Type": "Notification",
 8 |       "MessageId": "c5185dee-b948-5a60-8240-08e75ff37af7",
 9 |       "TopicArn": "arn:aws:sns:us-east-2:123456789012:high-cpu-alarm",
10 |       "Subject": "ALARM: \"cpu-mon\" in US East (Ohio)",
11 |       "Message": "{\"AlarmName\":\"cpu-mon\",\"AlarmDescription\":\"Alarm when CPU exceeds 40%\",\"AWSAccountId\":\"123456789012\",\"NewStateValue\":\"ALARM\",\"NewStateReason\":\"Threshold Crossed: 1 datapoint [99.66666666666667 (18/03/19 18:28:00)] was greater than or equal to the threshold (40.0).\",\"StateChangeTime\":\"2019-03-18T18:33:31.823+0000\",\"Region\":\"US East (Ohio)\",\"OldStateValue\":\"OK\",\"Trigger\":{\"MetricName\":\"CPUUtilization\",\"Namespace\":\"AWS/EC2\",\"StatisticType\":\"Statistic\",\"Statistic\":\"AVERAGE\",\"Unit\":null,\"Dimensions\":[{\"value\":\"i-0bae13e726155adc3\",\"name\":\"InstanceId\"}],\"Period\":300,\"EvaluationPeriods\":1,\"ComparisonOperator\":\"GreaterThanOrEqualToThreshold\",\"Threshold\":40.0,\"TreatMissingData\":\"\",\"EvaluateLowSampleCountPercentile\":\"\"}}",
12 |       "Timestamp": "2019-03-18T18:33:31.872Z",
13 |       "SignatureVersion": "1",
14 |       "Signature": "WiZ8lP42Gu7VHwgBWW1wuXtYlP5why37F5BV/8jxhNmdJVLjwdqbP6lEmPrvz3qNnhxly5P2UPGqCkB6B6U1HCXR+9Xt4td9boMs9mf3zAkC93rJbnUEkURmuIcSqlaSZ0odPK/53VCR3mYkQUc9nkOVBVvlrIAFhx8EtUme7MHV0sju1pchkunTECv9cSmbn9TP2SNkai+KIRfzFSXA7aEsr1m/VbLrzIAynWtxRdO+hksZdkFXd8pm3R5B6ElipuiIErQbVjF9hc7ytFqxIZBP8b5Vpq8ecaoV2g87zuZ7p+bY118td95IT6f9xATMZuv1hwm4LwRn5SukWQ+EQw==",
15 |       "SigningCertUrl": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-6aad65c2f9911b05cd53efda11f913f9.pem",
16 |       "UnsubscribeUrl": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:high-cpu-alarm:37113ff5-bc0f-47e7-93cb-a568393b1cdf",
17 |       "MessageAttributes": {}
18 |     }
19 |   }]
20 | }
21 | 


--------------------------------------------------------------------------------
/ThirdParty/Twitter/.gitignore:
--------------------------------------------------------------------------------
1 | Pipfile*
2 | package/**
3 | package.zip
4 | requirements.txt


