template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: LM Okta log collector

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
    Function:
        Timeout: !Ref FunctionTimeoutInSeconds
Mappings:
  Constants:
    LMOktaLogCollector:
      Version: 0.0.1
Parameters:
  LMCompanyName:
    Type: String
    Description: The LogicMonitor account name. If your domain is mycompany.logicmonitor.com, then it is mycompany
  LMAccessId:
    Type: String
    NoEcho: true
    Default: ""
    Description: The LM API tokens access ID
  LMAccessKey:
    Type: String
    NoEcho: true
    Default: ""
    Description: The LM API tokens access key
  LMBearerToken:
    Type: String
    NoEcho: true
    Default: ""
    Description: The LM API Bearer token. (You must specify LMBearerToken if not providing LMAccessId, LMAccessKey. In case you provide all, LMAccessId and LMAccessKey will be used to authenticate with Logicmonitor.  )
  OktaDomain:
    Type: String
    AllowedPattern: ^(?!-)[A-Za-z0-9-]+([\-\.]{1}[a-z0-9]+)*\.[A-Za-z]{2,6}
    Description: okta domain eg "company.okta.com".
  OktaAPIKey:
    Type: String
    NoEcho: true
    Description: Okta API key to fetch logs from okta.
  LMResourceId:
    Type: String
    Description: "Ignored when LMLogsServiceName is specified. Is a json for resource mapping. if specified as {\"system.hostname\" : \"prod-node-us-west-1\"} all logs will be mapped against the device with property system.hostname = prod-node-us-west-1"
  LMLogsServiceName:
    Type: String
    Default: "okta-system-logs"
    Description: This will be used for anomaly detection.
  FunctionName:
    Type: String
    Default: LM-Okta-Log-Collector
    Description: The name for lambda function.
  IncludeMetadataKeys:
    Type: String
    Default: 'severity,actor.displayName,actor.type,actor.alternateId,client.geographicalContext.city,displayMessage,eventType,target'
    Description: comma separated keys to add as event metadata in a lm-log event. for nested json specify '.' eg - actor.displayname,actor.type
  FunctionMemorySize:
    Type: Number
    Default: 2048
    MinValue: 128
    MaxValue: 4096
    Description:  The memory size for the OKTA Log Collector lambda function in MBs. CPU power assigned is proportional to the memory size. See https://docs.aws.amazon.com/lambda/latest/operatorguide/computing-power.html
  FunctionTimeoutInSeconds:
    Type: Number
    Default: 110
    MinValue: 20
    Description: The timeout for the OKTA Log Collector lambda function in Seconds
  ScheduleExpression:
    Type: String
    Default: "rate(2 minutes)"
    Description: Cron expression for this lambda function. "rate(2 minutes)" means, function will be triggered every 2 minutes. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html for more details.



Conditions:
  AccessIdEmpty: !Equals [!Ref LMAccessId, ""]
  AccessKeyEmpty: !Equals [!Ref LMAccessKey, ""]
  MustUseBearerTokenForAuth: !Or
    - !Condition AccessIdEmpty
    - !Condition AccessKeyEmpty
  UseLMV1ForAuth: !Not [!Condition MustUseBearerTokenForAuth]


Rules:
  NoAccessIdKeyProvided:
    RuleCondition: !Or [!Equals [!Ref LMAccessId, ""], !Equals [!Ref LMAccessKey, ""]]
    Assertions:
      - AssertDescription: Please specify either LMAccessId, LMAccessKey both or LMBearerToken to authenticate with Logicmonitor.
        Assert: !Not
          - !Equals
            - !Ref LMBearerToken
            - ""

Resources:

    LRTBucket:
        Type: AWS::S3::Bucket

    oktaLogCollector :
        Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
        DependsOn: OktaLogCollectorZip
        Properties:
            FunctionName:
              Ref: FunctionName
            CodeUri:
              Bucket: !Ref OktaLogCollectorZipsBucket
              Key: main.zip
            Handler: oktalogcollector.collector.lambda_handler
            Runtime: python3.9
            MemorySize: !Ref FunctionMemorySize
            Policies:
                - S3CrudPolicy:
                      BucketName: !Ref LRTBucket
                - Version: "2012-10-17"
                  Statement:
                    - Effect: Allow
                      Action:
                        - secretsmanager:GetSecretValue
                        - secretsmanager:DescribeSecret
                      Resource:
                        - Ref: OktaAPIKeySecret
                        - !If [UseLMV1ForAuth, !Ref AccessIdSecret, !Ref AWS::NoValue]
                        - !If [UseLMV1ForAuth, !Ref AccessKeySecret, !Ref AWS::NoValue]
                        - !If [MustUseBearerTokenForAuth, !Ref BearerTokenSecret, !Ref AWS::NoValue]

