Skip to content
This repository was archived by the owner on Nov 1, 2025. It is now read-only.

Commit bdf0962

Browse files
yurymkomarovyurymkomarov
committed
- move VPC creation code to repository
- minor fix in lambda configuration - update README
1 parent adeb78c commit bdf0962

File tree

6 files changed

+324
-59
lines changed

6 files changed

+324
-59
lines changed

‎README.md‎

Lines changed: 40 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -18,56 +18,58 @@ At a high level, awslambdaproxy proxies TCP/UDP traffic through AWS Lambda regio
1818
![](/assets/images/how-it-works.png?raw=true)
1919

2020
## Installation
21-
- [Manual](#manual)
2221
- [Terraform](#terraform)
22+
- [Manual](#manual)
23+
24+
## Terraform
25+
26+
1. Clone repository and go to Terraform component folder:
27+
```sh
28+
git clone git@github.com:dan-v/awslambdaproxy.git && cd awslambdaproxy/deployment/terraform
29+
```
2330

24-
The easiest way is to download a pre-built binary from the [GitHub Releases](https://github.com/dan-v/awslambdaproxy/releases) page.
31+
2. Configure your Terrafom backend. Read more about Terraform backend [here](https://www.terraform.io/docs/backends/index.html).
32+
33+
3. Create and fill variable defenitions file ([read more here](https://www.terraform.io/docs/configuration/variables.html#variable-definitions-tfvars-files)) if you don't want to use default variables values.
34+
35+
4. Run those commands to init and apply configuration:
36+
```sh
37+
terraform init && terraform apply -auto-approve
38+
```
39+
40+
It will create all dependent resources and run awslambdaproxy inside Docker container. EC2 instance SSH key can be found in AWS Secret Manager in your [AWS Management Console](https://console.aws.amazon.com/).
41+
42+
NOTE: Some AWS regions have a big list of IP CIDR blocks and they can overhead default limits of security group ([read more](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html#vpc-limits-security-groups)). Need to make limit increase request through the AWS Support Center by choosing Create Case and then choosing Service Limit Increase to prevent deployment issues.
2543

2644
## Manual
2745

28-
1. Copy `awslambdaproxy` binary to a <b>publicly accessible</b> linux host (e.g. EC2 instance, VPS instance, etc). You will need to <b>open the following ports</b> on this host:
46+
1. Download a pre-built binary from the [GitHub Releases](https://github.com/dan-v/awslambdaproxy/releases) page.
47+
48+
2. Copy `awslambdaproxy` binary to a <b>publicly accessible</b> linux host (e.g. EC2 instance, VPS instance, etc). You will need to <b>open the following ports</b> on this host:
2949
* <b>Port 22</b> - functions executing in AWS Lambda will open SSH connections back to the host running `awslambdaproxy`, so this port needs to be open to the world. The SSH key used here is dynamically generated at startup and added to the running users authorized_keys file.
3050
* <b>Port 8080</b> - the default configuration will start a HTTP/SOCKS proxy listener on this port with default user/password authentication. If you don't want to publicly expose the proxy server, one option is to setup your own VPN server (e.g. [dosxvpn](https://github.com/dan-v/dosxvpn) or [algo](https://github.com/trailofbits/algo)), connect to it, and just run awslambdaproxy with the proxy listener only on localhost (-l localhost:8080).
3151

32-
2. Optional, but I'd highly recommend taking a look at the Minimal IAM Policies section below. This will allow you to setup minimal permissions required to setup and run the project. Otherwise, if you don't care about security you can always use an access key with full administrator privileges.
52+
3. Optional, but I'd highly recommend taking a look at the Minimal IAM Policies section below. This will allow you to setup minimal permissions required to setup and run the project. Otherwise, if you don't care about security you can always use an access key with full administrator privileges.
3353

34-
3. `awslambdaproxy` will need access to credentials for AWS in some form. This can be either through exporting environment variables (as shown below), shared credential file, or an IAM role if assigned to the instance you are running it on. See [this](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials) for more details.
54+
4. `awslambdaproxy` will need access to credentials for AWS in some form. This can be either through exporting environment variables (as shown below), shared credential file, or an IAM role if assigned to the instance you are running it on. See [this](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials) for more details.
3555

3656
```sh
3757
export AWS_ACCESS_KEY_ID=XXXXXXXXXX
3858
export AWS_SECRET_ACCESS_KEY=YYYYYYYYYYYYYYYYYYYYYY
3959
```
40-
4. Run `awslambdaproxy setup`.
60+
5. Run `awslambdaproxy setup`.
4161