--------------------------------------------------------------------------------
/ThirdParty/Twitter/README.md:
--------------------------------------------------------------------------------
  1 | # Creating a Twitter App
  2 | 
  3 | In this lesson, you will learn to create a Twitter app that automatically sends tweets on a schedule.
  4 | 
  5 | ## Create Twitter Application
  6 | 
  7 | More info here <https://developer.twitter.com/en/docs/basics/apps/overview>.
  8 | 
  9 | Note the Consumer API keys and Access token & access token secret.
 10 | 
 11 | You can set these as environment variables, should you wish to create the SSM parameters using the AWS CLI:
 12 | 
 13 | ```sh
 14 | CONSUMER_KEY=5YAAipG8DLKjhdkjfhfQMZyuYhJ
 15 | CONSUMER_SECRET=qi3YF6hzdflkjLKJFZgJ6J3WwmEktMfX0IwPQMas
 16 | ACCESS_TOKEN=110809243434444423-pHHgCWvWOhc1KJHSLKJHFCAyrDOq0cR
 17 | ACCESS_TOKEN_SECRET=QXesCU9LKJHFLKJHKFF9FFVOjymg9UIDvRa58ySaQjd7357
 18 | ```
 19 | 
 20 | ## Create SSM Parameters
 21 | 
 22 | Use the keys from the previous step:
 23 | 
 24 | ```sh
 25 | aws ssm put-parameter --cli-input-json '{"Type": "SecureString", "KeyId": "alias/aws/ssm", "Name": "/TwitterBot/consumer_key", "Value": "'"$CONSUMER_KEY"'"}'
 26 | 
 27 | aws ssm put-parameter --cli-input-json '{"Type": "SecureString", "KeyId": "alias/aws/ssm", "Name": "/TwitterBot/consumer_secret", "Value": "'"$CONSUMER_SECRET"'"}'
 28 | 
 29 | aws ssm put-parameter --cli-input-json '{"Type": "SecureString", "KeyId": "alias/aws/ssm", "Name": "/TwitterBot/access_token", "Value": "'"$ACCESS_TOKEN"'"}'
 30 | 
 31 | aws ssm put-parameter --cli-input-json '{"Type": "SecureString", "KeyId": "alias/aws/ssm", "Name": "/TwitterBot/access_token_secret", "Value": "'"$ACCESS_TOKEN_SECRET"'"}'
 32 | ```
 33 | 
 34 | ## Create an S3 bucket and upload the data file
 35 | 
 36 | ```sh
 37 | aws s3 mb s3://123456789012-twitterbot
 38 | aws s3 cp data.txt s3://123456789012-twitterbot
 39 | ```
 40 | 
 41 | ## Create IAM execution role for Lambda
 42 | 
 43 | Grant access to your S3 bucket:
 44 | 
 45 | ```json
 46 | {
 47 |   "Version": "2012-10-17",
 48 |   "Statement": [{
 49 |       "Effect": "Allow",
 50 |       "Action": [
 51 |         "s3:GetObject"
 52 |       ],
 53 |       "Resource": "arn:aws:s3:::123456789012-twitterbot/*"
 54 |     },
 55 |     {
 56 |       "Effect": "Allow",
 57 |       "Action": [
 58 |         "ssm:GetParameter"
 59 |       ],
 60 |       "Resource": "arn:aws:ssm:us-east-2:123456789012:parameter/TwitterBot*"
 61 |     }
 62 |   ]
 63 | }
 64 | ```
 65 | 
 66 | ## Create deployment package
 67 | 
 68 | Create a new virtual environment using `pipenv` and install the required libraries:
 69 | 
 70 | ```sh
 71 | pipenv --python 3.7
 72 | pipenv shell
 73 | pipenv install tweepy
 74 | mkdir package
 75 | pipenv lock -r > requirements.txt
 76 | pip install -r requirements.txt --no-deps -t package
 77 | cd package
 78 | zip -r9 ../package.zip .
 79 | cd ..
 80 | zip -g package.zip lambda_function.py
 81 | rm -rf package/*
 82 | ```
 83 | 
 84 | ## Create Lambda function
 85 | 
 86 | ```sh
 87 | aws lambda create-function \
 88 | --function-name TwitterBot \
 89 | --zip-file fileb://package.zip \
 90 | --role arn:aws:iam::123456789012:role/LambdaTwitterBotRole \
 91 | --handler lambda_function.lambda_handler \
 92 | --runtime python3.7 \
 93 | --environment Variables={BUCKET_NAME=123456789012-twitterbot}
 94 | ```
 95 | 
 96 | ## Create CloudWatch Scheduled Rule
 97 | 
 98 | ```sh
 99 | aws events put-rule \
100 | --name TwitterBot \
101 | --schedule-expression 'rate(1 hour)'
102 | 
103 | aws lambda add-permission \
104 | --function-name TwitterBot \
105 | --statement-id TwitterBot \
106 | --action 'lambda:InvokeFunction' \
107 | --principal events.amazonaws.com \
108 | --source-arn arn:aws:events:us-east-1:123456789012:rule/TwitterBot
109 | 
110 | aws events put-targets --rule TwitterBot --targets file://targets.json
111 | ```


