
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
cfn-api-gateway-deployment
Advanced tools
AWS CloudFormation Custom Lambda Resource | API Gateway Deployment
AWS CloudFormation does not support AWS API Gateway. This is a Lambda-backed custom resource to add the AWS API Gateway's Deployment to CloudFormation.
This package on NPM
This package on GitHub
This Lambda makes use of the Lambda-Backed CloudFormation Custom Resource flow module, cfn-lambda
(GitHub / NPM).
See ./example.template.json
for a sample CloudFormation template. The example uses Condition
statements, Parameters
, and dynamic ServiceToken
generation fully.
"DeploymentLogicalIdInResourcesObject": {
"Type": "Type": "Custom::ApiGatewayDeployment",
"Properties": {
"ServiceToken": "arn:aws:lambda:<cfn-region-id>:<your-account-id>:function:<this-deployed-lambda-name>",
"RestApiId": "abcdefghij", // REQUIRED 10 char alphanum for RestApi id,
"StageName": "Foo Stage", // REQUIRED name of API stage to deploy into
"StageDescription": "blah blah", // OPTIONAL stage description
"Description": "some text", // OPTIONAL description of deployment (release note)
"CacheClustedEnabled": true, // OPTIONAL bool defaults false. Toggles api caching.
"CacheClusterSize": "0.5|1.6|6.1|13.5|28.4|58.2|118|237", // OPTIONAL GB of cache.
"Variables": { // OPTIONAL key-value hash of stage vars,
"FOO_ENV_VAR": "bar value" // where keys are varnames and
"so_many_var": "another 1" // values are their values.
}
}
}
Updating BaseApiId will require and trigger CloudFormation Resource Replacement
Though this resource works by itself, the example template in this repository also makes use of other resources in this custom family. You need to install these in your cloud to use the sample template.
Custom::ApiGatewayRestApi
(GitHub / NPM)Custom::ApiGatewayMethod
(GitHub / NPM)Custom::ApiGatewayMethodResponse
(GitHub / NPM)Custom::ApiGatewayIntegration
(GitHub / NPM)Custom::ApiGatewayIntegrationResponse
(GitHub / NPM)The way that takes 10 seconds...
# Have aws CLI installed + permissions for IAM and Lamdba
$ npm run cfn-lambda-deploy
You will have this resource installed in every supported Region globally!
... And the way more difficult way.
IMPORTANT: With this method, you must install this custom service Lambda in each AWS Region in which you want CloudFormation to be able to access the ApiGatewayDeployment
custom resource!
Zip this repository into /tmp/ApiGatewayDeployment.zip
$ cd $REPO_ROOT && zip -r /tmp/ApiGatewayDeployment.zip;
Enter a name in the Name blank. I suggest: CfnLambdaResouce-ApiGatewayDeployment
Enter a Description (optional).
Toggle Code Entry Type to "Upload a .ZIP file"
Click "Upload", navigate to and select /tmp/ApiGatewayDeployment.zip
Set the Timeout under Advanced Settings to 10 sec
Click the Role dropdown then click "Basic Execution Role". This will pop out a new window.
Select IAM Role, then select option "Create a new IAM Role"
Name the role lambda_cfn_api_gateway_deployment
(or something descriptive)
Click "View Policy Document", click "Edit" on the right, then hit "OK"
Copy and paste the ./execution-policy.json
document.
Hit "Allow". The window will close. Go back to the first window if you are not already there.
Click "Create Function". Finally, done! Now go to Usage or see the example template. Next time, stick to the instant deploy script.
Submit pull requests or Tweet @ayetempleton if you want to get involved with roadmap as well, or if you want to do this for a living :)
Work is (extremely) active, published here:
Andrew's NPM Account
FAQs
AWS CloudFormation Custom Lambda Resource | API Gateway Deployment
The npm package cfn-api-gateway-deployment receives a total of 15 weekly downloads. As such, cfn-api-gateway-deployment popularity was classified as not popular.
We found that cfn-api-gateway-deployment demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.