- remove VPC

theburningmonk · theburningmonk · commit 5708e85765a8 · 2018-10-01T23:37:02.000+02:00
- use function-shield instead
- use wrapper to simplify application of standard middlewares
diff --git a/functions/accept-order.js b/functions/accept-order.js
@@ -4,10 +4,7 @@ const co         = require('co');
 const kinesis    = require('../lib/kinesis');
 const log        = require('../lib/log');
 const cloudwatch = require('../lib/cloudwatch');
-
-const middy         = require('middy');
-const sampleLogging = require('../middleware/sample-logging');
-const captureCorrelationIds = require('../middleware/capture-correlation-ids');
+const wrapper    = require('../middleware/wrapper');
 
 const streamName = process.env.order_events_stream;
 
@@ -53,6 +50,4 @@ const handler = co.wrap(function* (event, context, cb) {
   cb(null, response);
 });
 
-module.exports.handler = middy(handler)
-  .use(captureCorrelationIds({ sampleDebugLogRate: 0.01 }))
-  .use(sampleLogging({ sampleRate: 0.01 }));
+module.exports.handler = wrapper(handler);
diff --git a/functions/fulfill-order.js b/functions/fulfill-order.js
@@ -4,10 +4,7 @@ const co         = require('co');
 const kinesis    = require('../lib/kinesis');
 const log        = require('../lib/log');
 const cloudwatch = require('../lib/cloudwatch');
-
-const middy         = require('middy');
-const sampleLogging = require('../middleware/sample-logging');
-const captureCorrelationIds = require('../middleware/capture-correlation-ids');
+const wrapper    = require('../middleware/wrapper');
 
 const streamName = process.env.order_events_stream;
 
@@ -53,6 +50,4 @@ const handler = co.wrap(function* (event, context, cb) {
   cb(null, response);
 });
 
-module.exports.handler = middy(handler)
-  .use(captureCorrelationIds({ sampleDebugLogRate: 0.01 }))
-  .use(sampleLogging({ sampleRate: 0.01 }));
+module.exports.handler = wrapper(handler);
diff --git a/functions/get-index.js b/functions/get-index.js
@@ -10,11 +10,8 @@ const aws4       = require('../lib/aws4');
 const log        = require('../lib/log');
 const cloudwatch = require('../lib/cloudwatch');
 const AWSXRay    = require('aws-xray-sdk');
-
-const middy         = require('middy');
+const wrapper    = require('../middleware/wrapper');
 const { ssm, secretsManager } = require('middy/middlewares');
-const sampleLogging = require('../middleware/sample-logging');
-const captureCorrelationIds = require('../middleware/capture-correlation-ids');
 
 const STAGE     = process.env.STAGE;
 const awsRegion = process.env.AWS_REGION;
@@ -99,6 +96,8 @@ const handler = co.wrap(function* (event, context, callback) {
 
   cloudwatch.incrCount('RestaurantsReturned', restaurants.length);
 
+  yield http({ uri: 'http://google.com' });
+
   const response = {
     statusCode: 200,
     body: html,
@@ -110,9 +109,7 @@ const handler = co.wrap(function* (event, context, callback) {
   callback(null, response);
 });
 
-module.exports.handler = middy(handler)
-  .use(captureCorrelationIds({ sampleDebugLogRate: 0.01 }))
-  .use(sampleLogging({ sampleRate: 0.01 }))
+module.exports.handler = wrapper(handler)
   .use(ssm({
     cache: true,
     cacheExpiryInMillis: 3 * 60 * 1000, // 3 mins
diff --git a/functions/get-restaurants.js b/functions/get-restaurants.js
@@ -6,10 +6,7 @@ const AWS        = AWSXRay.captureAWS(require('aws-sdk'));
 const dynamodb   = new AWS.DynamoDB.DocumentClient();
 const log        = require('../lib/log');
 const cloudwatch = require('../lib/cloudwatch');
-
-const middy         = require('middy');
-const sampleLogging = require('../middleware/sample-logging');
-const captureCorrelationIds = require('../middleware/capture-correlation-ids');
+const wrapper    = require('../middleware/wrapper');
 
 const defaultResults = process.env.defaultResults || 8;
 const tableName      = process.env.restaurants_table;
@@ -41,6 +38,4 @@ const handler = co.wrap(function* (event, context, cb) {
   cb(null, response);
 });
 
