Bugfixing and prep for basic auth

smoell · smoell · commit f4a8a8b6c269 · 2025-07-08T15:57:18.000+02:00
diff --git a/infrastructure/cdk/src/main/java/com/unicorn/core/InfrastructureLambdaBedrock.java b/infrastructure/cdk/src/main/java/com/unicorn/core/InfrastructureLambdaBedrock.java
@@ -17,6 +17,7 @@
 
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 
 public class InfrastructureLambdaBedrock extends Construct {
 
@@ -66,10 +67,9 @@ public InfrastructureLambdaBedrock(Construct scope, String id, String region, Bu
         bedrockRole.addToPolicy(PolicyStatement.Builder.create()
                 .effect(Effect.ALLOW)
                 .actions(List.of("bedrock:InvokeModel", "bedrock:ListFoundationModels"))
-                .resources(List.of("arn:aws:bedrock:*:*:inference-profile/eu.anthropic.claude-3-7-sonnet-20250219-v1:0"))
+                .resources(List.of("arn:aws:bedrock:*:*:inference-profile/us.anthropic.claude-3-7-sonnet-20250219-v1:0"))
                 .build());
 
-        // IAM Role for Lambda
         // IAM Role for Lambda
         Role lambdaRole = Role.Builder.create(this, "LambdaBedrockRole")
                 .assumedBy(new ServicePrincipal("lambda.amazonaws.com"))
@@ -81,7 +81,6 @@ public InfrastructureLambdaBedrock(Construct scope, String id, String region, Bu
                 ))
                 .build();
 
-        // Add permissions for Bedrock, S3, and SNS
         // Add permissions for Bedrock, S3, and SNS
         // Add permissions for logs
         lambdaRole.addToPolicy(PolicyStatement.Builder.create()
@@ -105,6 +104,19 @@ public InfrastructureLambdaBedrock(Construct scope, String id, String region, Bu
                 .resources(List.of("*"))  // Grant access to all Bedrock resources
                 .build());
 
+        // Add permissions for AWS Secrets Manager access
+        lambdaRole.addToPolicy(PolicyStatement.Builder.create()
+            .effect(Effect.ALLOW)
+            .actions(List.of(
+                    "secretsmanager:GetSecretValue",
+                    "secretsmanager:DescribeSecret"
+            ))
+            .resources(List.of(
+                    // Allow access to the specific secret for webhook credentials
+                    String.format("arn:aws:secretsmanager:%s:*:secret:grafana-webhook-credentials*", region)
+            ))
+            .build());
+
         // Add separate policy for S3 and SNS
         lambdaRole.addToPolicy(PolicyStatement.Builder.create()
                 .effect(Effect.ALLOW)
@@ -119,7 +131,6 @@ public InfrastructureLambdaBedrock(Construct scope, String id, String region, Bu
                 ))
                 .build());
 
-
         // Add permissions for EKS API access
         lambdaRole.addToPolicy(PolicyStatement.Builder.create()
                 .effect(Effect.ALLOW)
@@ -161,14 +172,14 @@ public InfrastructureLambdaBedrock(Construct scope, String id, String region, Bu
                 .securityGroups(List.of(lambdaSg))
                 .environment(Map.of(
                         "APP_LABEL", "unicorn-store-spring",
-                        "EKS_CLUSTER_NAME", eksCluster != null ? eksCluster.getCluster().getName() : "unicorn-store",
+                        "EKS_CLUSTER_NAME", Objects.requireNonNull(eksCluster.getCluster().getName()),
                         "K8S_NAMESPACE", "unicorn-store-spring",
                         "S3_BUCKET_NAME", s3Bucket.getBucketName(),
+                        "AWS_REGION", region,
                         "KUBERNETES_AUTH_TYPE", "aws"  // Use AWS IAM authentication for EKS
                 ))
                 .build();
 
-
         s3Bucket.grantWrite(this.threadDumpFunction);
         s3Bucket.grantRead(this.threadDumpFunction);
 
diff --git a/infrastructure/lambda/src/lambda_function.py b/infrastructure/lambda/src/lambda_function.py
@@ -5,7 +5,8 @@
 import requests
 import time
 import random
-import re  # Add this import for regex
+import re
+import base64
 from datetime import datetime
 from typing import Dict, Any
 from kubernetes import client, config
@@ -18,6 +19,62 @@
 def is_invalid(value: str) -> bool:
     return value is None or value.strip() in ["", "[no value]"]
 
