Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.8/site-packages/c7n/actions/invoke.py: 44%

1# Copyright The Cloud Custodian Authors. 

2# SPDX-License-Identifier: Apache-2.0 

3 

4try: 

5 from botocore.config import Config 

6except ImportError: 

7 from c7n.config import Bag as Config # pragma: no cover 

8 

9from .core import EventAction 

10from c7n import utils 

11from c7n.manager import resources 

12from c7n.version import version as VERSION 

13from c7n.credentials import assumed_session 

14 

15 

16class LambdaInvoke(EventAction): 

17 """Invoke an arbitrary lambda 

18 

19 serialized invocation parameters 

20 

21 - resources / collection of resources 

22 - policy / policy that is invoke the lambda 

23 - action / action that is invoking the lambda 

24 - event / cloud trail event if any 

25 - version / version of custodian invoking the lambda 

26 

27 We automatically batch into sets of 250 for invocation, 

28 We try to utilize async invocation by default, this imposes 

29 some greater size limits of 128kb which means we batch 

30 invoke. 

31 

32 Example:: 

33 

34 - type: invoke-lambda 

35 function: my-function 

36 assume-role: iam-role-arn 

37 

38 Note if your synchronously invoking the lambda, you may also need 

39 to configure the timeout, to avoid multiple invokes. The default 

40 is 90s, if the lambda doesn't respond within that time the boto 

41 sdk will invoke the lambda again with the same 

42 arguments. Alternatively use async: true 

43 

44 """ 

45 schema_alias = True 

46 schema = { 

47 'type': 'object', 

48 'required': ['type', 'function'], 

49 'additionalProperties': False, 

50 'properties': { 

51 'type': {'enum': ['invoke-lambda']}, 

52 'function': {'type': 'string'}, 

53 'assume-role': {'type': 'string'}, 

54 'region': {'type': 'string'}, 

55 'async': {'type': 'boolean'}, 

56 'qualifier': {'type': 'string'}, 

57 'batch_size': {'type': 'integer'}, 

58 'timeout': {'type': 'integer'}, 

59 'vars': {'type': 'object'}, 

60 } 

61 } 

62 

63 permissions = ('lambda:InvokeFunction', 

64 'iam:ListAccountAliases',) 

65 

66 def process(self, resources, event=None): 

67 

68 config = Config(read_timeout=self.data.get( 

69 'timeout', 90), region_name=self.data.get('region', None)) 

70 session = utils.local_session(self.manager.session_factory) 

71 assumed_role = self.data.get('assume-role', '') 

72 

73 if assumed_role: 

74 self.log.debug('Assuming role: {}'.format(assumed_role)) 

75 target_session = assumed_session(assumed_role, 'LambdaAssumedRoleSession', session) 

76 client = target_session.client('lambda', config=config) 

77 else: 

78 client = utils.local_session( 

79 self.manager.session_factory).client('lambda', config=config) 

80 

81 params = dict(FunctionName=self.data['function']) 

82 if self.data.get('qualifier'): 

83 params['Qualifier'] = self.data['Qualifier'] 

84 

85 if self.data.get('async', True): 

86 params['InvocationType'] = 'Event' 

87 

88 alias = utils.get_account_alias_from_sts( 

89 utils.local_session(self.manager.session_factory)) 

90 

91 payload = { 

92 'version': VERSION, 

93 'event': event, 

94 'account_id': self.manager.config.account_id, 

95 'account': alias, 

96 'region': self.manager.config.region, 

97 'action': self.data, 

98 'policy': self.manager.data} 

99 

100 results = [] 

101 for resource_set in utils.chunks(resources, self.data.get('batch_size', 250)): 

102 payload['resources'] = resource_set 

103 params['Payload'] = utils.dumps(payload) 

104 result = client.invoke(**params) 

105 result['Payload'] = result['Payload'].read() 

106 if isinstance(result['Payload'], bytes): 

107 result['Payload'] = result['Payload'].decode('utf-8') 

108 results.append(result) 

109 return results 

110 

111 @classmethod 

112 def register_resources(klass, registry, resource_class): 

113 if 'invoke-lambda' not in resource_class.action_registry: 

114 resource_class.action_registry.register('invoke-lambda', LambdaInvoke) 

115 

116 

117resources.subscribe(LambdaInvoke.register_resources)