Skip to content
This repository was archived by the owner on Sep 26, 2021. It is now read-only.

Commit f68b423

Browse files
blueimpblueimp
committed
Format markdown using prettier.
1 parent bc62c61 commit f68b423

File tree

11 files changed

+259
-200
lines changed

11 files changed

+259
-200
lines changed

‎README.md

+13-10
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,20 @@
11
# AWS Lambda
2+
23
A collection of functions for [AWS Lambda](https://aws.amazon.com/lambda/).
34

45
## Functions
5-
* [Authorize the client IP for an EC2 security group](authorize-ip)
6-
* [Return authorized keys for EC2 SSH access](ssh-authorized-keys)
7-
* [Grant bucket owner full control over an S3 object](bucket-owner-full-control)
8-
* [CloudWatch alarm notifications to Slack](cloudwatch-alarm-to-slack)
9-
* [CloudWatch Events to BuildKite](cloudwatch-events-to-buildkite)
10-
* [CloudWatch Logs to Elastic Cloud](cloudwatch-logs-to-elastic-cloud)
11-
* [Elastic Beanstalk events to Slack](elastic-beanstalk-events-to-slack)
12-
* [Subdomain or parent domain redirect](subdomain-redirect)
13-
* [Security headers for CloudFront](cloudfront-security-headers)
14-
* [Host header as X-Forwarded-Host for CloudFront](cloudfront-forwarded-host)
6+
7+
- [Authorize the client IP for an EC2 security group](authorize-ip)
8+
- [Return authorized keys for EC2 SSH access](ssh-authorized-keys)
9+
- [Grant bucket owner full control over an S3 object](bucket-owner-full-control)
10+
- [CloudWatch alarm notifications to Slack](cloudwatch-alarm-to-slack)
11+
- [CloudWatch Events to BuildKite](cloudwatch-events-to-buildkite)
12+
- [CloudWatch Logs to Elastic Cloud](cloudwatch-logs-to-elastic-cloud)
13+
- [Elastic Beanstalk events to Slack](elastic-beanstalk-events-to-slack)
14+
- [Subdomain or parent domain redirect](subdomain-redirect)
15+
- [Security headers for CloudFront](cloudfront-security-headers)
16+
- [Host header as X-Forwarded-Host for CloudFront](cloudfront-forwarded-host)
1517

1618
## License
19+
1720
Released under the [MIT license](https://opensource.org/licenses/MIT).

‎authorize-ip/README.md

+29-22
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
# authorize-ip
2-
[AWS Lambda](https://aws.amazon.com/lambda/) function to authorize the
3-
client IP for an EC2 security group.
2+
3+
[AWS Lambda](https://aws.amazon.com/lambda/) function to authorize the client IP
4+
for an EC2 security group.
45
Meant to be used with [Amazon API Gateway](https://aws.amazon.com/api-gateway/).
56

