Function Deployment - AWS

This playbook automates the deployment of an AWS Lambda function to manage resources within an Amazon EKS cluster. It ensures that all necessary configurations are created, updated, and verified. ### Setup - **Describe EKS Cluster**: Gather essential details of the EKS cluster. - **Create IAM Role**: Set up a new IAM role for the Lambda function. - **Create and Attach Policy**: Define and attach a policy to the IAM role to grant necessary permissions. ### Authentication Mode Check - **Verify Authentication Mode**: Ensure the current authentication mode allows API access. - **If not**: Update the cluster authentication mode to permit API access. ### Access Entry Configuration - **Create Access Entry**: Establish a new access entry in the EKS cluster. - **Associate Access Policy**: Link the access policy with the created access entry. - **Update Access Entry**: Apply the latest configurations to the access entry. ### VPC and Security Group Setup - **Describe VPCs**: Identify the appropriate VPC for the Lambda function. - **Create Security Group**: Define a security group to manage Lambda function traffic. - **Set Ingress Rules**: Configure ingress rules for the security group. ### VPC Endpoint Creation - **Create VPC Endpoint for eks-auth**: Establish a VPC endpoint for EKS authentication. - **Check for Errors**: Verify if there are any errors during the creation of the VPC endpoint. - **If errors**: Handle and log them. - **Verify VPC Endpoint Existence**: Ensure the VPC endpoint already exists. - **If exists**: Proceed with the next steps. ### Lambda Function Deployment - **Download Kubernetes Library**: Fetch the necessary Kubernetes library. - **Publish AWS Lambda Layer**: Publish a new layer version for the AWS Lambda function. - **Create Lambda Code**: Develop the Lambda function code. - **Zip Lambda Code**: Compress the Lambda function code for deployment. - **Create AWS Lambda Function**: Deploy the Lambda function using the zipped code. ### Resolution - **Final Verification**: Ensure all operations have been successfully completed. - **Completion**: Confirm the deployment process is finished, ensuring robust management of EKS authentication through AWS Lambda. This playbook provides a comprehensive, automated approach to deploying an AWS Lambda function for managing resources within an EKS cluster, efficiently handling all configurations and potential errors. ### Required Integration #### AWS IAM (Identity and Access Management) - [AWS IAM API Documentation](https://docs.aws.amazon.com/IAM/latest/APIReference/Welcome.html) - [Cortex XSOAR AWS IAM Integration](https://cortex.marketplace.pan.dev/marketplace/details/AWSIAM/) #### AWS EC2 (Elastic Compute Cloud) - [AWS EC2 API Documentation](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Welcome.html) - [Cortex XSOAR AWS EC2 Integration](https://cortex.marketplace.pan.dev/marketplace/details/AWSEC2/) #### AWS EKS (Elastic Kubernetes Service) - [AWS EKS API Documentation](https://docs.aws.amazon.com/eks/latest/APIReference/Welcome.html) - [Cortex XSOAR AWS EKS Integration](https://cortex.marketplace.pan.dev/marketplace/details/AWSEKS/) #### AWS Lambda - [AWS Lambda API Documentation](https://docs.aws.amazon.com/lambda/latest/dg/API_Reference.html) - [Cortex XSOAR AWS Lambda Integration](https://cortex.marketplace.pan.dev/marketplace/details/AWSLambda/).

Pack

AWS-Enrichment-Remediation

Tasks

28

Inputs

• ClusterName — The name of the cluster.
• region — The region of the cluster.
• FunctionName — The name of the Lambda function.
• FunctionCode — Entry ID of the uploaded base64-encoded contents of the deployment package. Amazon Web Services SDK and CLI clients handle the encoding for you.
• FunctionRuntime — The runtime environment for the function.
• FunctionHandler — The name of the method within your code that Lambda calls to execute your function.
• LayerName — The name to assign to the new Lambda layer.
• LayerRuntime — The name of the method within your code that Lambda calls to execute your function.
• LayerArchitecture — A list of compatible architectures.
• LibraryName — The Python library to download and attach to the Lambda Function. e.g. To be able to use the kubernetes library, use 'kubernetes' and the script will download and pack its files.
• LambdaRoleName — The lambda role name to create.
• LambdaPolicyName — The lambda policy name to create.
• SecurityGroupName — The security group name to create.