            Environment: # More info about Env Vars: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#environment-object
                Variables:
                  # last report time persistence config
                    LRT_S3_BUCKET : !Ref LRTBucket

                  # config for okta log collection.
                    OKTA_DOMAIN : !Ref OktaDomain
                    OKTA_API_KEY : !Ref OktaAPIKeySecret

                  # config for log-ingestion
                    COMPANY_NAME : !Ref LMCompanyName
                    LM_KEY_SERVICE : !Ref LMLogsServiceName
                    LM_RESOURCE_ID : !Ref LMResourceId
                    INCLUDE_METADATA_KEYS : !Ref IncludeMetadataKeys
                    LM_SERVICE_NAME_KEY : !Ref LMLogsServiceName
                    LM_ACCESS_ID : !If [UseLMV1ForAuth,!Ref AccessIdSecret, "" ]
                    LM_ACCESS_KEY : !If [UseLMV1ForAuth,!Ref AccessKeySecret, "" ]
                    LM_BEARER_TOKEN : !If [MustUseBearerTokenForAuth, !Ref BearerTokenSecret, ""]

            Events:
                oktaLogCollectionScheduleEvent:
                    Type: Schedule
                    Properties:
                        Schedule: !Ref ScheduleExpression
                        Enabled: True
    version:
      Type: AWS::Lambda::Version
      Properties:
        FunctionName: !Ref oktaLogCollector

    lambdaRetryConfig:
      Type: AWS::Lambda::EventInvokeConfig
      Properties:
        FunctionName: !Ref oktaLogCollector
        MaximumRetryAttempts: 0 # Back-filling will be performed in next lamda invocation in case of lambda timeouts
        Qualifier: !GetAtt version.Version

    OktaLogCollectorZipsBucket:
      Type: AWS::S3::Bucket
      Properties:
        BucketEncryption:
          ServerSideEncryptionConfiguration:
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: AES256
        PublicAccessBlockConfiguration:
          BlockPublicAcls: true
          BlockPublicPolicy: true
          IgnorePublicAcls: true
          RestrictPublicBuckets: true
    OktaLogCollectorZip:
      Type: Custom::OktaLogCollectorZip
      Properties:
        ServiceToken: !GetAtt "OktaLogCollectorZipCopier.Arn"
        DestZipsBucket: !Ref "OktaLogCollectorZipsBucket"
        LRTBucket: !Ref "LRTBucket"
        SourceZipUrl:
          Fn::Sub:
            - "https://lm-logs-okta-collector.s3.amazonaws.com/stable/code/${LMOktaLogCollectorVersion}/lambda.zip"
            - {
              LMOktaLogCollectorVersion:
                !FindInMap [ Constants, LMOktaLogCollector, Version ],
            }


    OktaLogCollectorZipCopier:
      Type: AWS::Serverless::Function
      Properties:
        Description: Copies Logic Monitor okta-log-collector zip to the destination S3 bucket
        Handler: index.handler
        Runtime: python3.9
        Timeout: 300
        InlineCode: |
          import json
          import logging
          import threading
          import boto3
          import urllib.request
          import os

          logger = logging.getLogger()
          logger.setLevel(logging.INFO)