67
## Setup
78

89
### IAM role creation
10+
911
Create a new [IAM](https://aws.amazon.com/iam/) role with the name
1012
`aws-lambda-authorize-ip-role`. Select the AWS Lambda role type and attach the
1113
managed policy `AWSLambdaBasicExecutionRole`.
@@ -33,40 +35,43 @@ Attach an additional inline policy with the following content, replacing
3335
}
3436
```
3537

36-
**Notice:**
38+
**Notice:**
39+
3740
> The `ec2:DescribeSecurityGroups` action currently does not support
3841
> [resource-level permissions](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html);
39-
> therefore, the `*` wildcard is used for the Resource element in the
40-
> statement.
42+
> therefore, the `*` wildcard is used for the Resource element in the statement.
4143
4244
### Function configuration
43-
Add the function code to AWS Lambda with the following configuration options:
4445

45-
Key | Value
46-
--------|--------------
47-
Runtime | Node.js 10.x
48-
Handler | index.handler
49-
Role | aws-lambda-authorize-ip-role
50-
Memory | 128 (MB)
51-
Timeout | 3 sec
46+
Add the function code to AWS Lambda with the following configuration options:
47+
48+
| Key | Value |
49+
| ------- | ---------------------------- |
50+
| Runtime | Node.js 10.x |
51+
| Handler | index.handler |
52+
| Role | aws-lambda-authorize-ip-role |
53+
| Memory | 128 (MB) |
54+
| Timeout | 3 sec |
5255

5356
### Environment variables
57+
5458
Set the following required environment variables for the Lambda function:
5559

56-
Key | Value
57-
---------|--------------
58-
groupid | The ID of the security group, e.g. ``"sg-xxxxxxxx"``.
60+
| Key | Value |
61+
| ------- | --------------------------------------------------- |
62+
| groupid | The ID of the security group, e.g. `"sg-xxxxxxxx"`. |
5963

6064
Set the following optional environment variables for the Lambda function:
6165

62-
Key | Value
63-
-------------|--------------
64-
protocol | The protocol to authorize, defaults to ``"tcp"``.
65-
port | The port to authorize, defaults to `22` (SSH).
66-
description | Description for the inbound rule, defaults to `"authorize-ip"`.
67-
keepipranges | Comma-separated IP ranges to exclude from cleanup.
66+
| Key | Value |
67+
| ------------ | --------------------------------------------------------------- |
68+
| protocol | The protocol to authorize, defaults to `"tcp"`. |
69+
| port | The port to authorize, defaults to `22` (SSH). |
70+
| description | Description for the inbound rule, defaults to `"authorize-ip"`. |
71+
| keepipranges | Comma-separated IP ranges to exclude from cleanup. |
6872

6973
### Trigger configuration
74+
7075
Add an `API Gateway` trigger.
7176
This endpoint can then be used to authorize the IP of the requesting client.
7277
[test-event.json](test-event.json) contains a sample API Gateway event.
@@ -77,7 +82,9 @@ trigger with a cron expression, e.g. `cron(0 3 * * ? *)` to run at 03:00 am
7782
[test-event2.json](test-event2.json) contains sample Cloudwatch Event data.
7883

7984
## License
85+
8086
Released under the [MIT license](https://opensource.org/licenses/MIT).
8187

8288
## Author
89+
8390
[Sebastian Tschan](https://blueimp.net/)

‎bucket-owner-full-control/README.md

+23-20
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
# bucket-owner-full-control
2+
23
[AWS Lambda](https://aws.amazon.com/lambda/) function to grant the bucket owner
34
full control over an S3 object.
45

56
## Setup
67

78
### Prerequisites
9+
810
This setup assumes two AWS accounts. The main account (`Account A`) grants
911
another account (`Account B`) access to an S3 bucket via
1012
[bucket policy](http://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html),
@@ -19,10 +21,7 @@ e.g. the following:
1921
"AWS": "arn:aws:iam::ACCOUNT_ID:root"
2022
},
2123
"Action": "s3:*",
22-
"Resource": [
23-
"arn:aws:s3:::BUCKET_NAME",
24-
"arn:aws:s3:::BUCKET_NAME/*"
25-
]
24+
"Resource": ["arn:aws:s3:::BUCKET_NAME", "arn:aws:s3:::BUCKET_NAME/*"]
2625
}
2726
]
2827
}
@@ -43,10 +42,7 @@ A sample bucket policy with this restriction would be the following:
4342
"AWS": "arn:aws:iam::ACCOUNT_ID:root"
4443
},
4544
"Action": "s3:*",
46-
"Resource": [
47-
"arn:aws:s3:::BUCKET_NAME",
48-
"arn:aws:s3:::BUCKET_NAME/*"
49-
]
45+
"Resource": ["arn:aws:s3:::BUCKET_NAME", "arn:aws:s3:::BUCKET_NAME/*"]
5046
},
5147
{
5248
"Effect": "Deny",
@@ -65,7 +61,8 @@ A sample bucket policy with this restriction would be the following:
6561
}
6662
```
6763

