threat_intel_downloader module now uses tf_lambda module

streamalert/shared/__init__.py

@@ -5,5 +5,6 @@
 CLASSIFIER_FUNCTION_NAME = 'classifier'
 RULES_ENGINE_FUNCTION_NAME = 'rules_engine'
 RULE_PROMOTION_NAME = 'rule_promotion'
+THREAT_INTEL_DOWNLOADER_NAME = 'threat_intel_downloader'
 
 CLUSTERED_FUNCTIONS = {CLASSIFIER_FUNCTION_NAME}

streamalert_cli/terraform/threat_intel_downloader.py

@@ -13,8 +13,10 @@
 See the License for the specific language governing permissions and
 limitations under the License.
 """
+from streamalert.shared import THREAT_INTEL_DOWNLOADER_NAME
 from streamalert_cli.manage_lambda.package import ThreatIntelDownloaderPackage
 from streamalert_cli.terraform.common import infinitedict, monitoring_topic_name
+from streamalert_cli.terraform.lambda_module import generate_lambda
 
 
 def generate_threat_intel_downloader(config):
@@ -29,24 +31,39 @@ def generate_threat_intel_downloader(config):
     # Use the monitoring topic as a dead letter queue
     dlq_topic = monitoring_topic_name(config)
 
+    prefix = config['global']['account']['prefix']
+
     # Threat Intel Downloader module
-    ti_downloader_config = config['lambda']['threat_intel_downloader_config']
-    ti_downloader_dict = infinitedict()
-    ti_downloader_dict['module']['threat_intel_downloader'] = {
+    tid_config = config['lambda']['threat_intel_downloader_config']
+
+    # old format of config used interval, but tf_lambda expects 'schedule_expression'
+    if 'schedule_expression' not in tid_config:
+        tid_config['schedule_expression'] = tid_config.get('interval', 'rate(1 day)')
+
+    result = infinitedict()
+
+    # Set variables for the threat intel downloader configuration
+    result['module']['threat_intel_downloader_iam'] = {
+        'source': './modules/tf_threat_intel_downloader',
         'account_id': config['global']['account']['aws_account_id'],
         'region': config['global']['account']['region'],
-        'source': './modules/tf_threat_intel_downloader',
-        'lambda_handler': ThreatIntelDownloaderPackage.lambda_handler,
-        'lambda_memory': ti_downloader_config.get('memory', '128'),
-        'lambda_timeout': ti_downloader_config.get('timeout', '60'),
-        'lambda_log_level': ti_downloader_config.get('log_level', 'info'),
-        'interval': ti_downloader_config.get('interval', 'rate(1 day)'),
-        'prefix': config['global']['account']['prefix'],
+        'prefix': prefix,
+        'function_role_id': '${module.threat_intel_downloader.role_id}',
+        'function_alias_arn': '${module.threat_intel_downloader.function_alias_arn}',
+        'function_cloudwatch_log_group_name': '${module.threat_intel_downloader.log_group_name}',
         'monitoring_sns_topic': dlq_topic,
-        'table_rcu': ti_downloader_config.get('table_rcu', '10'),
-        'table_wcu': ti_downloader_config.get('table_wcu', '10'),
-        'max_read_capacity': ti_downloader_config.get('max_read_capacity', '5'),
-        'min_read_capacity': ti_downloader_config.get('min_read_capacity', '5'),
-        'target_utilization': ti_downloader_config.get('target_utilization', '70')
+        'table_rcu': tid_config.get('table_rcu', '10'),
+        'table_wcu': tid_config.get('table_wcu', '10'),
+        'max_read_capacity': tid_config.get('max_read_capacity', '5'),
+        'min_read_capacity': tid_config.get('min_read_capacity', '5'),
+        'target_utilization': tid_config.get('target_utilization', '70')
     }
-    return ti_downloader_dict
+
+    result['module']['threat_intel_downloader'] = generate_lambda(
+        '{}_streamalert_{}'.format(prefix, THREAT_INTEL_DOWNLOADER_NAME),
+        ThreatIntelDownloaderPackage.package_name + '.zip',
+        ThreatIntelDownloaderPackage.lambda_handler,
+        tid_config,
+        config,
+    )
+    return result

terraform/modules/tf_threat_intel_downloader/iam.tf

@@ -1,31 +1,7 @@
-// IAM Role: Execution Role
-resource "aws_iam_role" "threat_intel_downloader" {
-  name               = "${var.prefix}_threat_intel_downloader"
-  path               = "/streamalert/"
-  assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json
-
-  tags = {
-    Name = "StreamAlert"
-  }
-}
-
-// IAM Policy Doc: Generic Lambda AssumeRole
-data "aws_iam_policy_document" "lambda_assume_role_policy" {
-  statement {
-    effect  = "Allow"
-    actions = ["sts:AssumeRole"]
-
-    principals {
-      type        = "Service"
-      identifiers = ["lambda.amazonaws.com"]
-    }
-  }
-}
-
 // IAM Role Policy: Allow lambda function to invoke the Lambda Function
 resource "aws_iam_role_policy" "threat_intel_downloader" {
   name   = "InvokeLambda"
-  role   = aws_iam_role.threat_intel_downloader.id
+  role   = var.function_role_id
   policy = data.aws_iam_policy_document.invoke_lambda_function.json
 }
 
