Prerequisites<\/b><\/h3>\r\n\r\n- AWS Account with necessary permissions to create and configure Lambda, IAM, CloudTrail, and CloudWatch Logs.<\/span><\/li>\r\n
- Slack workspace with permissions to create a new app and generate an incoming webhook URL.<\/span><\/li>\r\n<\/ol>\r\n
Architecture<\/b><\/h3>\r\n
Security Group Rule Event -> CloudTrail -> CloudWatch Logs -> Lambda Function -> Slack<\/span><\/i> ![\"\"](\"https:\/\/opstree.com\/blog\/wp-content\/uploads\/2024\/07\/image-1.png\")
<\/p>\r\nStep 1: Setup CloudTrail<\/b><\/h3>\r\n\r\n- Go to CloudTrail Console:<\/b><\/li>\r\n<\/ol>\r\n
\r\n- Navigate to the AWS Management Console.<\/span><\/li>\r\n
- Go to the CloudTrail service.<\/span><\/li>\r\n<\/ul>\r\n
\r\n- Create or Configure a Trail:<\/b><\/li>\r\n<\/ol>\r\n
![\"\"](\"https:\/\/opstree.com\/blog\/wp-content\/uploads\/2024\/07\/image-2.png\")
<\/p>\r\n
\r\n- Create a new trail or use an existing one.<\/span><\/li>\r\n
- Ensure that the trail is configured to log management events.<\/span><\/li>\r\n
- Enable the trail to send logs to CloudWatch Logs.<\/span><\/li>\r\n<\/ul>\r\n
Step 2: Setup CloudWatch Logs<\/b><\/h3>\r\n\r\n- Create Log Group:<\/b><\/li>\r\n<\/ol>\r\n
\r\n- Navigate to CloudWatch in the AWS Management Console.<\/span><\/li>\r\n
- Create a new log group or use an existing one to receive CloudTrail logs<\/span><\/li>\r\n<\/ul>\r\n
![\"\"](\"https:\/\/opstree.com\/blog\/wp-content\/uploads\/2024\/07\/Screenshot-2024-07-01-at-6.32.37\u202fPM.png\")
<\/p>\r\n
Step 3: Create Lambda Function<\/b><\/h3>\r\n\r\n- Create a Lambda Function:<\/b><\/li>\r\n<\/ol>\r\n
\r\n- Go to the AWS Lambda Console.<\/span><\/li>\r\n
- Create a new Lambda function with a suitable name, runtime (Python 3.8+), and role with the necessary permissions.<\/span><\/li>\r\n<\/ul>\r\n
![\"\"](\"https:\/\/opstree.com\/blog\/wp-content\/uploads\/2024\/07\/Screenshot-2024-07-01-at-3.12.14\u202fPM.png\")
<\/p>\r\n
\r\n- Add the Code mentioned below:<\/b><\/li>\r\n<\/ol>\r\n
import boto3
import json
import os
import base64
import gzip
import subprocess
ec2_client = boto3.client('ec2', region_name='us-east-1')
webhook_url = os.environ.get('WEBHOOK_URL')
def slack_message(sg_id, username, port, cidr, action):
\u00a0\u00a0\u00a0\u00a0message = f\"\"\"
:siren: *Security Group Rules Alert* :siren:
<!channel> Hey team,
A security group rule has been modified. Here are the details:
\u00a0*Action:* `{action}`
\u00a0*Created By:* `{username}`
\u00a0*Security Group Id:* `{sg_id}`
\u00a0*Port Number:* `{port}`
\u00a0*CIDR:* `{cidr}`
\u00a0*Potential Impact:* Access rule change detected.
\u00a0*Actions Required:* Review the security group rules to ensure they meet your security requirements.