Outputs

• AWS.EKS.DescribeCluster.name — The name of your cluster.
• AWS.EKS.DescribeCluster.arn — The Amazon Resource Name (ARN) of the cluster.
• AWS.EKS.DescribeCluster.createdAt — The creation date of the object.
• AWS.EKS.DescribeCluster.version — The Kubernetes server version for the cluster.
• AWS.EKS.DescribeCluster.endpoint — The endpoint for your Kubernetes API server.
• AWS.EKS.DescribeCluster.roleArn — The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to Amazon Web Services API operations on your behalf.
• AWS.EKS.DescribeCluster.identity — The identity provider information for the cluster.
• AWS.EKS.DescribeCluster.status — The current status of the cluster.
• AWS.EKS.DescribeCluster.clientRequestToken — A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
• AWS.EKS.DescribeCluster.platformVersion — The platform version of your Amazon EKS cluster.
• AWS.EKS.DescribeCluster.tags — A dictionary containing metadata for categorization and organization.
• AWS.EKS.DescribeCluster.id — The ID of your local Amazon EKS cluster on an Amazon Web Services Outpost.
• AWS.EKS.DescribeCluster.resourcesVpcConfig.subnetIds — The subnets associated with your cluster.
• AWS.EKS.DescribeCluster.resourcesVpcConfig.securityGroupIds — The security groups associated with the cross-account elastic network interfaces that are used to allow communication between your nodes and the Kubernetes control plane.
• AWS.EKS.DescribeCluster.resourcesVpcConfig.clusterSecurityGroupId — The cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication.
• AWS.EKS.DescribeCluster.resourcesVpcConfig.vpcId — The VPC associated with your cluster.
• AWS.EKS.DescribeCluster.resourcesVpcConfig.endpointPublicAccess — Whether the public API server endpoint is enabled.
• AWS.EKS.DescribeCluster.resourcesVpcConfig.endpointPrivateAccess — This parameter indicates whether the Amazon EKS private API server endpoint is enabled.
• AWS.EKS.DescribeCluster.resourcesVpcConfig.publicAccessCidrs — The CIDR blocks that are allowed access to your cluster’s public Kubernetes API server endpoint.
• AWS.EKS.DescribeCluster.kubernetesNetworkConfig.serviceIpv4Cidr — The CIDR block that Kubernetes Pod and Service object IP addresses are assigned from.
• AWS.EKS.DescribeCluster.kubernetesNetworkConfig.serviceIpv6Cidr — The CIDR block that Kubernetes Pod and Service IP addresses are assigned from if you created a 1.21 or later cluster with version 1.10.1 or later of the Amazon VPC CNI add-on and specified ipv6 for ipFamily when you created the cluster.
• AWS.EKS.DescribeCluster.kubernetesNetworkConfig.ipFamily — The IP family used to assign Kubernetes Pod and Service objects IP addresses.
• AWS.EKS.DescribeCluster.logging.clusterLogging — The cluster control plane logging configuration for your cluster.
• AWS.EKS.DescribeCluster.certificateAuthority.data — The Base64-encoded certificate data required to communicate with your cluster.
• AWS.EKS.DescribeCluster.encryptionConfig.resources — Specifies the resources to be encrypted. The only supported value is secrets.
• AWS.EKS.DescribeCluster.encryptionConfig.provider — Key Management Service (KMS) key.
• AWS.EKS.DescribeCluster.connectorConfig.activationId — A unique ID associated with the cluster for registration purposes.
• AWS.EKS.DescribeCluster.connectorConfig.activationCode — A unique code associated with the cluster for registration purposes.