+def verify_basic_auth(event: Dict[str, Any]) -> bool:
+    """
+    Verify Basic Authentication credentials from the request headers.
+    Returns True if authentication is successful, False otherwise.
+    """
+    try:
+        # Get headers from the event
+        headers = event.get('headers', {})
+        if not headers:
+            logger.warning("No headers found in the request")
+            return False
+        
+        # Look for authorization header (case-insensitive)
+        auth_header = None
+        for key in headers:
+            if key.lower() == 'authorization':
+                auth_header = headers[key]
+                break
+        
+        if not auth_header or not auth_header.startswith('Basic '):
+            logger.warning("No Basic Authorization header found")
+            return False
+        
+        # Extract and decode credentials
+        encoded_credentials = auth_header.split(' ')[1]
+        decoded_credentials = base64.b64decode(encoded_credentials).decode('utf-8')
+        username, password = decoded_credentials.split(':')
+        
+        # Get expected credentials from AWS Secrets Manager
+        secret_name = "grafana-webhook-credentials"
+        region_name = os.environ.get('AWS_REGION', 'us-east-1')
+        
+        session = boto3.session.Session()
+        client = session.client(
+            service_name='secretsmanager',
+            region_name=region_name
+        )
+        
+        response = client.get_secret_value(SecretId=secret_name)
+        secret = json.loads(response['SecretString'])
+        
+        # Validate credentials
+        if username != secret['username'] or password != secret['password']:
+            logger.warning("Invalid credentials provided")
+            return False
+        
+        logger.info("Authentication successful")
+        return True
+        
+    except ClientError as e:
+        logger.error(f"Error retrieving credentials from Secrets Manager: {str(e)}")
+        return False
+    except Exception as e:
+        logger.error(f"Authentication error: {str(e)}")
+        return False
+
 def extract_pod_info_from_valuestring(value_string: str) -> Dict[str, str]:
     """Extract pod information from Grafana alert valueString"""
     try:
@@ -184,13 +241,24 @@ def lambda_handler(event: Dict[str, Any], context: Any) -> Dict[str, Any]:
         # Check if this is a direct webhook call from Grafana
         if 'body' in event:
             logger.info("Processing direct webhook from Grafana")
+            
+            # Verify authentication for webhook calls
+            if not verify_basic_auth(event):
+                logger.warning("Authentication failed")
+                return {
+                    'statusCode': 401,
+                    'headers': {'WWW-Authenticate': 'Basic'},
+                    'body': json.dumps({'error': 'Authentication failed'})
+                }
+            
             try:
                 # Parse the webhook payload
                 if isinstance(event['body'], str):
                     body = json.loads(event['body'])
                 else:
                     body = event['body']
                 
+                # Rest of your webhook handling code remains the same
                 alerts = body.get('alerts', [])
                 if not alerts:
                     return {
@@ -200,6 +268,8 @@ def lambda_handler(event: Dict[str, Any], context: Any) -> Dict[str, Any]:
                 
                 results = []
                 for alert in alerts:
+                    # Your existing alert processing code...
+                    # No changes needed here
                     if alert.get('status') != 'firing':
                         logger.info("Skipping resolved alert")
                         continue
diff --git a/infrastructure/scripts/setup/monitoring.sh b/infrastructure/scripts/setup/monitoring.sh
@@ -30,6 +30,22 @@ cleanup() {
 }
 trap cleanup EXIT
 
+# -- Generate secure username and password for webhook
+WEBHOOK_USER="grafana-alerts"
+WEBHOOK_PASSWORD=$(openssl rand -base64 16 | tr -d '\n')
+
+# -- Create the secret for webhook
+aws secretsmanager create-secret \
+    --name grafana-webhook-credentials \
+    --description "Basic auth credentials for Grafana webhook to Lambda" \
+    --secret-string "{\"username\":\"$WEBHOOK_USER\",\"password\":\"$WEBHOOK_PASSWORD\"}"
+
+echo "Webhook credentials created:"
+echo "Username: $WEBHOOK_USER"
+echo "Password: $WEBHOOK_PASSWORD"
+echo "Save these credentials securely!"
+
+
 # --- Namespace & Helm setup ---
 kubectl create namespace "$NAMESPACE" 2>/dev/null || true
 helm repo add prometheus-community https://prometheus-community.github.io/helm-charts || true
@@ -303,16 +319,22 @@ if [[ -z "$NOTIF_UID" ]]; then
   CONTACT_POINT_JSON=$(jq -n \
     --arg name "lambda-webhook" \
     --arg url "$LAMBDA_URL" \
-    '{
-      name: $name,
-      type: "webhook",
-      settings: {
-        url: $url,
-        httpMethod: "POST"
-      },
-      disableResolveMessage: false,
-      isDefault: false
-    }')
+    --arg user "$WEBHOOK_USER" \
+    --arg pass "$WEBHOOK_PASSWORD" \
+  '{
+    name: $name,
+    type: "webhook",
+    settings: {
+      url: $url,
+      httpMethod: "POST",
+      username: $user,
+      password: $pass,
+      authorization_scheme: "basic"
+    },
+    disableResolveMessage: false,
+    isDefault: false
+  }')
+
 
   curl -s -X POST -u "$GRAFANA_USER:$GRAFANA_PASSWORD" \
     -H "Content-Type: application/json" \