          def send_cfn_resp(event, context, response_status):
              resp_body = json.dumps({
                  'Status': response_status,
                  'Reason': f'See reasons in CloudWatch Logs - group: {context.log_group_name}, stream:{context.log_stream_name}',
                  'PhysicalResourceId': context.log_stream_name,
                  'StackId': event['StackId'],
                  'RequestId': event['RequestId'],
                  'LogicalResourceId': event['LogicalResourceId'],
                  'Data': {}
              }).encode('utf-8')
              req = urllib.request.Request(url=event['ResponseURL'], data=resp_body, method='PUT')
              with urllib.request.urlopen(req) as f:
                  logger.info(f'Sent response to CloudFormation: {f.status}, {f.reason}')
          def delete_zips(bucket):
              s3 = boto3.resource('s3')
              bucket = s3.Bucket(bucket)
              bucket.objects.all().delete()
          def copy_zip(source_zip_url, dest_zips_bucket):
              s3 = boto3.client('s3')
              filename = "main.zip"
              with urllib.request.urlopen(source_zip_url) as data:
                  s3.upload_fileobj(data, dest_zips_bucket, filename)
          def clear_lrt_bucket(bucket):
              s3 = boto3.resource('s3')
              bucket = s3.Bucket(bucket)
              bucket.objects.all().delete()
          def timeout(event, context):
              logger.error('Execution is about to time out, sending failure response to CloudFormation')
              send_cfn_resp(event, context, 'FAILED')
          def handler(event, context):
              timer = threading.Timer((context.get_remaining_time_in_millis()
                          / 1000.00) - 0.5, timeout, args=[event, context])
              timer.start()
              logger.info(f'Received event: {json.dumps(event)}')
              try:
                  source_zip_url = event['ResourceProperties']['SourceZipUrl']
                  dest_zips_bucket = event['ResourceProperties']['DestZipsBucket']
                  LRTBucket = event['ResourceProperties']['LRTBucket']
                  if event['RequestType'] == 'Delete':
                      logger.info(f'Deleting : {dest_zips_bucket}')
                      delete_zips(dest_zips_bucket)
                      clear_lrt_bucket(LRTBucket)
                  else:
                      logger.info(f'Copying zip from : {source_zip_url} to {dest_zips_bucket}')
                      copy_zip(source_zip_url, dest_zips_bucket)
              except Exception as e:
                  logger.exception(f'Exception when copying zip from {source_zip_url} to {dest_zips_bucket}')
                  send_cfn_resp(event, context, 'FAILED')
              else:
                  send_cfn_resp(event, context, 'SUCCESS')
              finally:
                  timer.cancel()

        Policies:
          - Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:DeleteObject
                Resource:
                  - Fn::Join:
                      - "/"
                      - - Fn::GetAtt: "OktaLogCollectorZipsBucket.Arn"
                        - "*"
              - Effect: Allow
                Action:
                  - s3:DeleteObject
                Resource:
                  - Fn::Join:
                      - "/"
                      - - Fn::GetAtt: "LRTBucket.Arn"
                        - "*"
              - Effect: Allow
                Action:
                  - s3:ListBucket
                Resource:
                  - Fn::GetAtt: "OktaLogCollectorZipsBucket.Arn"
                  - Fn::GetAtt: "LRTBucket.Arn"
        Environment:
          Variables:
            LM_OKTA_LOG_COLLECTOR_VERSION: !FindInMap [ Constants, LMOktaLogCollector, Version ]


    AccessKeySecret:
      Type: AWS::SecretsManager::Secret
      Condition: UseLMV1ForAuth
      Properties:
        Description: Logic Monitor Access Key
        SecretString:
          Ref: LMAccessKey
    AccessIdSecret:
      Type: AWS::SecretsManager::Secret
      Condition: UseLMV1ForAuth
      Properties:
        Description: Logic Monitor Access Id
        SecretString:
          Ref: LMAccessId
    BearerTokenSecret:
      Type: AWS::SecretsManager::Secret
      Condition: MustUseBearerTokenForAuth
      Properties:
        Description: Logic Monitor Bearer Token
        SecretString:
          Ref: LMBearerToken
    OktaAPIKeySecret:
      Type: AWS::SecretsManager::Secret
      Properties:
        Description: Okta API key to fetch logs
        SecretString:
          Ref: OktaAPIKey
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Required
        Parameters:
          - FunctionName
          - OktaDomain
          - OktaAPIKey
          - LMCompanyName
      - Label:
          default: Authenticate with Logicmonitor
        Parameters:  
          - LMAccessId
          - LMAccessKey
          - LMBearerToken
      - Label:
          default: LM Logs (Optional)
        Parameters:
          - LMLogsServiceName
          - LMResourceId
          - IncludeMetadataKeys
      - Label:
          default: Lambda Function (Optional)
        Parameters:
          - ScheduleExpression
          - FunctionMemorySize
          - FunctionTimeoutInSeconds