• AWS.EKS.DescribeCluster.connectorConfig.activationExpiry — The expiration time of the connected cluster.
• AWS.EKS.DescribeCluster.connectorConfig.provider — The cluster’s cloud service provider.
• AWS.EKS.DescribeCluster.connectorConfig.roleArn — The Amazon Resource Name (ARN) of the role to communicate with services from the connected Kubernetes cluster.
• AWS.EKS.DescribeCluster.health.issues — An object representing the health issues of your local Amazon EKS cluster on an Amazon Web Services Outpost.
• AWS.EKS.DescribeCluster.outpostConfig.outpostArns — An object representing the configuration of your local Amazon EKS cluster on an Amazon Web Services Outpost.
• AWS.EKS.DescribeCluster.outpostConfig.controlPlaneInstanceType — The Amazon EC2 instance type used for the control plane.
• AWS.EKS.DescribeCluster.outpostConfig.controlPlanePlacement — An object representing the placement configuration for all the control plane instances of your local Amazon EKS cluster on an Amazon Web Services Outpost.
• AWS.EKS.DescribeCluster.accessConfig.bootstrapClusterCreatorAdminPermissions — Specifies whether or not the cluster creator IAM principal was set as a cluster admin access entry during cluster creation time.
• AWS.EKS.DescribeCluster.accessConfig.authenticationMode — The current authentication mode of the cluster.
• AWS.IAM.Roles.RoleName — The friendly name that identifies the role.
• AWS.IAM.Roles.RoleId — The stable and unique string identifying the role.
• AWS.IAM.Roles.Arn — The Amazon Resource Name (ARN) specifying the role.
• AWS.IAM.Roles.CreateDate — The date and time, when the role was created.
• AWS.IAM.Roles.Path — The path to the role.
• AWS.IAM.Roles.AssumeRolePolicyDocument — he policy that grants an entity permission to assume the role.
• AWS.IAM.Roles.Description — A description of the role that you provide.
• AWS.IAM.Roles.MaxSessionDuration — The maximum session duration (in seconds) for the specified role.
• AWS.IAM.Policies.PolicyName — The friendly name (not ARN) identifying the policy.
• AWS.IAM.Policies.PolicyId — The stable and unique string identifying the policy.
• AWS.IAM.Policies.Arn — The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
• AWS.IAM.Policies.Path — The path to the policy.
• AWS.IAM.Policies.DefaultVersionId — The identifier for the version of the policy that is set as the default version.
• AWS.IAM.Policies.Description — A friendly description of the policy.
• AWS.IAM.Policies.CreateDate — The date and time, in ISO 8601 date-time format , when the policy was created.
• AWS.IAM.Policies.UpdateDate — The date and time, in ISO 8601 date-time format , when the policy was last updated.
• AWS.EKS.CreateAccessEntry.clusterName — The name of the cluster.
• AWS.EKS.CreateAccessEntry.principalArn — The ARN of the IAM principal for the access entry.
• AWS.EKS.CreateAccessEntry.kubernetesGroups — A list of names that you’ve specified in a Kubernetes RoleBinding or ClusterRoleBinding object so that Kubernetes authorizes the principalARN access to cluster objects.
• AWS.EKS.CreateAccessEntry.accessEntryArn — The ARN of the access entry.
• AWS.EKS.CreateAccessEntry.createdAt — The creation date of the object.
• AWS.EKS.CreateAccessEntry.modifiedAt — The date and time for the last modification to the object.
• AWS.EKS.CreateAccessEntry.tags — A dictionary containing metadata for categorization and organization.