-module.exports.handler = middy(handler)
-  .use(captureCorrelationIds({ sampleDebugLogRate: 0.01 }))
-  .use(sampleLogging({ sampleRate: 0.01 }));
+module.exports.handler = wrapper(handler);
diff --git a/functions/notify-restaurant.js b/functions/notify-restaurant.js
@@ -4,11 +4,8 @@ const co     = require('co');
 const notify = require('../lib/notify');
 const retry  = require('../lib/retry');
 const log    = require('../lib/log');
-
-const middy         = require('middy');
-const sampleLogging = require('../middleware/sample-logging');
+const wrapper = require('../middleware/wrapper');
 const flushMetrics  = require('../middleware/flush-metrics');
-const captureCorrelationIds = require('../middleware/capture-correlation-ids');
 
 const handler = co.wrap(function* (event, context, cb) {
   let events = context.parsedKinesisEvents;
@@ -37,7 +34,5 @@ const handler = co.wrap(function* (event, context, cb) {
   cb(null, "all done");
 });
 
-module.exports.handler = middy(handler)
-  .use(captureCorrelationIds({ sampleDebugLogRate: 0.01 }))
-  .use(sampleLogging({ sampleRate: 0.01 }))
+module.exports.handler = wrapper(handler)
   .use(flushMetrics);
diff --git a/functions/notify-user.js b/functions/notify-user.js
@@ -4,11 +4,9 @@ const co     = require('co');
 const notify = require('../lib/notify');
 const retry  = require('../lib/retry');
 const log    = require('../lib/log');
+const wrapper = require('../middleware/wrapper');
 
-const middy         = require('middy');
-const sampleLogging = require('../middleware/sample-logging');
 const flushMetrics  = require('../middleware/flush-metrics');
-const captureCorrelationIds = require('../middleware/capture-correlation-ids');
 
 const handler = co.wrap(function* (event, context, cb) {
   let events = context.parsedKinesisEvents;
@@ -37,7 +35,5 @@ const handler = co.wrap(function* (event, context, cb) {
   cb(null, "all done");
 });
 
-module.exports.handler = middy(handler)
-  .use(captureCorrelationIds({ sampleDebugLogRate: 0.01 }))
-  .use(sampleLogging({ sampleRate: 0.01 }))
+module.exports.handler = wrapper(handler)
   .use(flushMetrics);
diff --git a/functions/place-order.js b/functions/place-order.js
@@ -7,10 +7,7 @@ const chance         = require('chance').Chance();
 const log            = require('../lib/log');
 const cloudwatch     = require('../lib/cloudwatch');
 const correlationIds = require('../lib/correlation-ids');
-
-const middy         = require('middy');
-const sampleLogging = require('../middleware/sample-logging');
-const captureCorrelationIds = require('../middleware/capture-correlation-ids');
+const wrapper        = require('../middleware/wrapper');
 
 const streamName = process.env.order_events_stream;
 
@@ -68,6 +65,4 @@ const handler = co.wrap(function* (event, context, cb) {
   cb(null, response);
 });
 
-module.exports.handler = middy(handler)
-  .use(captureCorrelationIds({ sampleDebugLogRate: 0.01 }))
-  .use(sampleLogging({ sampleRate: 0.01 }));
+module.exports.handler = wrapper(handler);
diff --git a/functions/retry-notify-restaurant.js b/functions/retry-notify-restaurant.js
@@ -4,11 +4,9 @@ const co         = require('co');
 const notify     = require('../lib/notify');
 const log        = require('../lib/log');
 const cloudwatch = require('../lib/cloudwatch');
+const wrapper    = require('../middleware/wrapper');
 
-const middy         = require('middy');
-const sampleLogging = require('../middleware/sample-logging');
 const flushMetrics  = require('../middleware/flush-metrics');
-const captureCorrelationIds = require('../middleware/capture-correlation-ids');
 
 const handler = co.wrap(function* (event, context, cb) {
   let order = JSON.parse(event.Records[0].Sns.Message);
@@ -33,7 +31,5 @@ const handler = co.wrap(function* (event, context, cb) {
   }
 });
 
