working PoC lambda
ADD
poc-functions/requirements.txt
+requests
+boto3
\ No newline at end of file

ADD
poc-functions/serverless.yml
+service: checkov-platform-poc
+
+provider:
+ name: aws
+ runtime: python3.8
+ stage: dev
+ version: 1
+ region: eu-west-2
+ memorySize: 128
+ custom:
+ IAM_COGNITO_ACCESS_KEY: ${file(./cognito_access_role.yml):IAM_COGNITO_ACCESS_KEY}
+ IAM_COGNITO_SECRET_KEY: ${file(./cognito_access_role.yml):IAM_COGNITO_SECRET_KEY}
+ BC_USER_POOL: ${file(./cognito_access_role.yml):BC_USER_POOL}
+ BC_USER_POOL_CLIENT_ID: ${file(./cognito_access_role.yml):BC_USER_POOL_CLIENT_ID}
+ BC_DASHBOARD_URL: ${file(./cognito_access_role.yml):BC_DASHBOARD_URL}
+ BC_API_URL: ${file(./cognito_access_role.yml):BC_API_URL}
+
+
+plugins:
+ - serverless-python-requirements
+package:
+ exclude:
+ - ./cognito_access_role.yml
+
+
+functions:
+ checkovUser:
+ timeout: 30
+ handler: signup.signup
+ environment:
+ Z_AWS_SECRET_ACCESS_KEY: ${self:provider.custom.IAM_COGNITO_SECRET_KEY}
+ Z_AWS_ACCESS_KEY_ID: ${self:provider.custom.IAM_COGNITO_ACCESS_KEY}
+ BC_API_URL: ${self:provider.custom.BC_API_URL}
+ BC_USER_POOL: ${self:provider.custom.BC_USER_POOL}
+ BC_USER_POOL_CLIENT_ID: ${self:provider.custom.BC_USER_POOL_CLIENT_ID}
+ BC_DASHBOARD_URL: ${self:provider.custom.BC_DASHBOARD_URL}
+ events:
+ - http:
+ path: checkovUser
+ method: post
+ cors:
+ origin: '*'
+ headers: # <-- Specify allowed headers
+ - Content-Type
+ - X-Amz-Date
+ - X-Api-Key
+ - X-Amz-Security-Token
+ - X-Amz-User-Agent
+ - Access-Control-Allow-Origin
+ - Access-Control-Allow-Headers
+ - Access-Control-Allow-Credentials
+ allowCredentials: false
+
+

ADD
poc-functions/signup.py
+import os
+import json
+import datetime
+import requests
+import logging
+import boto3
+import random
+import string
+
+def getRandomString(length):
+ # Random string with the combination of lower and upper case
+ letters = string.ascii_letters
+ result_str = ''.join(random.choice(letters) for i in range(length))
+ return result_str + str(random.randint(0,9))
+
+def signup(event, context):
+ bc_api_url = os.environ["BC_API_URL"]
+ bc_user_pool = os.environ["BC_USER_POOL"]
+ bc_user_pool_client_id = os.environ["BC_USER_POOL_CLIENT_ID"]
+ bc_dashboard_url = os.environ["BC_DASHBOARD_URL"]
+
+ signupUrl = "{}/signup".format(bc_api_url)
+ postData = json.loads(event["body"])
+
+ userEmail = postData["email"]
+ orgName = postData["email"].split("@")[0]
+ print(orgName)
+ print(userEmail)
+ customerName = orgName
+
+
+ signupPayload = {
+ "customer_name": orgName,
+ "org_name": orgName,
+ "org_name_display": orgName,
+ "owner_email": userEmail,
+ "owner_first_name":"Checkov",
+ "owner_last_name":"User",
+ "owner_phone":"+441234567890"
+ }
+
+ signupHeaders = {
+ 'Accept': 'application/json, text/plain, */*',
+ 'User-Agent': 'Mozilla/5.0 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36',
+ 'Content-Type': 'application/json;charset=UTF-8'
+ }
+
+ response = requests.request("POST", signupUrl, headers=signupHeaders, json=signupPayload)
+
+ print(response.text.encode('utf8'))
+ if response.status_code == 200:
+ # Created platform user sucessfully. Now to get API Token
+ # Set the users password, disabling the change password prompt at login (better UX).
+ # Then, auth to cognito using the known creds to get the users JWT. Use this to call the intergrations/ApiToken endpoint. Return details to checkov along with user's password and JWT.
+ idpClient = boto3.client('cognito-idp', region_name='us-west-2', aws_access_key_id=os.environ["Z_AWS_ACCESS_KEY_ID"],aws_secret_access_key=os.environ["Z_AWS_SECRET_ACCESS_KEY"])
+ userPassword = getRandomString(8)
+ changePasswordResponse = idpClient.admin_set_user_password(
+ UserPoolId=bc_user_pool,
+ Username=userEmail,
+ Password=userPassword,
+ Permanent=True
+ )
+
+ userAuthResponse = idpClient.admin_initiate_auth(
+ UserPoolId=bc_user_pool,
+ ClientId=bc_user_pool_client_id,
+ AuthFlow='ADMIN_NO_SRP_AUTH',
+ AuthParameters={
+ 'USERNAME': userEmail,
+ 'PASSWORD': userPassword
+ }
+ )
+
+
+ apiTokenUrl = "{}/integrations/apiToken".format(bc_api_url)
+ apiTokenPayload = {}
+ ApiTokenHeaders = {
+ 'Accept': 'application/json',
+ 'Authorization': "{}".format(userAuthResponse["AuthenticationResult"]["IdToken"]),
+ 'User-Agent': 'Mozilla/5.0 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36'
+ }
+
+ apiTokenResponse = requests.request("GET", apiTokenUrl, headers=ApiTokenHeaders, data = apiTokenPayload)
+ print(apiTokenUrl)
+ print(ApiTokenHeaders)
+ print(apiTokenResponse.json())
+ print(userPassword)
+ print(userAuthResponse)
+ print("data:")
+ print(apiTokenResponse.json()["data"])
+ apiToken = apiTokenResponse.json()["data"]
+
+ returnUserDetails = {
+ "userEmail": userEmail,
+ "userPassword": userPassword,
+ "userJWT": userAuthResponse["AuthenticationResult"]["IdToken"],
+ "userApiToken": apiToken,
+ "dashboardURL": bc_dashboard_url
+ }
+
+ print(json.dumps(returnUserDetails))
+
+ response = {
+ "statusCode": 200,
+ 'headers': {
+ 'Content-Type': 'application/json',
+ 'Access-Control-Allow-Origin': '*',
+ 'Access-Control-Allow-Credentials': 'true',
+ 'Access-Control-Allow-Headers': '*'
+ },
+ "body": json.dumps(returnUserDetails)
+ }
+ return response
+
+ else:
+ response = {
+ "statusCode": 500,
+ 'headers': {
+ 'Content-Type': 'text/plain',
+ 'Access-Control-Allow-Origin': '*',
+ 'Access-Control-Allow-Credentials': 'true',
+ 'Access-Control-Allow-Headers': '*'
+ },
+ "body": "Failed to create platform user! Sorry!"
+ }
+ return response
\ No newline at end of file

working PoC lambda