Блог

Я создал пакет развертывания для AWS Lambda с помощью своего файла python для мониторинга потоков DBActivityStreams в соответствии с документацией AWS.

 from __future__ import print_function
import json
import boto3
import base64
import zlib
import os 
import aws_encryption_sdk
from aws_encryption_sdk import CommitmentPolicy
from aws_encryption_sdk.internal.crypto import WrappingKey
from aws_encryption_sdk.key_providers.raw import RawMasterKeyProvider
from aws_encryption_sdk.identifiers import WrappingAlgorithm, EncryptionKeyType
import datetime

REGION_NAME = 'ca-central-1'
RESOURCE_ID = '<Cluster -ABC>'

enc_client = aws_encryption_sdk.EncryptionSDKClient(commitment_policy=CommitmentPolicy.REQUIRE_ENCRYPT_ALLOW_DECRYPT)
kms = boto3.client('kms', region_name=REGION_NAME)
todays_date = datetime.datetime.now()

class MyRawMasterKeyProvider(RawMasterKeyProvider):
    provider_id = "BC"
    def __new__(cls, *args, **kwargs):
        obj = super(RawMasterKeyProvider, cls).__new__(cls)
        return obj
    def __init__(self, plain_key):
        RawMasterKeyProvider.__init__(self)
        self.wrapping_key = WrappingKey(wrapping_algorithm=WrappingAlgorithm.AES_256_GCM_IV12_TAG16_NO_PADDING,
                                        wrapping_key=plain_key, wrapping_key_type=EncryptionKeyType.SYMMETRIC)
    def _get_raw_key(self, key_id):
        return self.wrapping_key

def decrypt_payload(payload, data_key):  
    my_key_provider = MyRawMasterKeyProvider(data_key)
    my_key_provider.add_master_key("DataKey")
    #Decrypt the records using the master key.
    decrypted_plaintext, header = enc_client.decrypt(
        source=payload,
        materials_manager=aws_encryption_sdk.materials_managers.default.DefaultCryptoMaterialsManager(master_key_provider=my_key_provider))
    return decrypted_plaintext

def decrypt_decompress(payload, key):   
    decrypted = decrypt_payload(payload, key)
    #Decompress the records using zlib library.
    decrypted = zlib.decompress(decrypted, zlib.MAX_WBITS   16)
    return decrypted

#Lambda Handler entry point
def lambda_handler(event, context):
    output = []
    print("Received event: "   json.dumps(event, indent=2))
    for dasRecord in event['Records']:
        kinesis = dasRecord['kinesis']
        data = base64.b64decode(kinesis["data"])
        # Do processing here
        val = processDASRecord(data)
        if len(val)>0:
            output_record = {
                #'recordId': dasRecord['recordId'],
                'result': 'Ok',
                'data': base64.b64encode(json.dumps(val).encode("utf-8"))
            }
        else:
            output_record = {
                'recordId': dasRecord['recordId'],
                'result': 'Dropped',
                'data': base64.b64encode(b'this is a dropped event')
            }
        output.append(output_record)

    print('Successfully processed {} records.'.format(len(event['records'])))
    return {'records': output}

def processDASRecord(rec):
    record = json.loads(rec)
    if record['type'] == 'DatabaseActivityMonitoringRecords':
        dbEvents = record["databaseActivityEvents"]
        dataKey = base64.b64decode(record["key"])
        try:
            #Decrypt the envelope master key using KMS
            data_key_decrypt_result = kms.decrypt(CiphertextBlob=dataKey, EncryptionContext={'aws:rds:dbc-id':RESOURCE_ID})
        except Exception as e:
            print(e)
            raise e

        try:
            plaintextEvents = decrypt_decompress(base64.b64decode(dbEvents), data_key_decrypt_result['Plaintext'])
        except Exception as e:
            print(e)
            raise e
        
        retObj = []
        #parse thru all activity and categorize it.
        try:
            events = json.loads(plaintextEvents)
            for dbEvent in events['databaseActivityEventList']:
                print(dbEvent)
              
            retObj.append(dbEvent)
        except Exception as e:
            print (e)
            raise e
        
        return retObj
 

ZIP — файл содержит зависимости для криптографии и cffi. Моя почтовая папка с пакетом содержит ниже.

Код работает без проблем при локальном запуске. Но когда я импортировал этот zip-файл в AWS lambda, я получаю следующую ошибку. Пакет python создан в среде AWS Linux EC2. Версия Python 3.7. Среда выполнения AWS python 3.9(если я дойду до 3.7, функция вообще не запустится)

 File "/var/task/aws_encryption_sdk/__init__.py", line 194, in decrypt
    plaintext = decryptor.read()
  File "/var/task/aws_encryption_sdk/streaming_client.py", line 260, in read
    self._prep_message()
  File "/var/task/aws_encryption_sdk/streaming_client.py", line 792, in _prep_message
    self._header, self.header_auth = self._read_header()
  File "/var/task/aws_encryption_sdk/streaming_client.py", line 830, in _read_header
    decryption_materials = self.config.materials_manager.decrypt_materials(request=decrypt_materials_request)
  File "/var/task/aws_encryption_sdk/materials_managers/default.py", line 150, in decrypt_materials
    data_key = self.master_key_provider.decrypt_data_key_from_list(
  File "/var/task/aws_encryption_sdk/key_providers/base.py", line 315, in decrypt_data_key_from_list
    data_key = self.decrypt_data_key(encrypted_data_key, algorithm, encryption_context)
  File "/var/task/aws_encryption_sdk/key_providers/base.py", line 268, in decrypt_data_key
    data_key = master_key.decrypt_data_key(encrypted_data_key, algorithm, encryption_context)
  File "/var/task/aws_encryption_sdk/key_providers/base.py", line 529, in decrypt_data_key
    decrypted_data_key = self._decrypt_data_key(
  File "/var/task/aws_encryption_sdk/key_providers/raw.py", line 180, in _decrypt_data_key
    plaintext_data_key = self.config.wrapping_key.decrypt(
  File "/var/task/aws_encryption_sdk/internal/crypto/wrapping_keys.py", line 105, in decrypt
    return decrypt(
  File "/var/task/aws_encryption_sdk/internal/crypto/encryption.py", line 150, in decrypt
    decryptor = Decryptor(algorithm, key, associated_data, encrypted_data.iv, encrypted_data.tag)
  File "/var/task/aws_encryption_sdk/internal/crypto/encryption.py", line 111, in __init__
    algorithm.encryption_algorithm(key), algorithm.encryption_mode(iv, tag), backend=default_backend()
  File "/var/task/cryptography/hazmat/backends/__init__.py", line 16, in default_backend
    from cryptography.hazmat.backends.openssl.backend import backend
  File "/var/task/cryptography/hazmat/backends/openssl/__init__.py", line 6, in <module>
    from cryptography.hazmat.backends.openssl.backend import backend
  File "/var/task/cryptography/hazmat/backends/openssl/backend.py", line 82, in <module>
    from cryptography.hazmat.bindings.openssl import binding
  File "/var/task/cryptography/hazmat/bindings/openssl/binding.py", line 14, in <module>
    from cryptography.hazmat.bindings._openssl import ffi, lib
ModuleNotFoundError: No module named '_cffi_backend'
 

Любая помощь была бы очень признательна. Я не смог найти никакого успешного решения в своем поиске.