diff --git a/aws/sam-app/README.md b/aws/sam-app/README.md index 37d15df..20a9797 100644 --- a/aws/sam-app/README.md +++ b/aws/sam-app/README.md @@ -4,33 +4,28 @@ This project is a template for an AWS Serverless Application that enables you to It contains source code and supporting files for a serverless application that you can deploy with the SAM CLI. It includes the following directories and files: * `template.yml` : The application uses several AWS resources, including Lambda functions, Eventbridge rules, and IAM roles. These resources are defined in this file. -* `src/configure` : This is the source for the Lambda function that runs when the CloudFormation stack is created and destroyed. It takes care of storing the API key needed to -send events to NS1 Connect in a safe place, and cleaning up when the stack is no longer needed. +* `src/configure` : This is the source for the Lambda function that runs when the CloudFormation stack is created and destroyed. It takes care of storing the API key needed to send events to NS1 Connect in a safe place, and cleaning up when the stack is no longer needed. * `src/dns_updates` : This is the source for the Lambda function that is responsible for sending zone and record events to NS1 Connect. -* `src/dns_snapshot` : This is the source for the Lambda function that runs when the CloudFormation stack is created to get NS1 Connect up-to-date with the existing zones -and records in your AWS account. +* `src/dns_snapshot` : This is the source for the Lambda function that runs when the CloudFormation stack is created to get NS1 Connect up-to-date with the existing zones and records in your AWS account. ## Architecture +``` + +--------------+ +--------------+ +--------------+ +--------------+ +--------------+ +--------------+ + | Route 53 | --> | CloudTrail | --> | EventBridge | --> | SQS | --> | Lambda | --> | NS1 | + +--------------+ +--------------+ +--------------+ +--------------+ +--------------+ +--------------+ +``` -+--------------+ +--------------+ +--------------+ +--------------+ +--------------+ +--------------+ -| Route 53 | --> | CloudTrail | --> | EventBridge | --> | SQS | --> | Lambda | --> | NS1 | -+--------------+ +--------------+ +--------------+ +--------------+ +--------------+ +--------------+ - -When zones and records are created, changed, and deleted, events are automatically recorded in CloudTrail. The installed EventBridge rule watches for these events and queues them up -for the Lambda to take on the next leg. Processing of the messages for the events is minimal. The message is taken in its entirety, lightly wrapped, and sent -off across the Internet to the NS1 CloudSync REST API endpoint. Events are then processed asynchronously in NS1 Connect. +When zones and records are created, changed, and deleted, events are automatically recorded in CloudTrail. The installed EventBridge rule watches for these events and queues them up for the Lambda to take on the next leg. Processing of the messages for the events is minimal. The message is taken in its entirety, lightly wrapped, and sent off across the Internet to the NS1 CloudSync REST API endpoint. Events are then processed asynchronously in NS1 Connect. ## Parameters -| Parameter | Default | Description | -|---|---|---| -| `NS1APIKey` | *(required)* | Your NS1 Connect account API key. | -| `CreateCloudTrail` | `false` | Set to `true` only if your AWS account has no existing active multi-region CloudTrail trail. Most accounts already have a default trail (`management-events`); leave as `false` to avoid creating a duplicate trail and incurring unnecessary charges. | -| `CloudTrailName` | `NS1CloudSyncTrail` | **Only used when `CreateCloudTrail` is `true`** — leave as default if `CreateCloudTrail` is `false`. Name for the new trail created by this stack. Do not set this to the name of an existing trail. | +- **`NS1APIKey`** *(required)* — Your NS1 Connect account API key. +- **`CreateCloudTrail`** (default: `false`) — Set to `true` only if your AWS account has no existing active multi-region CloudTrail trail. Most accounts already have a default trail (`management-events`); leave as `false` to avoid creating a duplicate trail and incurring unnecessary charges (~$3/month). +- **`CloudTrailName`** (default: `NS1CloudSyncTrail`) — **Only used when `CreateCloudTrail` is `true`.** Leave as default if `CreateCloudTrail` is `false`. Name for the new trail created by this stack. Do not set this to the name of an existing trail. ## Security and permissions -You will need to provide an NS1 API key when installing the stack. A secret in AWS Secrets Manager is created for this key. When the `dns_updates` Lambda initializes it will request the key -from Secrets Manager and store it in memory for the lifetime of the Lambda execution environment. + +You will need to provide an NS1 API key when installing the stack. A secret in AWS Secrets Manager is created for this key. When the `dns_updates` Lambda initializes it will request the key from Secrets Manager and store it in memory for the lifetime of the Lambda execution environment. This template creates several IAM roles. Most of them are scoped to resources that the stack creates, such as the SQS queues, Secrets Manager secrets, CloudTrail bucket, and Step Functions state machine. diff --git a/aws/sam-app/packaged.yaml b/aws/sam-app/packaged.yaml index 16041f0..f5cdccb 100644 --- a/aws/sam-app/packaged.yaml +++ b/aws/sam-app/packaged.yaml @@ -317,7 +317,7 @@ Resources: Properties: LayerName: CloudSyncSharedLayer Description: Common functions - ContentUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/d039e5ba235f51b5adbfc3dea991670b + ContentUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/8b3c6d5874fad55e71dceff84a62d4a4 CompatibleRuntimes: - python3.11 RetentionPolicy: Delete @@ -410,7 +410,7 @@ Resources: Type: AWS::Serverless::Function Properties: FunctionName: CloudSyncDNSUpdateFunction - CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/7275877880f92da93b2cdbb40b09be4d + CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/4eef64468e7a3b343fdf0e8515384d82 Handler: app.handler Timeout: 10 Role: @@ -517,7 +517,7 @@ Resources: Type: AWS::Serverless::Function Properties: FunctionName: CloudSyncConfigureFunction - CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/6d23588d10c2c64ae0ad67991a609881 + CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/4acea290305294fd1fa5079983fb9951 Handler: app.configure_application Timeout: 300 Role: @@ -600,7 +600,7 @@ Resources: Type: AWS::Serverless::Function Properties: FunctionName: CloudSyncSnapshotFunction - CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/3973d0b91ac2f038f09a9cdcfd3e6230 + CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/5651b05b1db37247fd7a72a29f2444de Handler: app.lambda_handler Role: Fn::GetAtt: @@ -624,7 +624,7 @@ Resources: Type: AWS::Serverless::Function Properties: FunctionName: CloudSyncSnapshotListFunction - CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/3eb338e2099b8affed6c70ce13cbdb5b + CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/74914cd18b4791cb4c5d611fb9d9a920 Handler: app.lambda_handler Policies: - Version: '2012-10-17' @@ -642,7 +642,7 @@ Resources: Type: AWS::Serverless::Function Properties: FunctionName: CloudSyncHCSnapshotFunction - CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/3e6237008c5cd3a303819a0f788594fc + CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/55694e1a2ae304c2173f8cbe192f103a Handler: app.lambda_handler Role: Fn::GetAtt: @@ -785,7 +785,7 @@ Resources: Type: AWS::Serverless::Function Properties: FunctionName: CloudSyncTriggerStateMachineFunction - CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/8a180dcc15bae43041f365dbcd76702a + CodeUri: s3://aws-sam-cli-managed-default-samclisourcebucket-5bpg79c8x6lw/268f6a6998731980cc24080d4a4a9666 Handler: app.lambda_handler Policies: - Version: '2012-10-17'