Thank you for your attention to this matter! :hammer_and_spanner:
\"\"\"
\u00a0\u00a0\u00a0\u00a0return message
def send_alert(sg_id, username, port, cidr, action):
\u00a0\u00a0\u00a0\u00a0message = slack_message(sg_id, username, port, cidr, action)
\u00a0\u00a0\u00a0\u00a0payload = {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"channel\": \"\",
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"username\": \"Bot\",
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"text\": message,
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"icon_emoji\": \":alert:\"
\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0json_payload = json.dumps(payload)
\u00a0\u00a0\u00a0\u00a0curl_command = ['curl', '-X', 'POST', '-H', 'Content-Type: application\/json', '-d', json_payload, webhook_url]
\u00a0\u00a0\u00a0\u00a0response = subprocess.run(curl_command, check=True, capture_output=True, text=True)
def parse_event(event):
\u00a0\u00a0\u00a0\u00a0if 'detail' in event:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0action = event['detail']['eventName']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0username = event['detail']['userIdentity']['principalId'].split(':')[-1]
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0sg_rule_sets = event['detail']['responseElements']['securityGroupRuleSet']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0for sg_rule in sg_rule_sets['items']:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0sg_id = sg_rule['groupId']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0from_port = int(sg_rule['fromPort'])
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0to_port = int(sg_rule['toPort'])
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0cidr = sg_rule.get('cidrIpv4', sg_rule.get('cidrIpv6', 'N\/A'))
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0send_alert(sg_id, username, to_port, cidr, action)
\u00a0\u00a0\u00a0\u00a0else:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# Log CloudWatch log events
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_data = event['awslogs']['data']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0compressed_payload = base64.b64decode(log_data)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0uncompressed_payload = gzip.decompress(compressed_payload)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_events = json.loads(uncompressed_payload)['logEvents']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0for log_event in log_events:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0message = log_event['message']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_entry = json.loads(message)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0action = log_entry['eventName']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0username = log_entry['userIdentity']['principalId'].split(':')[-1]
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0sg_rule_sets = log_entry['responseElements']['securityGroupRuleSet']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0for sg_rule in sg_rule_sets['items']:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0sg_id = sg_rule['groupId']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0from_port = int(sg_rule['fromPort'])
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0to_port = int(sg_rule['toPort'])
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0cidr = sg_rule.get('cidrIpv4', sg_rule.get('cidrIpv6', 'N\/A'))
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0send_alert(sg_id, username, to_port, cidr, action)
def lambda_handler(event, context):
\u00a0\u00a0\u00a0\u00a0try:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0parse_event(event)
\u00a0\u00a0\u00a0\u00a0except KeyError as e:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(f\"KeyError: {e}\")
# Example event structure for testing
if __name__ == \"__main__\":
\u00a0\u00a0\u00a0\u00a0test_event = {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'awslogs': {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'data': base64.b64encode(gzip.compress(json.dumps({
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'logEvents': [
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'message': json.dumps({
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'eventName': 'AuthorizeSecurityGroupIngress',
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'userIdentity': {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'principalId': 'AWS:TestUser',
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0},