-module.exports.handler = middy(handler)
-  .use(captureCorrelationIds({ sampleDebugLogRate: 0.01 }))
-  .use(sampleLogging({ sampleRate: 0.01 }))
+module.exports.handler = wrapper(handler)
   .use(flushMetrics);
diff --git a/functions/retry-notify-user.js b/functions/retry-notify-user.js
@@ -4,11 +4,9 @@ const co         = require('co');
 const notify     = require('../lib/notify');
 const log        = require('../lib/log');
 const cloudwatch = require('../lib/cloudwatch');
+const wrapper    = require('../middleware/wrapper');
 
-const middy         = require('middy');
-const sampleLogging = require('../middleware/sample-logging');
-const flushMetrics  = require('../middleware/flush-metrics');
-const captureCorrelationIds = require('../middleware/capture-correlation-ids');
+const flushMetrics = require('../middleware/flush-metrics');
 
 const handler = co.wrap(function* (event, context, cb) {
   let order = JSON.parse(event.Records[0].Sns.Message);
@@ -33,7 +31,5 @@ const handler = co.wrap(function* (event, context, cb) {
   }
 });
 
-module.exports.handler = middy(handler)
-  .use(captureCorrelationIds({ sampleDebugLogRate: 0.01 }))
-  .use(sampleLogging({ sampleRate: 0.01 }))
+module.exports.handler = wrapper(handler)
   .use(flushMetrics);
diff --git a/functions/search-restaurants.js b/functions/search-restaurants.js
@@ -6,9 +6,7 @@ const AWS        = AWSXRay.captureAWS(require('aws-sdk'));
 const dynamodb   = new AWS.DynamoDB.DocumentClient();
 const log        = require('../lib/log');
 const cloudwatch = require('../lib/cloudwatch');
-
-const middy         = require('middy');
-const sampleLogging = require('../middleware/sample-logging');
+const wrapper    = require('../middleware/wrapper');
 
 const defaultResults = process.env.defaultResults || 8;
 const tableName      = process.env.restaurants_table;
@@ -45,5 +43,4 @@ const handler = co.wrap(function* (event, context, cb) {
   cb(null, response);
 });
 
-module.exports.handler = middy(handler)
-  .use(sampleLogging({ sampleRate: 0.01 }));
+module.exports.handler = wrapper(handler);
diff --git a/middleware/function-shield.js b/middleware/function-shield.js
@@ -0,0 +1,20 @@
+'use strict';
+
+const FuncShield = require('@puresec/function-shield');
+
+module.exports = () => {
+  return {
+    before: (handler, next) => {
+      FuncShield.configure({
+        policy: {
+          outbound_connectivity: "block",
+          read_write_tmp: "block", 
+          create_child_process: "block"
+        },
+        token: process.env.FUNCTION_SHIELD_TOKEN
+      });
+
+      next();
+    }
+  };
+};
diff --git a/middleware/wrapper.js b/middleware/wrapper.js
@@ -0,0 +1,13 @@
+'use strict';
+
+const middy = require('middy');
+const sampleLogging = require('./sample-logging');
+const captureCorrelationIds = require('./capture-correlation-ids');
+const functionShield = require('./function-shield');
+
+module.exports = f => {
+  return middy(f)
+    .use(captureCorrelationIds({ sampleDebugLogRate: 0.01 }))
+    .use(sampleLogging({ sampleRate: 0.01 }))
+    .use(functionShield());
+};
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -10,6 +10,7 @@
     "author": "",
     "license": "ISC",
     "dependencies": {
+        "@puresec/function-shield": "^1.0.7",
         "aws-xray-sdk": "^1.2.0",
         "bluebird": "^3.5.1",
         "chance": "^1.0.13",
@@ -29,7 +30,6 @@
         "serverless-iam-roles-per-function": "^0.1.5",
         "serverless-plugin-tracing": "^2.0.0",
         "serverless-pseudo-parameters": "^1.2.5",
-        "serverless-sam": "0.0.3",
-        "serverless-vpc-discovery": "^1.0.12"
+        "serverless-sam": "0.0.3"
     }
 }
diff --git a/serverless.yml b/serverless.yml
