AWS Lambda action

AWS Lambda functions can be called when an automation stitch is triggered. This example uses a Security Rating Summary trigger in the automation stitch.

To configure an AWS Lambda function automation stitch in the GUI:

1. Go to Security Fabric > Automation and click Create New.
2. Enter the stitch name.
3. Configure the trigger:
   1. Click Add Trigger.
   2. Click Create and select Security Rating Summary.
   3. Enter the following:

      Name	auto-aws
      Report	Security Posture

   4. Click OK.
   5. Select the trigger in the list and click Apply.
4. Configure the AWS Lambda function action:
   1. Click Add Action.
   2. Click Create and select AWS Lambda.
   3. Enter the following:

      Name	aws-action-1
      URL	Enter the request API URI
      API key	Enter the API key
      HTTP header	header2 : header2_value

   4. Click OK.
   5. Select the action in the list and click Apply.
5. Click OK.

To configure an AWS Lambda function automation stitch in the CLI:

1. Create the automation trigger:

   config system automation-trigger
       edit "auto-aws"
           set event-type security-rating-summary
       next
   end

2. Create the automation action:

   config system automation-action
       edit "aws-action-1"
           set action-type aws-lambda
           set aws-api-key *************
           set uri "0100000000.execute-api.us-east-2.amazonaws.com/default/xxxxx-autobatoon-XXX-lambdaXXX"
           config http-headers
               edit 1
                   set key "header2"
                   set value "header2_value"
               next
           end
       next
   end

3. Create the automation stitch:

   config system automation-stitch
       edit "auto-aws"
           set trigger "auto-aws"
           config actions
               edit 1
                   set action "aws-action-1"
                   set required enable
               next
           end
       next
   end

When the automation stitch is triggered, the Security Fabric > Automation page shows the stitch trigger time. In AWS, the log shows that the function was called, executed, and finished.