@@ -39,15 +15,15 @@ data "aws_iam_policy_document" "invoke_lambda_function" {
     ]
 
     resources = [
-      aws_lambda_function.threat_intel_downloader.arn,
+      var.function_alias_arn
     ]
   }
 }
 
 // IAM Role Policy: Allow the lambda function to create/update CloudWatch logs
 resource "aws_iam_role_policy" "cloudwatch_logs" {
   name   = "WriteToCloudwatchLogs"
-  role   = aws_iam_role.threat_intel_downloader.id
+  role   = var.function_role_id
   policy = data.aws_iam_policy_document.cloudwatch_logs_policy.json
 }
 
@@ -61,7 +37,7 @@ data "aws_iam_policy_document" "cloudwatch_logs_policy" {
     ]
 
     resources = [
-      aws_cloudwatch_log_group.threat_intel_downloader.arn,
+      var.function_cloudwatch_log_group_name
     ]
   }
 
@@ -74,15 +50,15 @@ data "aws_iam_policy_document" "cloudwatch_logs_policy" {
     ]
 
     resources = [
-      "arn:aws:logs:${var.region}:${var.account_id}:log-group:${aws_cloudwatch_log_group.threat_intel_downloader.name}:log-stream:*",
+      "arn:aws:logs:${var.region}:${var.account_id}:log-group:${var.function_cloudwatch_log_group_name}:log-stream:*",
     ]
   }
 }
 
 // IAM role policy: Allow lambda function to read/write data from DynamoDB
 resource "aws_iam_role_policy" "read_write_dynamodb" {
   name   = "ReadDynamoDB"
-  role   = aws_iam_role.threat_intel_downloader.id
+  role   = var.function_role_id
   policy = data.aws_iam_policy_document.read_write_dynamodb.json
 }
 
@@ -107,7 +83,7 @@ data "aws_iam_policy_document" "read_write_dynamodb" {
 // IAM role policy: Allow lambda function to read from parameter store
 resource "aws_iam_role_policy" "get_api_creds_from_ssm" {
   name   = "GetSSMParams"
-  role   = aws_iam_role.threat_intel_downloader.id
+  role   = var.function_role_id
   policy = data.aws_iam_policy_document.get_api_creds_from_ssm.json
 }
 
@@ -129,7 +105,7 @@ data "aws_iam_policy_document" "get_api_creds_from_ssm" {
 // IAM Role Policy: Allow the Threat Intel Downloader function to publish sns (used for DLQ)
 resource "aws_iam_role_policy" "theat_intel_downloader_publish_sns" {
   name   = "PublishToSNS"
-  role   = aws_iam_role.threat_intel_downloader.id
+  role   = var.function_role_id
   policy = data.aws_iam_policy_document.theat_intel_downloader_publish_sns.json
 }
 

terraform/modules/tf_threat_intel_downloader/variables.tf

@@ -10,37 +10,27 @@ variable "prefix" {
   type = string
 }
 
-variable "lambda_handler" {
+variable "function_role_id" {
+  description = "Threat Intel Downloader function IAM Role ID, exported from the tf_lambda module"
 }
 
-variable "lambda_memory" {
-  type    = string
-  default = "128"
+variable "function_alias_arn" {
+  description = "Threat Intel Downloader function alias arn, exported from the tf_lambda module"
 }
 
-variable "lambda_timeout" {
-  type    = string
-  default = "120"
-}
-
-variable "filename" {
-  type    = string
-  default = "threat_intel_downloader.zip"
+variable "function_cloudwatch_log_group_name" {
+  description = "Threat Intel Downloader function cloudwatch log group name, exported from the tf_lambda module"
 }
 
-variable "lambda_log_level" {
+variable "parameter_name" {
+  default = "threat_intel_downloader_api_creds"
   type    = string
-  default = "info"
 }
 
-variable "enable_metrics" {
-  default = false
+variable "monitoring_sns_topic" {
 }
 
-variable "interval" {
-  type    = string
-  default = "rate(1 day)"
-}
+// ***** DynamoDB Table configuration *****
 
 variable "table_rcu" {
   default = 10
@@ -50,18 +40,6 @@ variable "table_wcu" {
   default = 10
 }
 
-variable "parameter_name" {
-  default = "threat_intel_downloader_api_creds"
-  type    = string
-}
-
-variable "monitoring_sns_topic" {
-}
-
-variable "log_retention" {
-  default = 14
-}
-
 variable "max_read_capacity" {
   default = 5
 }