--------------------------------------------------------------------------------
/ThirdParty/Twitter/data.txt:
--------------------------------------------------------------------------------
 1 | Once men turned their thinking over to machines in the hope that this would set them free. But that only permitted other men with machines to enslave them.
 2 | Deep in the human unconscious is a pervasive need for a logical universe that makes sense. But the real universe is always one step beyond logic.
 3 | The mystery of life isn't a problem to solve, but a reality to experience.
 4 | What do you despise? By this are you truly known.
 5 | There is no escape—we pay for the violence of our ancestors.
 6 | Hope clouds observation.
 7 | It is so shocking to find out how many people do not believe that they can learn, and how many more believe learning to be difficult.
 8 | He who controls the spice controls the universe.
 9 | Without change something sleeps inside us, and seldom awakens. The sleeper must awaken.
10 | The mind commands the body and it obeys. The mind orders itself and meets resistance.
11 | Whether a thought is spoken or not it is a real thing and it has power," Tuek said. "You might find the line between life and death among the Fremen to be too sharp and quick.
12 | Fear is the mind-killer.
13 | It is impossible to live in the past, difficult to live in the present and a waste to live in the future.
14 | Try looking into that place where you dare not look! You'll find me there, staring out at you!
15 | The people who can destroy a thing, they control it.
16 | Survival is the ability to swim in strange water.
17 | The Fremen were supreme in that quality the ancients called "spannungsbogen" -- which is the self-imposed delay between desire for a thing and the act of reaching out to grasp that thing.
18 | Arrakis teaches the attitude of the knife - chopping off what's incomplete and saying: 'Now, it's complete because it's ended here.'
19 | What has mood to do with it? You fight when the necessity arises—no matter the mood! Mood's a thing for cattle or making love or playing the baliset. It's not for fighting.
20 | Highly organized research is guaranteed to produce nothing new.
21 | Proper teaching is recognized with ease. You can know it without fail because it awakens within you that sensation which tells you this is something you have always known.
22 | The willow submits to the wind and prospers until one day it is many willows - a wall against the wind.
23 | "Give as few orders as possible," his father had told him once long ago. "Once you've given orders on a subject, you must always give orders on that subject."
24 | There should be a science of discontent. People need hard times to develop psychic muscles.
25 | Any road followed precisely to its end leads precisely nowhere. Climb the mountain just a little bit to test that it's a mountain. From the top of the mountain, you cannot see the mountain.


--------------------------------------------------------------------------------
/ThirdParty/Twitter/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "s3:GetObject"
 7 |       ],
 8 |       "Resource": "arn:aws:s3:::123456789012-twitterbot/*"
 9 |     },
10 |     {
11 |       "Effect": "Allow",
12 |       "Action": [
13 |         "ssm:GetParameter"
14 |       ],
15 |       "Resource": "arn:aws:ssm:us-east-2:123456789012:parameter/TwitterBot*"
16 |     }
17 |   ]
18 | }
19 | 


--------------------------------------------------------------------------------
/ThirdParty/Twitter/lambda_function.py:
--------------------------------------------------------------------------------
 1 | import os
 2 | import random
 3 | 
 4 | import boto3
 5 | from botocore.exceptions import ClientError
 6 | import tweepy
 7 | 
 8 | BUCKET_NAME = os.environ['BUCKET_NAME']
 9 | KEY = 'data.txt'
10 | 
11 | s3 = boto3.resource('s3')
12 | ssm = boto3.client('ssm')
13 | 
14 | 
15 | def get_parameter(param_name):
16 |     response = ssm.get_parameter(Name=param_name, WithDecryption=True)
17 |     credentials = response['Parameter']['Value']
18 |     return credentials
19 | 
20 | 
21 | def get_tweet_text():
22 |     filename = '/tmp/' + KEY
23 |     try:
24 |         s3.Bucket(BUCKET_NAME).download_file(KEY, filename)
25 |     except ClientError as e:
26 |         if e.response['Error']['Code'] == "404":
27 |             print(f'The object {KEY} does not exist in bucket {BUCKET_NAME}.')
28 |         else:
29 |             raise
30 | 
31 |     with open(filename) as f:
32 |         lines = f.readlines()
33 |         return random.choice(lines)
34 | 
35 | 
36 | def lambda_handler(event, context):
37 | 
38 |     # Get SSM parameters
39 |     CONSUMER_KEY = get_parameter('/TwitterBot/consumer_key')
40 |     CONSUMER_SECRET = get_parameter('/TwitterBot/consumer_secret')
41 |     ACCESS_TOKEN = get_parameter('/TwitterBot/access_token')
42 |     ACCESS_TOKEN_SECRET = get_parameter('/TwitterBot/access_token_secret')
43 | 
44 |     # Authenticate Tweepy
45 |     auth = tweepy.OAuthHandler(CONSUMER_KEY, CONSUMER_SECRET)
46 |     auth.set_access_token(ACCESS_TOKEN, ACCESS_TOKEN_SECRET)
47 |     api = tweepy.API(auth)
48 | 
49 |     # Send tweet
50 |     tweet = get_tweet_text()
51 |     print(tweet)
52 |     api.update_status(tweet)
53 | 


--------------------------------------------------------------------------------
/ThirdParty/Twitter/targets.json:
--------------------------------------------------------------------------------
1 | [
2 |   {
3 |     "Id": "1",
4 |     "Arn": "arn:aws:lambda:us-east-1:123456789012:function:TwitterBot"
5 |   }
6 | ]
7 | 