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'responseElements': {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'securityGroupRuleSet': {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'items': [
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'groupId': 'sg-12345678',
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'fromPort': 22,
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'toPort': 22,
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'cidrIpv4': '0.0.0.0\/0',
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0]
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0})
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0]
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}).encode())).decode()
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0lambda_handler(test_event, None)
<\/pre>\r\nSet Environment Variable:<\/b> ![\"\"](\"https:\/\/opstree.com\/blog\/wp-content\/uploads\/2024\/07\/Screenshot-2024-07-01-at-6.34.22\u202fPM.png\")
<\/p>\r\n\r\n- Set the <\/span>WEBHOOK_URL<\/span> environment variable to the Slack webhook URL you created.<\/span><\/li>\r\n<\/ul>\r\n
Step 4: Configure CloudWatch Logs Filter Pattern<\/b><\/h3>\r\n\r\n- Create Metric Filter:<\/b><\/li>\r\n<\/ol>\r\n
\r\n- Go to the CloudWatch Console.<\/span><\/li>\r\n
- Select the log group that receives CloudTrail logs.<\/span><\/li>\r\n
- Create a new metric filter with the following pattern:<\/span><\/li>\r\n
- { ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) }<\/span><\/li>\r\n
- Provide a name for the filter and configure it.<\/span><\/li>\r\n<\/ul>\r\n
![\"\"](\"https:\/\/opstree.com\/blog\/wp-content\/uploads\/2024\/07\/Screenshot-2024-07-01-at-6.40.29\u202fPM.png\")
Step 5: Add CloudWatch Logs Trigger to Lambda<\/b><\/p>\r\n\r\n- Add Trigger:<\/b><\/li>\r\n<\/ol>\r\n
\r\n- Go to the Lambda Console.<\/span><\/li>\r\n
- Select your Lambda function.<\/span><\/li>\r\n
- In the \u201cFunction overview\u201d section, click \u201cAdd trigger\u201d.<\/span><\/li>\r\n
- Select \u201cCloudWatch Logs\u201d as the trigger type.<\/span><\/li>\r\n
- Choose the log group that contains the CloudTrail logs.<\/span><\/li>\r\n
- Specify the filter pattern created earlier.<\/span><\/li>\r\n
- Click \u201cAdd\u201d.<\/span><\/li>\r\n<\/ul>\r\n
![\"\"](\"https:\/\/opstree.com\/blog\/wp-content\/uploads\/2024\/07\/Screenshot-2024-07-01-at-6.37.36\u202fPM.png\")
Step 6: Test the Setup<\/b><\/p>\r\n\r\n- Generate Test Events<\/b>:<\/span><\/li>\r\n<\/ol>\r\n
Modify a security group rule (e.g., authorize or revoke an ingress or egress rule) to generate test events.<\/span><\/p>\r\n\r\n- Verify Slack Notifications<\/b>:<\/span><\/li>\r\n<\/ol>\r\n
Check your Slack channel to ensure notifications are being received as expected.<\/span> ![\"\"](\"https:\/\/opstree.com\/blog\/wp-content\/uploads\/2024\/07\/image-3.png\")
<\/span><\/p>\r\nConclusion<\/b><\/h2>\r\n
Following these steps, you have successfully set up a Lambda function to send notifications to Slack for security group rule changes. This setup enhances security monitoring and provides real-time alerts to your AWS security groups for critical changes.<\/span><\/p>\r\n
Architecture<\/b><\/h3>\r\n
Security Group Rule Event -> CloudTrail -> CloudWatch Logs -> Lambda Function -> Slack<\/span><\/i> Set Environment Variable:<\/b> Modify a security group rule (e.g., authorize or revoke an ingress or egress rule) to generate test events.<\/span><\/p>\r\n Check your Slack channel to ensure notifications are being received as expected.<\/span> Following these steps, you have successfully set up a Lambda function to send notifications to Slack for security group rule changes. This setup enhances security monitoring and provides real-time alerts to your AWS security groups for critical changes.<\/span><\/p>\r\n<\/p>\r\nStep 1: Setup CloudTrail<\/b><\/h3>\r\n
\r\n
\r\n
\r\n
<\/p>\r\n\r\n
Step 2: Setup CloudWatch Logs<\/b><\/h3>\r\n
\r\n
\r\n
<\/p>\r\nStep 3: Create Lambda Function<\/b><\/h3>\r\n
\r\n
\r\n
<\/p>\r\n\r\n
import boto3
import json
import os
import base64
import gzip
import subprocess
ec2_client = boto3.client('ec2', region_name='us-east-1')
webhook_url = os.environ.get('WEBHOOK_URL')
def slack_message(sg_id, username, port, cidr, action):
\u00a0\u00a0\u00a0\u00a0message = f\"\"\"
:siren: *Security Group Rules Alert* :siren:
<!channel> Hey team,
A security group rule has been modified. Here are the details:
\u00a0*Action:* `{action}`
\u00a0*Created By:* `{username}`
\u00a0*Security Group Id:* `{sg_id}`
\u00a0*Port Number:* `{port}`
\u00a0*CIDR:* `{cidr}`
\u00a0*Potential Impact:* Access rule change detected.
\u00a0*Actions Required:* Review the security group rules to ensure they meet your security requirements.
