LmbdUtil.psm1

<#
 # This module includes utility functions that are based on
 #
 # the AWSPowerShell module and AWSSDK to provide help administering
 # 
 # relevant tasks for AWS lambda functions.
 #>

<#
 .SYNOPSIS
 Get an extended list of data on aws lambdas.

 .DESCRIPTION
 Retrieve a list of lambda functions, config details and function policy statuses.
 #>
Function Get-AWSLmbds {
param([string]$accessKey,[string]$accessSecret,[string]$LambdaName)

if (Test-Path "$env:ProgramFiles\WindowsPowerShell\Modules\AWSPowerShell\3.3.604.0\") {

if ((Get-Module -Name AWSPowerShell) -eq $null) {
Import-Module AWSPowerShell -ErrorVariable "moduleimport" -Force
 Set-AWSCredential -AccessKey $accessKey -SecretKey $accessSecret -StoreAs "credsaws"
  Initialize-AWSDefaultConfiguration -ProfileName credsaws -Region (Get-DefaultAWSRegion)
 } else  {Trap { return Write-Host " Problem wih  module - error $moduleimport" -ErrorAction Stop; } }
}
else {
Trap [System.Exception] {
return Write-Host "Path with module N/A, exiting." -ErrorAction Stop;
 }
}

Try {
 $awskeysecret = (Get-AWSCredential).GetCredentials()
 $lmfuncs = Get-LMFunctionList -AccessKey $awskeysecret.AccessKey -Credential (Get-AWSCredential) -Region (Get-DefaultAWSRegion) | ?{$_.FunctionName -eq $LambdaName} -ErrorVariable 'exception' -ErrorAction Stop;
  $lmconfigInfo = Get-LMFunctionConfiguration -AccessKey $awskeysecret -Credential (Get-AWSCredential) -Region (Get-DefaultAWSRegion) -FunctionName $lmfuncs.FunctionName -ErrorVariable 'exception' -ErrorAction Stop;
  $lmpolicyInfo = ((Get-LMPolicy -FunctionName $lmfuncs.FunctionName).Policy | ConvertFrom-Json -ErrorVariable 'exception' -ErrorAction Stop).Statement;

  $LmbdInfoOut = New-Object -TypeName PSCustomObject;

  # Basic function information.
  $LmbdInfoOut | Add-Member -MemberType NoteProperty -Name "Name" -Value $lmconfigInfo.FunctionName
  $LmbdInfoOut | Add-Member -MemberType NoteProperty -Name "Handler" -Value $lmconfigInfo.Handler
  $LmbdInfoOut | Add-Member -MemberType NoteProperty -Name "LatestUpdate" -Value (($lmconfigInfo.LastModified) -replace "T" , "  " -replace "\+0000", "")
  
  # Extended config information.
  $LmbdInfoOut | Add-Member -MemberType NoteProperty -Name "Runtime" -Value $lmconfigInfo.Runtime
  $LmbdInfoOut | Add-Member -MemberType NoteProperty -Name "TracingConfig" -Value $lmconfigInfo.TracingConfig
  $LmbdInfoOut | Add-Member -MemberType NoteProperty -Name "TraceMode" -Value ($lmconfigInfo.TracingConfig.Mode)
  $LmbdInfoOut | Add-Member -MemberType NoteProperty -Name "LambdaSize" -Value $lmconfigInfo.CodeSize

  # Policy function information.
  $LmbdInfoOut | Add-Member -MemberType NoteProperty -Name "PolicyLevel" -Value ($lmpolicyInfo.Effect | Select -First 1)
  $LmbdInfoOut | Add-Member -MemberType NoteProperty -Name "PolicyType" -Value ($lmpolicyInfo.Principal | Select -First 1).Service
  $LmbdInfoOut | Add-Member -MemberType NoteProperty -Name "FunctionState" -Value $lmconfigInfo.HttpStatusCode
   }
  Catch{
  return Write-Error "Exception occured while retrieving info. Error Information - $($exception)" -ErrorAction Stop
  }
  return $LmbdInfoOut;
}

<#
 .DESCRIPTION
 Check whether an aws gateway has any HTTP methods enabled.

 .PARAMETER ApiGatewayRest
 The list of endpoint objects to check.

 .PARAMETER resPathName
 The resource name as endpoint path to perform the relevant HTTP methods check.
 #>
Function Test-AWSMethodsExist {
[CmdLetBinding()]
param(
[Parameter(Mandatory=$true,ValueFromPipeline=$true)]
[PSCustomObject[]]$ApiGatewayRest,
[string]$resPathName
)
Process{ $resultEP = ($ApiGatewayRest | ?{$_.PathPart -eq $resPathName}) }
End {return $resultEP.ResourceMethods.Count -ne 0}
}

<#
 .DESCRIPTION
 Function used to identify whether a lambda is enabled on an aws api gateway endpoint.
 This also checks that any http methods are included for the relevant resource.