68-
A sample [s3 put-object](http://docs.aws.amazon.com/cli/latest/reference/s3api/put-object.html)
64+
A sample
65+
[s3 put-object](http://docs.aws.amazon.com/cli/latest/reference/s3api/put-object.html)
6966
command with the required `bucket-owner-full-control` ACL as argument:
7067

7168
```sh
@@ -81,6 +78,7 @@ application like [Cyberduck](https://cyberduck.io/), this Lambda function comes
8178
in handy.
8279

8380
### IAM roles creation
81+
8482
In `Account B`, create a new cross-account [IAM](https://aws.amazon.com/iam/)
8583
role. Fill in the account ID of `Account A` as account that can use this role.
8684
As role name, choose `bucket-owner-full-control-role`.
@@ -127,29 +125,34 @@ After creating the role, attach the following inline policy, replacing
127125
```
128126

129127
### Function configuration
130-
Add the function code to AWS Lambda with the following configuration options:
131128

132-
Key | Value
133-
--------|--------------
134-
Runtime | Node.js 10.x
135-
Handler | index.handler
136-
Role | aws-lambda-bucket-owner-role
137-
Memory | 128 (MB)
138-
Timeout | 3 sec
129+
Add the function code to AWS Lambda with the following configuration options:
130+
131+
| Key | Value |
132+
| ------- | ---------------------------- |
133+
| Runtime | Node.js 10.x |
134+
| Handler | index.handler |
135+
| Role | aws-lambda-bucket-owner-role |
136+
| Memory | 128 (MB) |
137+
| Timeout | 3 sec |
139138

140139
### Environment variables
140+
141141
Set the following required environment variable for the Lambda function:
142142

143-
Key | Value
144-
--------|--------------
145-
rolearn | The ARN of the `bucket-owner-full-control-role` of `Account B`.
143+
| Key | Value |
144+
| ------- | --------------------------------------------------------------- |
145+
| rolearn | The ARN of the `bucket-owner-full-control-role` of `Account B`. |
146146

147147
### Trigger configuration
148+
148149
Add an `S3` trigger for your bucket with the `PUT` event type.
149150
[test-event.json](test-event.json) contains a sample S3 PUT event.
150151

151152
## License
153+
152154
Released under the [MIT license](https://opensource.org/licenses/MIT).
153155

154156
## Author
157+
155158
[Sebastian Tschan](https://blueimp.net/)

‎cloudfront-forwarded-host/README.md

+18-15
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
# cloudfront-forwarded-host
2+
23
[AWS Lambda@Edge](https://aws.amazon.com/lambda/edge/) function to forward the
34
`Host` header as `X-Forwarded-Host` to a
45
[CloudFront](https://aws.amazon.com/cloudfront/) origin.
56

67
## Setup
78

89
### IAM role creation
10+
911
Create a new [IAM](https://aws.amazon.com/iam/) role with the name
1012
`aws-lambda-edge-execution-role` and the following trust relationship:
1113

