Bachinator Blog

Triggering a Lambda function from Slack

Published: Fri 03 February 2017 tags: lambda slack aws api_gateway

Introduction

There are times when automated processes need to be triggered by a person. As an example, you may have an automated process for publishing code to a test or QA server. Then, after a person has sanity checked it, you want to trigger the deploy to production.

One convenient way to do this is from Slack. In Slack, you can configure a Slash Command to post to a URL. This URL can be an AWS API Gateway that triggers an AWS Lambda function.

For a discussion of setting up a Lambda function like this, please see the article Python Lambda functions and API Gateway.

Slack's Slash Commands

Slack has a number of ways to plug into other technologies. The Slash Command allows you to configure a custom Slack command, in the format:

/my-command argument1 argument2 ...

When this command is submitted, the text of your command, along with all of its arguments, will be posted to a URL that you specify when you create the command. This URL will be the API Gateway URL that is generated when you create the gateway. This text will then be passed on to a Lambda function that can then process it in any way you wish. A number of other Slack specific paramters will also be posted along with your text.

Create and Configure the Slash Command

To begin, log into Slack in your browser and navigate to <yourgroup>.slack.com/apps/manage/custom-integrations. Click on the Slash Commands link and then click the green Add Configuration button on the left side.

In the input field, specify the command you want to define, like:

/deploy

then click on the green Add Slash Command Integration button. This will take you to where you can configure your Slack Lambda integration. In the Integration Settings section, specify the URL that was created for your API Gateway, make a note of the command's Token, and configure the rest of it the way you would like to.

The Lambda Function

Configuring the Lambda Function

As mentioned in the previous the article, the last main section of the serverless.yml file is the functions section. This section defines the name of the function, the python function that is called, any environment variables, and the events that trigger the Lambda function.

For our Slash Command, we need to define a function named deploy, triggered by an API Gateway, with an environment variable SLACK_TOKEN defined:

functions:
    deploy:
        handler: handler.deploy
        environment:
            SLACK_TOKEN: gIkuvaNzQIHg97ATvDxqgjtO
        events:
            - http:
                path: deploy
                method: post

For security purposes, you can avoid saving credentials in your code by using local environment variables. For example, you could replace the environment subsection with:

        environment:
            SLACK_TOKEN: ${env:SLACK_TOKEN}

This would look for a local environment variable defined as SLACK_TOKEN.

Writing the Lambda Function

Now that our Lambda function has been configured, we are ready to write the code to handle the incoming Slash Command. We've defined the handler to be handler.deploy which translates to the deploy function within the handler.py file.

We start with the following:

import urlparse

def deploy(event, context):
    data = event['body']
    args = dict(urlparse.parse_qsl(data))
    token = args.get('token', "")
    text = args.get('text', "")

The function deploy will be called when the Lambda function is triggered, and the parameters event and context will be passed in. You can retrieve the data that Slack posted from the event parameter:

    data = event['body']

This can then be broken down into the individual posted parameters with:

    args = dict(urlparse.parse_qsl(data))

Slack posts a number of parameters with a Slash Command:

token=gIkuvaNzQIHg97ATvDxqgjtO
team_id=T0001
team_domain=example
channel_id=C2147483705
channel_name=test
user_id=U2147483697
user_name=Steve
command=/weather
text=94070
response_url=https://hooks.slack.com/commands/1234/5678

At a minimum, you would use the token parameter to verify that the post came from your Slash Command. Once verified, you would act on the content of the text command. If appropriate, you might use Python's argparse module to parse the command.

You should post a response to the user - as discussed in the previous article. This response must be within 3 seconds. If it takes any longer, you can post a response to the response_url that Slack posted along with your other data.

Deploying the Lambda function and API Gateway

Once you've finished updating the Lambda function code, deploy it:

serverless deploy

It will return the URL of the API Gateway that it created or updated. This is the URL to which the Slash Command is configured to post.

There are comments.

Python Lambda functions and API Gateway

Published: Fri 27 January 2017 tags: lambda aws api_gateway

Introduction

The most common way to run an AWS Lambda function from outside AWS is through an AWS API Gateway. The API Gateway is accessible via a standard http post. This post could come from a website or an external service like Slack.

Setting up the Lambda function

The easiest way I've found to create a Lambda function and an API Gateway and connect them is with Serverless.

Serverless

Serverless is a framework that allows you to simply define the behavior of a Lambda function with a YAML configuration file and the Lambda function code. A single or group of Lambda functions that work together are referred to as a service.

Installation

Installation of serverless is quite simple:

npm install -g serverless

Basic Setup

To begin your service, you'll use the create command:

serverless create --template aws-python --path myService

This will create a new folder for your service called myService or whatever you specified in the serverless create command. Within that folder, you will find two files that have been preconfigured, handler.py and serverless.yml.