--------------------------------------------------------------------------------
/Triggering-Lambda-from-SQS/README.md:
--------------------------------------------------------------------------------
 1 | # Triggering Lambda from SQS
 2 | 
 3 | Run the provided script `send_message.py` to send messages to SQS
 4 | 
 5 | **Example**: Send a message containing random text to the `Messages` queue every 0.1 second (10 messages per second):
 6 | 
 7 | `./send_message.py -q Messages -i 0.1`
 8 | 
 9 | Press `Ctrl+C` to quit.
10 | 


--------------------------------------------------------------------------------
/Triggering-Lambda-from-SQS/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Action": [
14 |         "dynamodb:*",
15 |         "sqs:*"
16 |       ],
17 |       "Effect": "Allow",
18 |       "Resource": "*"
19 |     }
20 |   ]
21 | }
22 | 


--------------------------------------------------------------------------------
/Triggering-Lambda-from-SQS/lambda_function.py:
--------------------------------------------------------------------------------
 1 | from datetime import datetime
 2 | import json
 3 | import os
 4 | import boto3
 5 | 
 6 | QUEUE_NAME = os.environ['QUEUE_NAME']
 7 | MAX_QUEUE_MESSAGES = os.environ['MAX_QUEUE_MESSAGES']
 8 | DYNAMODB_TABLE = os.environ['DYNAMODB_TABLE']
 9 | 
10 | sqs = boto3.resource('sqs')
11 | dynamodb = boto3.resource('dynamodb')
12 | 
13 | 
14 | def lambda_handler(event, context):
15 | 
16 |     # Receive messages from SQS queue
17 |     queue = sqs.get_queue_by_name(QueueName=QUEUE_NAME)
18 | 
19 |     print("ApproximateNumberOfMessages:",
20 |           queue.attributes.get('ApproximateNumberOfMessages'))
21 | 
22 |     for message in queue.receive_messages(
23 |             MaxNumberOfMessages=int(MAX_QUEUE_MESSAGES)):
24 | 
25 |         print(message)
26 | 
27 |         # Write message to DynamoDB
28 |         table = dynamodb.Table(DYNAMODB_TABLE)
29 | 
30 |         response = table.put_item(
31 |             Item={
32 |                 'MessageId': message.message_id,
33 |                 'Body': message.body,
34 |                 'Timestamp': datetime.now().isoformat()
35 |             }
36 |         )
37 |         print("Wrote message to DynamoDB:", json.dumps(response))
38 | 
39 |         # Delete SQS message
40 |         message.delete()
41 |         print("Deleted message:", message.message_id)
42 | 


--------------------------------------------------------------------------------
/Triggering-Lambda-from-SQS/send_message.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python3.7
 2 | # -*- coding: utf-8 -*-
 3 | import argparse
 4 | import logging
 5 | import sys
 6 | from time import sleep
 7 | import boto3
 8 | from faker import Faker
 9 | 
10 | 
11 | parser = argparse.ArgumentParser()
12 | parser.add_argument("--queue-name", "-q", required=True,
13 |                     help="SQS queue name")
14 | parser.add_argument("--interval", "-i", required=True,
15 |                     help="timer interval", type=float)
16 | parser.add_argument("--message", "-m", help="message to send")
17 | parser.add_argument("--log", "-l", default="INFO",
18 |                     help="logging level")
19 | args = parser.parse_args()
20 | 
21 | if args.log:
22 |     logging.basicConfig(
23 |         format='[%(levelname)s] %(message)s', level=args.log)
24 | 
25 | else:
26 |     parser.print_help(sys.stderr)
27 | 
28 | sqs = boto3.client('sqs')
29 | 
30 | response = sqs.get_queue_url(QueueName=args.queue_name)
31 | 
32 | queue_url = response['QueueUrl']
33 | 
34 | logging.info(queue_url)
35 | 
36 | while True:
37 |     message = args.message
38 |     if not args.message:
39 |         fake = Faker()
40 |         message = fake.text()
41 | 
42 |     logging.info('Sending message: ' + message)
43 | 
44 |     response = sqs.send_message(
45 |         QueueUrl=queue_url, MessageBody=message)
46 | 
47 |     logging.info('MessageId: ' + response['MessageId'])
48 |     sleep(args.interval)
49 | 


--------------------------------------------------------------------------------
/Triggering-Lambda-from-SQS/sqs_lambda_function.py:
--------------------------------------------------------------------------------
 1 | from datetime import datetime
 2 | import json
 3 | import os
 4 | import boto3
 5 | 
 6 | DYNAMODB_TABLE = os.environ['DYNAMODB_TABLE']
 7 | 
 8 | dynamodb = boto3.resource('dynamodb')
 9 | 
10 | def lambda_handler(event, context):
11 |     # Count items in the Lambda event 
12 |     no_messages = str(len(event['Records']))
13 |     print("Found " +no_messages +" messages to process.")
14 | 
15 |     for message in event['Records']:
16 | 
17 |         print(message)
18 | 
19 |         # Write message to DynamoDB
20 |         table = dynamodb.Table(DYNAMODB_TABLE)
21 | 
22 |         response = table.put_item(
23 |             Item={
24 |                 'MessageId': message['messageId'],
25 |                 'Body': message['body'],
26 |                 'Timestamp': datetime.now().isoformat()
27 |             }
28 |         )
29 |         print("Wrote message to DynamoDB:", json.dumps(response))
30 | 