@@ -16,10 +18,7 @@ Create a new [IAM](https://aws.amazon.com/iam/) role with the name
1618
{
1719
"Effect": "Allow",
1820
"Principal": {
19-
"Service": [
20-
"lambda.amazonaws.com",
21-
"edgelambda.amazonaws.com"
22-
]
21+
"Service": ["lambda.amazonaws.com", "edgelambda.amazonaws.com"]
2322
},
2423
"Action": "sts:AssumeRole"
2524
}
@@ -28,28 +27,32 @@ Create a new [IAM](https://aws.amazon.com/iam/) role with the name
2827
```
2928

3029
### Function configuration
30+
3131
Add the function code to AWS Lambda in the `US East (N. Virginia)` region with
32-
the following configuration options:
32+
the following configuration options:
3333

34-
Key | Value
35-
--------|--------------
36-
Runtime | Node.js 10.x
37-
Handler | index.handler
38-
Role | aws-lambda-edge-execution-role
39-
Memory | 128 (MB)
40-
Timeout | 1 sec
34+
| Key | Value |
35+
| ------- | ------------------------------ |
36+
| Runtime | Node.js 10.x |
37+
| Handler | index.handler |
38+
| Role | aws-lambda-edge-execution-role |
39+
| Memory | 128 (MB) |
40+
| Timeout | 1 sec |
4141

4242
Next publish a version of the function and copy its
4343
[Lambda Function ARN](http://docs.aws.amazon.com/lambda/latest/dg/versioning-intro.html).
4444

4545
### CloudFront configuration
46-
In the behavior settings of the CloudFront distribution, add a new
47-
**Lambda Function Association** with the **Event Type** `Viewer Request` and
48-
the **Lambda Function ARN** copied from the function configuration.
46+
47+
In the behavior settings of the CloudFront distribution, add a new **Lambda
48+
Function Association** with the **Event Type** `Viewer Request` and the **Lambda
49+
Function ARN** copied from the function configuration.
4950
Save your edits and wait until the new settings have been deployed.
5051

5152
## License
53+
5254
Released under the [MIT license](https://opensource.org/licenses/MIT).
5355

5456
## Author
57+
5558
[Sebastian Tschan](https://blueimp.net/)

‎cloudfront-security-headers/README.md

+18-15
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
# cloudfront-security-headers
2+
23
[AWS Lambda@Edge](https://aws.amazon.com/lambda/edge/) function to add common
34
security headers for static content served via
45
[CloudFront](https://aws.amazon.com/cloudfront/).
56

67
## Setup
78

89
### IAM role creation
10+
911
Create a new [IAM](https://aws.amazon.com/iam/) role with the name
1012
`aws-lambda-edge-execution-role` and the following trust relationship:
1113

@@ -16,10 +18,7 @@ Create a new [IAM](https://aws.amazon.com/iam/) role with the name
1618
{
1719
"Effect": "Allow",
1820
"Principal": {
19-
"Service": [
20-
"lambda.amazonaws.com",
21-
"edgelambda.amazonaws.com"
22-
]
21+
"Service": ["lambda.amazonaws.com", "edgelambda.amazonaws.com"]
2322
},
2423
"Action": "sts:AssumeRole"
2524
}
@@ -28,28 +27,32 @@ Create a new [IAM](https://aws.amazon.com/iam/) role with the name
2827
```
2928

3029
### Function configuration
30+
3131
Add the function code to AWS Lambda in the `US East (N. Virginia)` region with
32-
the following configuration options:
32+
the following configuration options:
3333

34-
Key | Value
35-
--------|--------------
36-
Runtime | Node.js 10.x
37-
Handler | index.handler
38-
Role | aws-lambda-edge-execution-role
39-
Memory | 128 (MB)
40-
Timeout | 3 sec
34+
| Key | Value |
35+
| ------- | ------------------------------ |
36+
| Runtime | Node.js 10.x |
37+
| Handler | index.handler |
38+
| Role | aws-lambda-edge-execution-role |
39+
| Memory | 128 (MB) |
40+
| Timeout | 3 sec |
4141

4242
Next publish a version of the function and copy its
4343
[Lambda Function ARN](http://docs.aws.amazon.com/lambda/latest/dg/versioning-intro.html).
4444

4545
### CloudFront configuration
46-
In the behavior settings of the CloudFront distribution, add a new
47-
**Lambda Function Association** with the **Event Type** `Origin Response` and
48-
the **Lambda Function ARN** copied from the function configuration.
46+
47+
In the behavior settings of the CloudFront distribution, add a new **Lambda
48+
Function Association** with the **Event Type** `Origin Response` and the
49+
**Lambda Function ARN** copied from the function configuration.
4950
Save your edits and wait until the new settings have been deployed.
5051

5152
## License
53+
5254
Released under the [MIT license](https://opensource.org/licenses/MIT).
5355

5456
## Author
57+
5558
[Sebastian Tschan](https://blueimp.net/)

0 commit comments

Comments
 (0)