Configuring our Lambda function with an API Gateway

The Lambda function, along with its trigger are defined in the serverless.yml file. This file has three main sections, service, provider, and function.

Service

The service section simply defines the name of your service, so you should see a line in your generated serverless.yml file:

service: myService

Provider

The next section in the serverless.yml file is the provider section. In your generated serverless.yml file you should see the following:

provider:
    name: aws
    runtime: python2.7

There are a number of other configuration options in the provider section. For example, you might want to specify a region, with:

    region: us-west-2

And if your Lambda function will be using any other AWS features, you will probably need to specify iamRoleStatements that give your Lambda function access to those AWS features. For example, to give full access to AWS SNS, you might include:

    iamRoleStatements:
        - Effect: "Allow"
        Action:
        - "sns:*"
        Resource: "arn:aws:sns:us-west-2:*:*"

Functions

The last main section of the serverless.yml file is the functions section. This section defines the name of the function, the python function that is called, any environment variables, and the events that trigger the Lambda function.

For example, to define a function named deploy, triggered by an AWS API Gateway, with an environment variable SLACK_TOKEN defined, you might include:

functions:
    deploy:
        handler: handler.deploy
        environment:
            MY_ENV: gIkuvaNzQIHg97ATvDxqgjtO
        events:
            - http:
                path: deploy
                method: post

For security purposes, you can avoid saving credentials in your code by using local environment variables. For example, you could replace the environment subsection with:

        environment:
            MY_ENV: ${env:MY_ENV}

This would look for a local environment variable defined as MY_ENV.

Writing the Lambda function

Now that our Lambda function has been configured, we are ready to write the code to handle the incoming http post. We've defined the handler to be handler.deploy which translates to the deploy function within the handler.py file.

We start with the following:

import urlparse

def deploy(event, context):
    data = event['body']
    args = dict(urlparse.parse_qsl(data))
    parameter1 = args.get('parameter1', "")
    parameter2 = args.get('parameter2', "")

The function deploy will be called when the Lambda function is triggered, and the parameters event and context will be passed in. You can retrieve the data that was posted from the event parameter:

    data = event['body']

This can then be broken down into the individual posted parameters with:

    args = dict(urlparse.parse_qsl(data))

After the parameters have been processed, you'll want to return the results to the caller. This will need to be in a form that the caller can process. It can be useful to generalize the formatting of the return data:

def get_response(text):
    response = {
        "statusCode": 200,
        "body": text
    }
    return response

You could then return a text response from your deploy function with:

    return get_response("This is my return text.")

Dealing with Python modules

If you need to use external Python modules you have a couple choices. If it's just a single file module, you can just drop it into your project folder next to handler.py. Serverless will install it automatically. You could do the same with a folder or group of folders containing code, but if you are dealing with more complex modules, the easiest thing to do is use the serverless module serverless-python-requirements, following their directions for installing and using. One note on installation of this module is that you probably want to install it globally, in which case you would install it with:

npm install -g serverless-python-requirements

rather than their suggested:

npm install --save serverless-python-requirements

which will install it in the lambda function project directory.

Deploying the Lambda function and API Gateway

Deploying your Lambda function and API Gateway is very easy with Serverless. Simply run:

serverless deploy

This will return the URL of the API Gateway that it created.

There are comments.

Python and Multi-Factor Authentication

Published: Mon 26 December 2016 tags: mfa

Introduction

Multi-factor authentication is simply an authentication process involving multiple authentication steps.

Wikipedia MFA article

There are more and more situations today where the added security benefits of MFA are important. In this article, we'll look at using MFA in a command-line python application or process.

The Python modules, pyotp and qrcode, provide the functionality you need to enable MFA in your applications. We will be using one time passwords (OTP) and QR codes.

Process

The process is pretty straight forward:

Generate a key for each user
Generate a QR code from that key
Load the QR code into appropriate software like Google Authenticator
Verify the 6 digit code produced by Google Authenticator to authenticate someone

Implementation Details

OTP Key

The pyotp module will generate the key for you:

import pyotp

def genkey():
    return pyotp.random_base32()

You will then save this key in an appropriate database, tied to the appropriate user.

The QR Code

The following code will generate a PNG image with the user's QR code, given the key and the user's email address. The key will have to be retreived from the key database based on the username.

import pyotp
import qrcode

org = "My Secure Org"

def writeqr(email, key, output):
    t = pyotp.TOTP(key)
    image = qrcode.make(t.provisioning_uri(email, org))
    image.save(output)
    print "Qrcode written to %s." % output

This image can then either be sent to the user or displayed on a website. This must be secured because it authorizes the user.

This image would then be used to configure the MFA software - like Google Authenticator.

Authenticate the user

The last step is to actually authenticate the user. All that is required is to retrieve the user's key from the database, and verify it:

import pyotp

def auth(mfa_code, key):
    t = pyotp.TOTP(key)
    return t.verify(mfa_code)

There are comments.