 .PARAMETER LambdaPart
 The name of the lambda function to validate.

 .PARAMETER AgResEndPointName
 The name of the api gateway used to perform the check.

 .PARAMETER AgResName
 The resource name on the api gateway.
 #>
Function Test-AWSLambdaEnabled {
[CmdletBinding()]
param(
[Parameter(Mandatory=$true,Position=0)]
[string]$LambdaPart,
[string]$AgResEndPointName,
[string]$AgResName
)

$endpointId = (Get-AGRestApiList -Region (Get-DefaultAWSRegion) | ?{ $_.Name -eq $AgResEndPointName}).Id
$resourceId = (Get-AGResourceList -RestApiId $endpointId -Region (Get-DefaultAWSRegion) | ?{$_.Path -ne "/" -and $_.PathPart -ne $null -and $_.PathPart -eq $AgResName}).Id

 if ($resourceId | Test-AWSMethodsExist -resPathName $AgResName) {
 return Write-Error "$([System.ArgumentException]::new("EndPoint setup does not include any http methods"))";
}
return ((Get-AGIntegration -HttpMethod "GET" -RestApiId $endpointId -ResourceId $resourceId).Uri -ilike "*$LambdaPart*")
}

<#
 .DESCRIPTION
 Used to call a lambda that is set on an aws api execution url.
 The function first checks that the endpoint has the function associated with it and 
 that the lambda is not in an error state. On error while calling the function,
 a default s3 bucket content can be set as an alternative response.

 .PARAMETER RestEndPointName
 The relevant rest api that hosts the function.

 .PARAMETER AGWStageName
 The stage name that is used for deployment on the gateway.

 .PARAMETER AGWResourceName
 The name of the resource on the gateway.

 .PARAMETER LmbdName
 The name of the lambda that is associated with the relevant gateway.
 #>
Function Invoke-AWSLambdaEndPoint {
param (
[string]$RestEndPointName,
[string]$AGWstageName,
[string]$AGWResourceName,
[string]$LmbdName
)

Try {

if (Test-AWSLambdaEnabled -LambdaPart $LmbdName -AgResEndPointName $RestEndPointName -AgResName $AGWResourceName) {
$lmbdres = (Invoke-LMFunction -FunctionName $LmbdName);
 if ($lmbdres.StatusCode -eq 200) {

 $regionName = ((Get-AWSRegion | ?{$_.Region -ilike "*us-west*"}) | Select -Last 1).Region;
$awsEpId = (Get-AGRestApiList -Region (Get-DefaultAWSRegion) | ?{ $_.Name -eq $RestEndPointName }).Id;
$resapigate = Get-AGResourceList -RestApiId ($awsEpId) -Region (Get-DefaultAWSRegion) | ?{$_.Path -ne "/" -and $_.PathPart -ne $null -and $_.PathPart -eq $AGWResourceName}

  $fullapiurl = "https://{0}.execute-api.{1}.amazonaws.com/{2}/{3}" -f $awsEpId, $regionName, $AGWStageName, "$($resapigate.PathPart)";
  $apiurl=$fullapiurl -replace  "/ ","/";
  $response = Invoke-RestMethod -Uri $apiurl -UseDefaultCredentials -UseBasicParsing
  
 } else {
  return  ("{'ErrorContent':'Function is in an error state.'}" | ConvertFrom-Json);
}
 } else {
return  ("{'ErrorContent':'Function not included in the endpoint.'}" | ConvertFrom-Json);
 }
}

Catch {
Write-Host "Failed to properly invoke function, getting default bucket response." | Out-Null; $_ | Out-File ".\error-awslambda.log";
   $response = ((Invoke-WebRequest -Uri "https://xxxxxx.s3-xxxx.amazonaws.com/xxxxxx/data.json").Content)
   } # Catch Exceptions retrieve default dataset from an s3 bucket.

return ($response | ConvertFrom-Json);
}

<#
 .DESCRIPTION
 This function checks that a lambda has vpc configuration.

 .PARAMETER LambdaName
 Name of the function used for the relevant check.
 #>
Function Test-AWSVpcCfg {
param(
[string]$LambdaName
)
return (Get-LMFunctionConfiguration -Credential (Get-AWSCredential) -FunctionName $LambdaName).VpcConfig -ne $null;
}

<#
 .DESCRIPTION
 Check whether a lamdba has an associated s3 policy enabled.

 .PARAMETER LambdaName
 Name of the function used for the relevant check.
 #>
Function Test-S3Enabled {
param(
[string]$LambdaName
)
$lambdapol = Get-LMPolicy -Credential (Get-AWSCredential) -FunctionName $LambdaName -Region (Get-DefaultAWSRegion);
$policy = $lambdapol.Policy | ConvertFrom-Json;
return (($policy.Statement.Principal.Service | ?{$_ -ilike "*s3*"}).Length -ne 0)
}