Is there any way to capture AWS Lambda's own CRUD events like lambda create, lambda update, lambda delete
I am trying to create an alert system to slack channel on every lambda update
CloudTrail:
Lambda is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in Lambda. CloudTrail captures API calls for Lambda as events. The calls captured include calls from the Lambda console and code calls to the Lambda API operations.
Additionally, many services (but not Lambda) send change events directly to EventBridge. EventBridge is notified when an RDS Instance is deleted, for instance. For finer-grained monitoring, consider the AWS Config service.
Related
In the AWS account, if a new VPC is created , I need that VPC flow logs should get enabled (created) automatically. Is there a way to do it ?
You can use EventBridge to automate response to events, currently, VPC is not integrated with EventBridge so you could:
Monitor CloudTrail events, particuarly the CreateVPC action as described in the AWS docs.
Add an AWS Lambda Function (AWS docs reference) that triggers based on the event
Modify your function to create the flow log using the SDK (python example on the AWS docs)
I have an AWS Lambda function that takes in and processes logs from CloudWatch Logs that are sent to specific log groups. The thing is, I may need to add more triggers as more log groups are created. The only way I have found to create a trigger for a specific log group is to use the AWS Lambda console and the AWS CloudFront console. Is it possible to create a trigger for an AWS Lambda function programmatically? For instance, in some Java code?
Yes, one of the common ways of triggering server-less functions is using endpoints. I believe you can expose an API endpoint from the Function's console using a an API Gateway, and call this endpoint URL from your java code or whatever programmatic entity you wish.
I'm trying to trigger a Lambda function when I click on deploy in the API-Gateway console to deploy API on a stage.
I already tried with cloudwatch rule, but there is no event patterns for API-Gateway deployment.
My questions are:
Is it possible to trigger a lambda function when I click on the deploy button on API-Gateway console?
If yes, how can I do that?
Thank you
Unfortunately, there is no straight forward way for achieving this.
CloudWatch rule will not help as there is no logging generated on API deployment.
The only thing left behind a deploy action is a CloudTrail event.
The best solution I could think for this involves Amazon EventBridge which is an event bus managed service provided by AWS.
In EventBridge you can create rules that collect specific events from various AWS services within (and beyond) your AWS account.
API Gateway is not one of these services, but CloudTrail is! (For reference here is a list of the EventBridge supported services)
An API deployment in API Gateway emits an event to CloudTrail which has CreateDeployment as event name and apigateway.amazonaws.com as event source. The event payload also includes data such as the restApiId, the stage, the IAM identity details of the deploying agent and more.
Note, that there is not much documentation around CloudTrail event schemas, but the event would look something like the one listed here
Now, we need to create an EventBridge rule that captures such CloudTrail events.
This is a very good, step by step, guide on how to do this.
For your use case, you need to choose API Gateway as the service name and add CreateDeployment as a Specific Operation as shown in the screenshot below:
Once the EventBridge rule is set up then you can directly attach it as a trigger in any Lambda function. See relevant tutorial.
Downsides
The above solution cannot be applied on the individual API level. The EventBridge rule will capture the deployments of all APIs of any stage in a specific region. Additional filtering has to be implemented within the lambda logic.
This will lead to unnecessary lambda executions if the solution is scoped for anything less than all the APIs of a region. However as we're talking about API deployments, the extra lambda execution cost will be negligible.
I need a way to log API gateway deployments (date/time, user, swagger diff etc.). Is there an event thats fired that i can attach a lambda to, or alternatively is this information already available on the dashboard somewhere?
As Krishna mentioned, CloudTrail can capture API events (both from the AWS console as well as the AWS APIs) for API Gateway, including the deployment of APIs. Since CloudTrail stores the events in S3, you can take advantage of S3 bucket notifications as a means to trigger your Lambda function.
I want to call a lambda function when my EC2 tag "Something" changes. Is it possible? If I cannot listen to changes to a specific tag, I could listen on EC2 config changes. How can I do that? I am not sure which option to select on cloudwatch events ...
UPDATE
I tried AWS Config, but it appears that it only monitors config changes when instance is started?
Yes, you can use Amazon CloudWatch Events with AWS CloudTrail to call a Lambda function, triggered off a CreateTags event. (Changing a tag is actually treated as creating a tag.)
Turn on AWS CloudTrail for your region (this involves pointing it to an Amazon S3 bucket for log storage)
Create an Amazon SNS topic
Create an AWS Lambda function with a trigger on the SNS topic
Create an Amazon CloudWatch Events rule:
Service Name: EC2
Event Type: AWS API Call via CloudTrail
Specific Operations: CreateTags
Add Target: Select your Lambda function
Your Lambda function will receive a notification when a tag is created/changed.