• AWS.EKS.CreateAccessEntry.username — The name of a user that can authenticate to the cluster.
• AWS.EKS.CreateAccessEntry.type — The type of the access entry.
• AWS.EKS.AssociatedAccessPolicy.clusterName — The name of your cluster.
• AWS.EKS.AssociatedAccessPolicy.principalArn — The ARN of the IAM principal for the AccessEntry.
• AWS.EKS.AssociatedAccessPolicy.policyArn — The ARN of the AccessPolicy.
• AWS.EKS.AssociatedAccessPolicy.associatedAt — The date and time the AccessPolicy was associated with an AccessEntry.
• AWS.EKS.AssociatedAccessPolicy.modifiedAt — The date and time for the last modification to the object.
• AWS.EKS.AssociatedAccessPolicy.accessScope.type — The scope type of an access policy.
• AWS.EKS.AssociatedAccessPolicy.accessScope.namespaces — A Kubernetes namespace that an access policy is scoped to.
• AWS.EKS.UpdateAccessEntry.clusterName — The name of your cluster.
• AWS.EKS.UpdateAccessEntry.principalArn — The ARN of the IAM principal for the access entry.
• AWS.EKS.UpdateAccessEntry.kubernetesGroups — A list of names that you’ve specified in a Kubernetes RoleBinding or ClusterRoleBinding object so that Kubernetes authorizes the principalARN access to cluster objects.
• AWS.EKS.UpdateAccessEntry.accessEntryArn — The ARN of the access entry.
• AWS.EKS.UpdateAccessEntry.createdAt — The creation date of the object.
• AWS.EKS.UpdateAccessEntry.modifiedAt — The date and time for the last modification to the object.
• AWS.EKS.UpdateAccessEntry.tags — Metadata that assists with categorization and organization. Each tag consists of a key and an optional value.
• AWS.EKS.UpdateAccessEntry.username — The name of a user that can authenticate to your cluster.
• AWS.EKS.UpdateAccessEntry.type — The type of the access entry.
• AWS.Lambda.Layers.LayerVersionArn — The ARN of the layer version.
• AWS.Lambda.Layers.LayerArn — The ARN of the layer.
• AWS.Lambda.Layers.Description — The description of the version.
• AWS.Lambda.Layers.CreatedDate — The date that the layer version was created, in ISO-8601 format (YYYY-MM-DDThh:mm:ss.sTZD).
• AWS.Lambda.Layers.Version — The version number.
• AWS.Lambda.Layers.CompatibleRuntimes — The layer’s compatible runtimes.
• AWS.Lambda.Layers.CompatibleArchitectures — The layer’s compatible architectures.
• AWS.Lambda.Functions.FunctionName — The name of the function.
• AWS.Lambda.Functions.FunctionArn — The function’s Amazon Resource Name (ARN).
• AWS.Lambda.Functions.Runtime — The identifier of the function’s runtime. Runtime is required if the deployment package is a .zip file archive.
• AWS.Lambda.Functions.Role — The function’s execution role.
• AWS.Lambda.Functions.Handler — The function that Lambda calls to begin running your function.
• AWS.Lambda.Functions.Description — The function’s description.
• AWS.Lambda.Functions.PackageType — The type of deployment package. Set to Image for container image and set Zip for .zip file archive.
• AWS.Lambda.Functions.LastModified — The date and time that the function was last updated, in ISO-8601 format (YYYY-MM-DDThh:mm:ss.sTZD).
• AWS.Lambda.Functions.Timeout — The amount of time in seconds that Lambda allows a function to run before stopping it.
• AWS.Lambda.Functions.VpcConfig.SubnetIds — A list of VPC subnet IDs.
• AWS.Lambda.Functions.VpcConfig.SecurityGroupIds — A list of VPC security group IDs.
