Creating Lambda functions

This lab does not aim to cover all aspects of Lambda functions, but you'll need to know the basics of configuring and testing a function. By navigating to the Functions section of the Lambda console and clicking on a function’s name, you can view details of the function and configure it.

This lab does not aim to cover all aspects of Lambda functions, but you'll need to know the basics of configuring and testing a function. By navigating to the Functions section of the Lambda console and clicking on a function’s name, you can view details of the function and configure it.

The Lambda console includes an inline code editor – in this lab, you'll need to use this to change the provided malicious-IP-denier function.

Note: When changing a function, you must Deploy any changes for them to take effect, before you can Test them. Use the buttons at the top of the Code source window.

You should use the example event provided on the lab desktop as the test event’s JSON. You can then view the execution results, which should look like the following if your function is correct:

SNS topics and subscriptions

While SNS is not the primary focus of this lab, you'll need to know some SNS basics to complete the tasks. By navigating to the Topics section of the SNS console and clicking on a topic’s name, you can view details of the topic and create a subscription for it.

When creating a subscription, you need to choose the protocol. The protocol is the type of endpoint that notifications will be sent to (email, SMS, HTTP). You then need to provide the endpoint itself, such as a specific phone number or URL.

I will take you through how to integrate Eventbridge with AWS services such as Lambda and SNS to automate and expedite the incident response process.

AWS GuardDuty takes up to five minutes to generate a finding and send an event to EventBridge once it detects malicious activity. In this lab, we've generated some realistic fake GuardDuty Finding events, so you don’t have to wait around. These events come from a metrolio.guardduty source, which is why you need to change the event pattern for the fourth activity. In reality, your EventBridge rule would use an event pattern like that required to complete the third activity.

The GuardDuty findings show an EC2 instance being connected to from IP addresses that you've flagged as malicious. Network ACLs can be applied to the subnet that an EC2 instance is in to block traffic from certain IP addresses, and the malicious-IP-denier lambda function in this lab creates new ACL entries to deny each malicious IP address reported in the events that it receives.

You can view all network ACLs by navigating to the VPC console and then Network ACLs, under Security in the left-hand sidebar. Clicking on a network ACL’s ID will show you the inbound rules for a network ACL

Use the inline code editor to edit the malicious-IP-denier Lambda function so that it retrieves any malicious remote IP addresses from events it receives. The Lambda function then blocks the IP address using a network ACL.

TBC