--------------------------------------------------------------------------------
/Video-Transcoding/.gitignore:
--------------------------------------------------------------------------------
1 | .vscode/*


--------------------------------------------------------------------------------
/Video-Transcoding/Aerial.mp4:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/linuxacademy/content-lambda-boto3/c037e4a1583c32f1ae81bb16d3ce880a1292df02/Video-Transcoding/Aerial.mp4


--------------------------------------------------------------------------------
/Video-Transcoding/Clouds.mp4:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/linuxacademy/content-lambda-boto3/c037e4a1583c32f1ae81bb16d3ce880a1292df02/Video-Transcoding/Clouds.mp4


--------------------------------------------------------------------------------
/Video-Transcoding/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Action": [
14 |         "elastictranscoder:*",
15 |         "s3:*"
16 |       ],
17 |       "Effect": "Allow",
18 |       "Resource": "*"
19 |     }
20 |   ]
21 | }
22 | 


--------------------------------------------------------------------------------
/Video-Transcoding/lambda_handler.py:
--------------------------------------------------------------------------------
 1 | from datetime import datetime
 2 | import json
 3 | import urllib.parse
 4 | import os
 5 | import boto3
 6 | 
 7 | PIPELINE_ID = os.environ['PIPELINE_ID']
 8 | 
 9 | transcoder = boto3.client('elastictranscoder')
10 | s3 = boto3.resource('s3')
11 | 
12 | 
13 | def lambda_handler(event, context):
14 |     print("Received event: " + json.dumps(event))
15 | 
16 |     # Get the object from the event
17 |     key = urllib.parse.unquote_plus(
18 |         event['Records'][0]['s3']['object']['key'], encoding='utf-8')
19 | 
20 |     filename = os.path.splitext(key)[0]  # filename w/o extension
21 | 
22 |     # Create a job
23 |     job = transcoder.create_job(
24 |         PipelineId=PIPELINE_ID,
25 |         Input={
26 |             'Key': key
27 |         },
28 |         Outputs=[
29 |             {
30 |                 'Key': filename + '-1080p.mp4',
31 |                 'ThumbnailPattern': filename + '-{resolution}-{count}',
32 |                 'PresetId': '1351620000001-000001'  # Generic 1080p
33 |             },
34 |             {
35 |                 'Key': filename + '-720p.mp4',
36 |                 'ThumbnailPattern': filename + '-{resolution}-{count}',
37 |                 'PresetId': '1351620000001-000010'  # Generic 720p
38 |             }
39 |         ]
40 |     )
41 | 
42 |     print("start time={}".format(datetime.now().strftime("%H:%M:%S.%f")[:-3]))
43 |     print("job={}".format(job))
44 |     job_id = job['Job']['Id']
45 | 
46 |     # Wait for the job to complete
47 |     waiter = transcoder.get_waiter('job_complete')
48 |     waiter.wait(Id=job_id)
49 |     end_time = datetime.now().strftime("%H:%M:%S.%f")[:-3]
50 |     print("end time={}".format(end_time))
51 | 


--------------------------------------------------------------------------------
/WebApps/Contact-Form/README.md:
--------------------------------------------------------------------------------
 1 | # Building a Contact Form with API Gateway and SES
 2 | 
 3 | This lesson demonstrates a web page with a typical contact form. Using API Gateway and a Lambda function as a backend for this form, we will send the form post contents via email using SES, and also write the contact data to DynamoDB.
 4 | 
 5 | ## DynamoDB
 6 | 
 7 | Create table `Contact` with primary partition key `id`:
 8 | 
 9 | ```sh
10 | aws dynamodb create-table --table-name Contact \
11 |   --attribute-definitions AttributeName=id,AttributeType=S \
12 |   --key-schema AttributeName=id,KeyType=HASH \
13 |   --billing-mode=PAY_PER_REQUEST
14 | ```
15 | 
16 | ## Lambda function
17 | 
18 | Create function **ContactEmail**
19 | 
20 | ## API Gateway
21 | 
22 | Create API **ContactEmailAPI**
23 | 
24 | ### Create Method
25 | 
26 | Select **POST** and check the check mark  
27 | 
28 | Integration Type: Lambda Function  
29 | Use Lambda Proxy Integration: Checked (stores request data in `event`)  
30 | Lambda region: Same region as Lambda function  
31 | Lambda function: **ContactEmail**
32 | 
33 | ### Enable CORS
34 | 
35 | Select the **POST** method  
36 | Under **Actions** select **Enable CORS**  
37 | Leave the default options and click on **Enable CORS and replace existing CORS headers**.  
38 | Click **Yes, replace existing values**
39 | 
40 | ### Deploy API
41 | 
42 | Under **Actions** select **Deploy API**  
43 | Deployment stage: **[New stage]**  
44 | Stage name: **prod**  
45 | 
46 | Note the **Invoke URL** and update `form.js`.
47 | 
48 | ## Test locally
49 | 
50 | ```sh
51 | cd Contact-Form
52 | python3 -m http.server
53 | ```
54 | 
55 | Browse <http://localhost:8000>


