search

aws-samples / aws-waf-dashboard

1 click deployment for creating AWS WAF dashboard
MIT No Attribution
39 stars 43 forks source link

Bucket Access is denied #13

Open dtnmatt opened 2 years ago

dtnmatt commented 2 years ago

The launch stack button is non-functional as it appears the bucket no longer allows access or does not exist.

vaibhav154 commented 2 years ago

Hello, Yes, the Launch Stack button is non-functional. I have found some workaround, so that we can create it via AWS CLI. For authentication token I have used aws sso login using the profile, you can use various methods to login using aws-cli.

I have used 3 files

  1. cloudformation-custom-resources/common-script.py (to create s3 bucket and create zip files and upload it to S3 Bucket)
  2. deploy_core script (This script is used to deploy Cloudformation stack by passing waf-dashboard.yaml.yaml)
  3. waf-dashboard.yaml.yaml (In this file I have removed hardcoded names for WAFv2Modification, WAFGlobalModification, WAFRegionalModification)

1. common-script.py (this script is resides under cloudformation-custom-resources/ folder

import boto3 import sys import os

PROFILE=sys.argv[1] region = sys.argv[2]

boto3 = boto3.session.Session(profile_name=PROFILE)

print("Working on region: " + region)

bucket_prefix = "aws-waf-dashboards-" bucket_name = bucket_prefix + region

s3 = boto3.client('s3', region_name=region) if (region != 'us-east-1'): s3.create_bucket(Bucket=bucket_name, CreateBucketConfiguration={'LocationConstraint': region}) else: s3.create_bucket(Bucket=bucket_name)

cmd_1 = 'cd domain-setter-lambda; zip -r ../domain-setter-lambda.zip ; cd ..' cmd_2 = 'cd es-cognito-auth-lambda; zip -r ../es-cognito-auth-lambda.zip ; cd ..' cmd_3 = 'cd kibana-customizer-lambda; zip -r ../kibana-customizer-lambda.zip *; cd ..' os.system(cmd_1) os.system(cmd_2) os.system(cmd_3)

print("Working on region: " + region);

print("-> Uploading zip files to Bucket: " + bucket_name);

Copying domain-setter-lambda.zip

boto3.resource('s3').Bucket(bucket_name).upload_file("domain-setter-lambda.zip", 'domain-setter-lambda.zip') boto3.client('s3', region_name=region).put_object_acl(ACL='public-read',Bucket=bucket_name,Key='domain-setter-lambda.zip');

Copying es-cognito-auth-lambda.zip

boto3.resource('s3').Bucket(bucket_name).upload_file("es-cognito-auth-lambda.zip", 'es-cognito-auth-lambda.zip') boto3.client('s3', region_name=region).put_object_acl(ACL='public-read',Bucket=bucket_name,Key='es-cognito-auth-lambda.zip');

Copying kibana-customizer-lambda.zip

boto3.resource('s3').Bucket(bucket_name).upload_file("kibana-customizer-lambda.zip", 'kibana-customizer-lambda.zip') boto3.client('s3', region_name=region).put_object_acl(ACL='public-read',Bucket=bucket_name,Key='kibana-customizer-lambda.zip');

cmd_1 = 'rm domain-setter-lambda.zip' cmd_2 = 'rm es-cognito-auth-lambda.zip' cmd_3 = 'rm kibana-customizer-lambda.zip'

os.system(cmd_1) os.system(cmd_2) os.system(cmd_3)

s3 = boto3.client('s3', region_name=region)

s3.delete_object(Bucket=bucket_name,Key='domain-setter-lambda.py');

2. deploy_core(this is under the root of repository)

!/usr/bin/env bash

========================================================== configurations ===

SVC_NAME=my-waf-dashboard DataNodeEBSVolumeSize=100 ElasticSerchDomainName=waf-dashboards NodeType=m5.large.elasticsearch Email=abc@gmail.com

=============================================================== functions ===

function deploy_core_stack { PROFILE=${1} REGION=${2} TOKEN_PREFIX=${3} # optional

Create S3 Bucket and upload zip files

cd cloudformation-custom-resources python3 common-script.py ${PROFILE} ${REGION} cd ..

deploy core stack

aws cloudformation deploy --stack-name ${SVC_NAME} --template-file waf-dashboard.yaml.yaml \ --capabilities CAPABILITY_NAMED_IAM --no-fail-on-empty-changeset \ --parameter-overrides \ DataNodeEBSVolumeSize=${DataNodeEBSVolumeSize} \ ElasticSerchDomainName=${ElasticSerchDomainName} \ NodeType=${NodeType} \ UserEmail=${Email} \ --region ${REGION} \ --profile ${PROFILE}

enable core stack terminate protection

aws cloudformation update-termination-protection --stack-name ${SVC_NAME} \ --enable-termination-protection \ --region ${REGION} \ --profile ${PROFILE} > /dev/null }

============================================================= deployments ===

DEPLOY_TYPE=${1} DEPLOY_PROFILE=${2} DEPLOY_REGION=${3} DEPLOY_PREFIX=${4}

if [[ "${DEPLOY_TYPE}" == "solo" ]]; then

deploy_core_stack ${DEPLOY_PROFILE} ${DEPLOY_REGION:-us-east-1} ${DEPLOY_PREFIX:-dev}

elif [[ "${DEPLOY_TYPE}" == "nonprd" ]]; then

deploy_core_stack

fi

3. waf-dashboard.yaml.yaml

AWSTemplateFormatVersion: "2010-09-09" Description: Sample AWS WAF Dashboard build on Amazon Elasticsearch Service.

Parameters: DataNodeEBSVolumeSize: Type: Number Default: 100 Description: Elasticsearch volume disk size

NodeType: Type: String Default: m5.large.elasticsearch Description: Elasticsearch Node Type

ElasticSerchDomainName: Type: String Default: 'waf-dashboards' AllowedPattern: "[a-z\-]*" Description: Elasticsearch domain name

UserEmail: Type: String Default: 'your@email.com' Description: Dashboard user e-mail address

Resources:

UserPoolDomainSetterLambda: Type: "AWS::Lambda::Function" Properties: Handler: "lambda_function.handler" Role: !GetAtt UserPoolDomainSetterLambdaRole.Arn Code: S3Bucket: !Join

Outputs:

DashboardLinkOutput: Description: Link to WAF Dashboard Value: !Join

To run this script be in the root of the repository and run ./deploy_core nonprd

pbalajiips commented 2 years ago

still getting 403

➜  ~ wget https://waf-dashboards.s3.amazonaws.com/dashboard.yaml
--2022-05-26 21:21:44--  https://waf-dashboards.s3.amazonaws.com/dashboard.yaml
Resolving waf-dashboards.s3.amazonaws.com (waf-dashboards.s3.amazonaws.com)... 52.217.111.52
Connecting to waf-dashboards.s3.amazonaws.com (waf-dashboards.s3.amazonaws.com)|52.217.111.52|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2022-05-26 21:21:44 ERROR 403: Forbidden.