Forwarding the events using Node.js

To collect and forward CloudTrail events to Devo, you will set up a trail that will send all AWS management and S3 bucket activity events to Lambda function that will collect, process, and forward the events securely to Devo. We provide the source code and files required to create the function. You only need to use these files to create the function, customize a few environment variables, and set up the CloudTrail rule that will start forwarding data.

This article takes you step-by-step through the configuration process:

• Download the source code files
• Prepare the ZIP file for upload
• Create the Lambda function

Download the source code files

Click here to download the zip file containing what you need to create the Lambda function. There are two folders and three files at the root level.

Prepare the ZIP file for upload

Add the certificate files previously downloaded to the /certs folder and your source code will be complete.

Create a .zip file containing the certs and node_modules folders, index.js, and package.json. You can name it anything you like.

Create the Lambda function

This procedure guides you through creating the new Lambda function. For this process, you need to have available the .zip file you prepared earlier. 

1. Log into your AWS Console, go to Lambda → Functions. Click Create function.

2. Select Author from scratch, then enter the Basic information required:
   - Function name: SendCloudTrailEventsToDevo
   - Runtime:  Node js 12.x
   - Execution role: Create a new role with basic Lambda permissions
   Click Create function.

3. In the Function code area, select Upload a .zip file as the Code entry type. Click Upload and select the .zip file you created in the last main step. Click Save.

4. In the Environment variables area, define the following variables:
   

   DEVO_CA_CHAIN_CERT_FILE	chain_eu.crt (for the EU region) chain_us.crt (for the US region)
   DEVO_CLIENT_PRIVATE_CERT_FILE	<devo_domain>.key
   DEVO_CLIENT_PUBLIC_CERT_FILE	<devo_domain>.crt
   DEVO_URL	eu.elb.relay.logtrust.net (for the EU region) us.elb.relay.logtrust.net (for the US region)
   DEVO_PORT	443

5. In the Tags area, we recommend that you define the following tags (although it's not obligatory, it is good practice):

   Owner	username
   devo:MonitoringTarget	aws
   devo:MonitoringTech	CloudTrail

6. In Basic settings area, enter a useful Description like This function receives CloudTrail events from an S3 bucket and sends them to Devo <domain name>. You can accept the default values for Memory (128MB) and Timeout (3 seconds).

7. Click Save.

8. Now, select the new function to view its details. In the Execution role area, click View the <function-name> role to edit the role permissions.

9. On the Permissions tab, click Attach policy. Select AmazonS3ReadOnlyAccess , then click Attach policy.

10. On the Tags tab, click Edit tags and add the same tags as in step 5.

11. Establish version-tracking by selecting Publish new version from the Actions menu. Enter a description if you like and click Publish.
12. In the function Designer, click Add triggers....on the left and select S3. 

13. In the S3 trigger configuration, enter the bucket name you specified when creating the trail. Select Object Created (All) as the Event type and select the Enable trigger checkbox. Click Submit.

With both the trail and the Lambda function enabled, events should begin to flow to your Devo domain. Look out for the cloud.aws.cloudtrail.events table to appear in your Finder.

If the table doesn't appear in your domain's Finder after 10 minutes, here are some things you can do to troubleshoot the problem:

• Go to the S3 bucket and make sure that it contains data.
• Go to CloudTrail - Trails and make sure the trail is active/enabled.
• Make sure the Lambda function's environment variable definitions match the certificate file names in the .zip that you uploaded.
• Go to CloudWatch - Logs and review the log for the Lambda function you created. 
• Go to Lambda, select the function you set up for CloudTrail, and click Test to send a test event. We suggest you copy the JSON of an event in the function's CloudWatch logs to use in the test event.