--------------------------------------------------------------------------------
/WebApps/Contact-Form/lambda/lambda_execution_role.json:
--------------------------------------------------------------------------------
 1 | {
 2 |   "Version": "2012-10-17",
 3 |   "Statement": [{
 4 |       "Effect": "Allow",
 5 |       "Action": [
 6 |         "logs:CreateLogGroup",
 7 |         "logs:CreateLogStream",
 8 |         "logs:PutLogEvents"
 9 |       ],
10 |       "Resource": "arn:aws:logs:*:*:*"
11 |     },
12 |     {
13 |       "Effect": "Allow",
14 |       "Action": [
15 |         "ses:SendEmail",
16 |         "ses:SendRawEmail"
17 |       ],
18 |       "Resource": [
19 |         "*"
20 |       ]
21 |     },
22 |     {
23 |       "Effect": "Allow",
24 |       "Action": [
25 |         "dynamodb:PutItem"
26 |       ],
27 |       "Resource": "arn:aws:dynamodb:us-east-2:123456789012:table/Contact"
28 |     }
29 |   ]
30 | }
31 | 


--------------------------------------------------------------------------------
/WebApps/Contact-Form/lambda/lambda_function.py:
--------------------------------------------------------------------------------
  1 | import json
  2 | import os
  3 | import uuid
  4 | from datetime import datetime
  5 | 
  6 | import boto3
  7 | from botocore.exceptions import ClientError
  8 | 
  9 | CHARSET = 'UTF-8'
 10 | DYNAMODB_TABLE = os.environ['DYNAMODB_TABLE']
 11 | SENDER_EMAIL = os.environ['SENDER_EMAIL']  # Must be configured in SES
 12 | SES_REGION = 'us-east-1'
 13 | 
 14 | 
 15 | dynamodb = boto3.resource('dynamodb')
 16 | ses = boto3.client('ses', region_name=SES_REGION)
 17 | 
 18 | 
 19 | def lambda_handler(event, context):
 20 |     print(event)
 21 |     data = json.loads(event['body'])
 22 |     print(json.dumps(data))
 23 | 
 24 |     try:
 25 | 
 26 |         content = 'Message from ' + \
 27 |             data['first_name'] + ' ' + data['last_name'] + '\n' + \
 28 |             data['company'] + '\n' + \
 29 |             data['address1'] + '\n' + \
 30 |             data['address2'] + '\n' + \
 31 |             data['city'] + '\n' + \
 32 |             data['state'] + '\n' + \
 33 |             data['zip'] + '\n' + \
 34 |             data['email'] + '\n' + \
 35 |             data['phone'] + '\n' + \
 36 |             data['budget'] + '\n' + \
 37 |             data['message']
 38 |         save_to_dynamodb(data)
 39 |         response = send_mail_to_user(data, content)
 40 |     except ClientError as e:
 41 |         print(e.response['Error']['Message'])
 42 |     else:
 43 |         print("Email sent! Message Id:", response['MessageId'])
 44 | 
 45 |     return {
 46 |         "statusCode": 200,
 47 |         "headers": {"Content-Type": "application/json"},
 48 |         "body": ""
 49 |     }
 50 | 
 51 | 
 52 | def save_to_dynamodb(data):
 53 |     timestamp = datetime.utcnow().replace(microsecond=0).isoformat()
 54 |     table = dynamodb.Table(DYNAMODB_TABLE)
 55 |     item = {
 56 |         'id': str(uuid.uuid1()),
 57 |         'first_name': data['first_name'],  # required
 58 |         'last_name': data['last_name'],  # required
 59 |         'company': data['company'] if data['company'] else None,
 60 |         'address1': data['address1'] if data['address1'] else None,
 61 |         'address2': data['address2'] if data['address2'] else None,
 62 |         'city': data['city'] if data['city'] else None,
 63 |         'state': data['state'] if data['state'] else None,
 64 |         'zip': data['zip'] if data['zip'] else None,
 65 |         'email': data['email'],  # required
 66 |         'phone': data['phone'],  # required
 67 |         'budget': data['budget'],  # required
 68 |         'message': data['message'],  # required
 69 |         'createdAt': timestamp,
 70 |         'updatedAt': timestamp
 71 |     }
 72 |     table.put_item(Item=item)
 73 |     return
 74 | 
 75 | 
 76 | def send_mail_to_user(data, content):
 77 |     return ses.send_email(
 78 |         Source=SENDER_EMAIL,
 79 |         Destination={
 80 |             'ToAddresses': [
 81 |                 data['email'],
 82 |             ],
 83 |         },
 84 |         Message={
 85 |             'Subject': {
 86 |                 'Charset': CHARSET,
 87 |                 'Data': 'Thank you for contacting us!'
 88 |             },
 89 |             'Body': {
 90 |                 'Html': {
 91 |                     'Charset': CHARSET,
 92 |                     'Data': content
 93 |                 },
 94 |                 'Text': {
 95 |                     'Charset': CHARSET,
 96 |                     'Data': content
 97 |                 }
 98 |             }
 99 |         }
100 |     )
101 | 