• AWS.Lambda.Functions.VpcConfig.VpcId — The ID of the VPC.
• AWS.Lambda.Functions.VpcConfig.Ipv6AllowedForDualStack — Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets.
• AWS.EKS.UpdateCluster.clusterName — The name of the cluster.
• AWS.EKS.UpdateCluster.id — The ID of the update.
• AWS.EKS.UpdateCluster.status — The status of the update.
• AWS.EKS.UpdateCluster.type — The type of the update.
• AWS.EKS.UpdateCluster.params — The parameters of the update.
• AWS.EKS.UpdateCluster.createdAt — The creation date of the object.
• File.Name — The name of the file.
• File.EntryID — The entry ID of the file.
• File.Type — The file type.
• File.Extension — The file extension.
• File.SHA256 — The SHA256 hash of the file.
• ZipFile.ZippedFile — The zipped file.
• AWS.EC2.Vpcs.VpcEndpoint.VpcEndpointId — The ID of the endpoint.
• AWS.EC2.Vpcs.VpcEndpoint.State — The state of the VPC endpoint.
• AWS.EC2.Vpcs.VpcEndpoint.ServiceName — The service name of the VPC endpoint.
• AWS.EC2.Vpcs.VpcEndpoint.VpcId — The ID of the VPC to which the endpoint is associated.
• AWS.EC2.Vpcs.VpcEndpoint.EndpointType — The type of the VPC endpoint.
• AWS.EC2.Vpcs.VpcId — The ID of the VPC.
• AWS.EC2.Vpcs.AccountId — The ID of the AWS account with which the EC2 instance is associated. This key is only present when the parameter "AWS organization accounts" is provided.
• AWS.EC2.Vpcs.State — The current state of the VPC.
• AWS.EC2.Vpcs.CidrBlock — The primary IPv4 CIDR block for the VPC.
• AWS.EC2.Vpcs.Tags.Key — The key of the tag.
• AWS.EC2.Vpcs.Tags.Value — The value of the tag.
• AWS.EC2.Vpcs.Tags.Ipv6CidrBlockAssociationSet.AssociationId — The association ID for the IPv6 CIDR block.
• AWS.EC2.Vpcs.Tags.Ipv6CidrBlockAssociationSet.Ipv6CidrBlock — The IPv6 CIDR block.
• AWS.EC2.Vpcs.Tags.Ipv6CidrBlockAssociationSet.Ipv6CidrBlockState.State — The state of the CIDR block.
• AWS.EC2.Vpcs.Tags.Ipv6CidrBlockAssociationSet.Ipv6CidrBlockState.StatusMessage — A message about the status of the CIDR block, if applicable.
• AWS.EC2.Vpcs.Tags.CidrBlockAssociationSet.AssociationId — The association ID for the IPv4 CIDR block.
• AWS.EC2.Vpcs.Tags.CidrBlockAssociationSet.CidrBlock — The IPv4 CIDR block.
• AWS.EC2.Vpcs.Tags.CidrBlockAssociationSet.CidrBlockState.State — The state of the CIDR block.
• AWS.EC2.Vpcs.Tags.CidrBlockAssociationSet.CidrBlockState.StatusMessage — A message about the status of the CIDR block, if applicable.
• AWS.EC2.SecurityGroups.GroupName — The name of the security group.
• AWS.EC2.SecurityGroups.Description — A description for the security group.
• AWS.EC2.SecurityGroups.VpcId — The ID of the VPC.
• AWS.EC2.SecurityGroups.GroupId — The ID of the security group.
• AWS.EC2.SecurityGroups.AccountId — The ID of the AWS account with which the EC2 instance is associated. This key is only present when the parameter "AWS organization accounts" is provided.
• ErrorEntries — Contents of the errors associated with the entry/entries.

Commands used

• aws-ec2-authorize-security-group-ingress-rule
• aws-ec2-create-security-group
• aws-ec2-create-vpc-endpoint
• aws-ec2-describe-vpcs
• aws-eks-associate-access-policy
• aws-eks-create-access-entry
• aws-eks-describe-cluster
• aws-eks-update-access-entry
• aws-eks-update-cluster-config
• aws-iam-attach-policy
• aws-iam-create-policy
• aws-iam-create-role
• aws-lambda-create-function
• aws-lambda-publish-layer-version