Thank you for your attention to this matter! :hammer_and_spanner:
\"\"\"
\u00a0\u00a0\u00a0\u00a0return message
def send_alert(sg_id, username, port, cidr, action):
\u00a0\u00a0\u00a0\u00a0message = slack_message(sg_id, username, port, cidr, action)
\u00a0\u00a0\u00a0\u00a0payload = {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"channel\": \"\",
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"username\": \"Bot\",
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"text\": message,
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"icon_emoji\": \":alert:\"
\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0json_payload = json.dumps(payload)
\u00a0\u00a0\u00a0\u00a0curl_command = ['curl', '-X', 'POST', '-H', 'Content-Type: application\/json', '-d', json_payload, webhook_url]
\u00a0\u00a0\u00a0\u00a0response = subprocess.run(curl_command, check=True, capture_output=True, text=True)
def parse_event(event):
\u00a0\u00a0\u00a0\u00a0if 'detail' in event:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0action = event['detail']['eventName']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0username = event['detail']['userIdentity']['principalId'].split(':')[-1]
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0sg_rule_sets = event['detail']['responseElements']['securityGroupRuleSet']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0for sg_rule in sg_rule_sets['items']:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0sg_id = sg_rule['groupId']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0from_port = int(sg_rule['fromPort'])
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0to_port = int(sg_rule['toPort'])
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0cidr = sg_rule.get('cidrIpv4', sg_rule.get('cidrIpv6', 'N\/A'))
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0send_alert(sg_id, username, to_port, cidr, action)
\u00a0\u00a0\u00a0\u00a0else:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0# Log CloudWatch log events
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_data = event['awslogs']['data']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0compressed_payload = base64.b64decode(log_data)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0uncompressed_payload = gzip.decompress(compressed_payload)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_events = json.loads(uncompressed_payload)['logEvents']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0for log_event in log_events:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0message = log_event['message']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0log_entry = json.loads(message)
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0action = log_entry['eventName']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0username = log_entry['userIdentity']['principalId'].split(':')[-1]
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0sg_rule_sets = log_entry['responseElements']['securityGroupRuleSet']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0for sg_rule in sg_rule_sets['items']:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0sg_id = sg_rule['groupId']
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0from_port = int(sg_rule['fromPort'])
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0to_port = int(sg_rule['toPort'])
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0cidr = sg_rule.get('cidrIpv4', sg_rule.get('cidrIpv6', 'N\/A'))
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0send_alert(sg_id, username, to_port, cidr, action)
def lambda_handler(event, context):
\u00a0\u00a0\u00a0\u00a0try:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0parse_event(event)
\u00a0\u00a0\u00a0\u00a0except KeyError as e:
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0print(f\"KeyError: {e}\")
# Example event structure for testing
if __name__ == \"__main__\":
\u00a0\u00a0\u00a0\u00a0test_event = {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'awslogs': {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'data': base64.b64encode(gzip.compress(json.dumps({
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'logEvents': [
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'message': json.dumps({
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'eventName': 'AuthorizeSecurityGroupIngress',
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'userIdentity': {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'principalId': 'AWS:TestUser',
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0},
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'responseElements': {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'securityGroupRuleSet': {
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'items': [
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0{
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'groupId': 'sg-12345678',
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'fromPort': 22,
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'toPort': 22,
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0'cidrIpv4': '0.0.0.0\/0',
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0]
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0})
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0]
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}).encode())).decode()
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0}
\u00a0\u00a0\u00a0\u00a0lambda_handler(test_event, None)
<\/pre>\r\n<\/p>\r\n\r\n
Step 4: Configure CloudWatch Logs Filter Pattern<\/b><\/h3>\r\n
\r\n
\r\n
Step 5: Add CloudWatch Logs Trigger to Lambda<\/b><\/p>\r\n\r\n
\r\n
Step 6: Test the Setup<\/b><\/p>\r\n\r\n
\r\n
<\/span><\/p>\r\nConclusion<\/b><\/h2>\r\n