--------------------------------------------------------------------------------
/WebApps/Contact-Form/webapp/css/style.css:
--------------------------------------------------------------------------------
 1 | @import url('https://fonts.googleapis.com/css?family=Open+Sans');
 2 | 
 3 | body {
 4 |   font-family: 'Open Sans', sans-serif;
 5 |   padding-top: 5rem;
 6 | }
 7 | 
 8 | textarea {  
 9 |   height: 100%;
10 | }
11 | 
12 | .starter-template {
13 |   padding: 3rem 1.5rem;
14 |   text-align: center;
15 | }


--------------------------------------------------------------------------------
/WebApps/Contact-Form/webapp/index.html:
--------------------------------------------------------------------------------
  1 | <!doctype html>
  2 | <html lang="en">
  3 | 
  4 | <head>
  5 |     <meta charset="utf-8">
  6 |     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
  7 |     <title>Building a Contact Form with API Gateway and SES</title>
  8 |     <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css" integrity="sha384-ggOyR0iXCbMQv3Xipma34MD+dH/1fQ784/j6cY/iJTQUOhcWr7x9JvoRxT2MZw1T"
  9 |         crossorigin="anonymous">
 10 |     <link rel="stylesheet" href="/css/style.css">
 11 |     <script src="http://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8="
 12 |         crossorigin="anonymous"></script>
 13 |     <script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js" integrity="sha384-UO2eT0CpHqdSJQ6hJty5KVphtPhzWj9WO1clHTMGa3JDZwrnQq4sF86dIHNDz0W1"
 14 |         crossorigin="anonymous"></script>
 15 |     <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js" integrity="sha384-JjSmVgyd0p3pXB1rRibZUAYoIIy6OrQ6VrjIEaFf/nJGzIxFDsf4x0xIM+B07jRM"
 16 |         crossorigin="anonymous"></script>
 17 |     <script src="/js/form.js"></script>
 18 | </head>
 19 | 
 20 | <body>
 21 |     <nav class="navbar navbar-expand-md navbar-dark bg-dark fixed-top"></nav>
 22 | 
 23 |     <main role="main" class="container">
 24 | 
 25 |         <div class="starter-template">
 26 |             <h1>Building a Contact Form with API Gateway and SES</h1>
 27 |             <p class="lead">Fill out this form and submit to API Gateway!</p>
 28 | 
 29 |             <form id="mainForm">
 30 |                 <div class="form-row">
 31 |                     <div class="col-md-4 mb-3">
 32 |                         <label for="first_name">First name</label>
 33 |                         <input type="text" class="form-control" id="first_name" placeholder="First name" required>
 34 |                     </div>
 35 |                     <div class="col-md-4 mb-3">
 36 |                         <label for="last_name">Last name</label>
 37 |                         <input type="text" class="form-control" id="last_name" placeholder="Last name" required>
 38 |                     </div>
 39 |                 </div>
 40 |                 <div class="form-row">
 41 |                     <div class="col-md-6 mb-3">
 42 |                         <label for="company">Company</label>
 43 |                         <input type="text" class="form-control" id="company" placeholder="Company">
 44 |                     </div>
 45 |                     <div class="col-md-6 mb-3">
 46 |                         <label for="address1">Address 1</label>
 47 |                         <input type="text" class="form-control" id="address1" placeholder="Address 1">
 48 |                     </div>
 49 |                     <div class="col-md-6 mb-3">
 50 |                         <label for="address2">Address 2</label>
 51 |                         <input type="text" class="form-control" id="address2" placeholder="Address 2">
 52 |                     </div>
 53 |                 </div>
 54 |                 <div class="form-row">
 55 |                     <div class="form-group col-md-6">
 56 |                         <label for="city">City</label>
 57 |                         <input type="text" class="form-control" id="city" placeholder="City">
 58 |                     </div>
 59 |                     <div class="form-group col-md-4">
 60 |                         <label for="state">State</label>
 61 |                         <input type="text" class="form-control" id="state" placeholder="State">
 62 |                     </div>
 63 |                     <div class="form-group col-md-2">
 64 |                         <label for="zip">Zip</label>
 65 |                         <input type="text" class="form-control" id="zip" placeholder="Zip">
 66 |                     </div>
 67 |                 </div>
 68 |                 <div class="form-row">
 69 |                     <div class="form-group col-md-4">
 70 |                         <label for="email">Email</label>
 71 |                         <input type="text" class="form-control" id="email" type="email" placeholder="Email" required>
 72 |                     </div>
 73 |                     <div class="form-group col-md-4">
 74 |                         <label for="phone">Phone</label>
 75 |                         <input type="text" class="form-control" id="phone" placeholder="Phone" required>
 76 |                     </div>
 77 |                     <div class="form-group col-md-4">
 78 |                         <label for="validationDefault10">Budget</label>
 79 |                         <select class="custom-select" id="budget" required>
 80 |                             <option value="">Budget</option>
 81 |                             <option value="Under 5000">Under $5,000</option>
 82 |                             <option value="5000-20000">$5,000-$20,000</option>
 83 |                             <option value="Over 20000">Over $20,000</option>
 84 |                         </select>
 85 |                     </div>
 86 |                 </div>
 87 | 
 88 |                 <div class="form-group">
 89 |                     <label for="message">Message</label>
 90 |                     <input type="textarea" class="form-control" id="message" placeholder="Message" rows="5" required>
 91 |                 </div>
 92 | 
 93 |                 <button id="submit" class="btn btn-primary" type="submit">Submit form</button>
 94 |             </form>
 95 |             <div id="form-response"></div>
 96 |         </div>
 97 | 
 98 |     </main>
 99 | 
100 | </body>
101 | 
102 | </html>


--------------------------------------------------------------------------------
/WebApps/Contact-Form/webapp/js/form.js:
--------------------------------------------------------------------------------
 1 | // Set 'URL' to your API Gateway endpoint
 2 | URL = 'https://abcdefghij.execute-api.us-east-2.amazonaws.com/prod/';
 3 | 
 4 | $(document).ready(function () {
 5 | 
 6 |     $("#mainForm").submit(function (e) {
 7 |         e.preventDefault();
 8 |         
 9 |         var first_name = $("#first_name").val(),
10 |             last_name = $("#last_name").val(),
11 |             company = $("#company").val(),
12 |             address1 = $("#address1").val(),
13 |             address2 = $("#address2").val(),
14 |             city = $("#city").val(),
15 |             state = $("#state").val(),
16 |             zip = $("#zip").val(),
17 |             email = $("#email").val(),
18 |             phone = $("#phone").val(),
19 |             budget = $("#budget").val(),
20 |             message = $("#message").val();
21 | 
22 |         $.ajax({
23 |             type: "POST",
24 |             url: URL,
25 |             contentType: 'application/json',
26 |             crossDomain: true, // remove in production environments
27 |             dataType: 'json',
28 |             // dataType: 'jsonp' // use JSONP for done() callback to work locally
29 |             data: JSON.stringify({
30 |                 first_name: first_name,
31 |                 last_name: last_name,
32 |                 company: company,
33 |                 address1: address1,
34 |                 address2: address2,
35 |                 city: city,
36 |                 state: state,
37 |                 zip: zip,
38 |                 phone: phone,
39 |                 email: email,
40 |                 budget: budget,
41 |                 message: message
42 |             })
43 |         }).done(function (result) {
44 |             console.log(result);
45 |         }).fail(function (jqXHR, textStatus, error) {
46 |             console.log("Post error: " + error);
47 |             if (error != '') $('#form-response').text('Error: ' + error);
48 |         }).always(function(data) {
49 |             console.log(JSON.stringify(data));
50 |             $('#form-response').text('Form submitted!');
51 |         });
52 | 
53 |     });
54 | });


--------------------------------------------------------------------------------