4262
```sh
4363
./awslambdaproxy setup
4464
```
4565

46-
5. Run `awslambdaproxy run`.
66+
6. Run `awslambdaproxy run`.
4767

4868
```sh
4969
./awslambdaproxy run -r us-west-2,us-west-1,us-east-1,us-east-2
5070
```
5171

52-
6. Configure your web browser (or OS) to use the HTTP/SOCKS5 proxy on the publicly accessible host running `awslambdaproxy` on port 8080.
53-
54-
## Examples
55-
```
56-
# execute proxy in four different regions with rotation happening every 60 seconds
57-
./awslambdaproxy run -r us-west-2,us-west-1,us-east-1,us-east-2 -f 60s
58-
59-
# choose a different port and username/password for proxy and add another listener on localhost with no auth
60-
./awslambdaproxy run -l "admin:admin@:8888,localhost:9090"
61-
62-
# bypass certain domains from using lambda proxy
63-
./awslambdaproxy run -b "*.websocket.org,*.youtube.com"
64-
65-
# specify a dns server for the proxy server to use for dns lookups
66-
./awslambdaproxy run -l "admin:awslambdaproxy@:8080?dns=1.1.1.1"
67-
68-
# increase function memory size for better network performance
69-
./awslambdaproxy run -m 512
70-
```
72+
7. Configure your web browser (or OS) to use the HTTP/SOCKS5 proxy on the publicly accessible host running `awslambdaproxy` on port 8080.
7173

7274
## Minimal IAM Policies
7375
* This assumes you have the AWS CLI setup with an admin user
@@ -102,25 +104,23 @@ aws iam create-access-key --user-name awslambdaproxy-run
102104
}
103105
```
104106
105-
## Terraform
106-
107-
1. Clone repository and go to Terraform component folder:
108-
```sh
109-
git clone git@github.com:dan-v/awslambdaproxy.git && cd awslambdaproxy/deployment/terraform
107+
## Examples
110108
```
109+
# execute proxy in four different regions with rotation happening every 60 seconds
110+
./awslambdaproxy run -r us-west-2,us-west-1,us-east-1,us-east-2 -f 60s
111111

112-
2. Configure your Terrafom backend. Read more about Terraform backend [here](https://www.terraform.io/docs/backends/index.html).
113-
114-
3. Create and fill variable defenitions file ([read more here](https://www.terraform.io/docs/configuration/variables.html#variable-definitions-tfvars-files)) if you don't want to use default variables values.
112+
# choose a different port and username/password for proxy and add another listener on localhost with no auth
113+
./awslambdaproxy run -l "admin:admin@:8888,localhost:9090"
115114

116-
4. Run those commands to init and apply configuration:
117-
```sh
118-
terraform init && terraform apply -auto-approve
119-
```
115+
# bypass certain domains from using lambda proxy
116+
./awslambdaproxy run -b "*.websocket.org,*.youtube.com"
120117

121-
It will create all dependent resources and run awslambdaproxy inside Docker container. EC2 instance SSH key can be found in AWS Secret Manager in your [AWS Management Console](https://console.aws.amazon.com/).
118+
# specify a dns server for the proxy server to use for dns lookups
119+
./awslambdaproxy run -l "admin:awslambdaproxy@:8080?dns=1.1.1.1"
122120

123-
NOTE: Some AWS regions have a big list of IP CIDR blocks and they can overhead default limits of security group ([read more](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html#vpc-limits-security-groups)). Need to make limit increase request through the AWS Support Center by choosing Create Case and then choosing Service Limit Increase to prevent deployment issues.
121+
# increase function memory size for better network performance
122+
./awslambdaproxy run -m 512
123+
```
124124
125125
## FAQ
126126
1. <b>Should I use awslambdaproxy?</b> That's up to you. Use at your own risk.

‎deployment/terraform/data.tf‎

Lines changed: 33 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ data "aws_ami" "this" {
88
}
99
}
1010

11+
data "aws_availability_zones" "this" {
12+
state = "available"
13+
}
14+
1115
data "aws_vpc" "default" {
1216
default = true
1317
}
@@ -16,6 +20,10 @@ data "aws_subnet_ids" "default" {
1620
vpc_id = data.aws_vpc.default.id
1721
}
1822

23+
data "aws_subnet" "default" {
24+
id = element(tolist(data.aws_subnet_ids.default.ids), 0)
25+
}
26+
1927
data "aws_security_group" "default" {
2028
vpc_id = data.aws_vpc.default.id
2129

@@ -25,7 +33,31 @@ data "aws_security_group" "default" {
2533
}
2634
}
2735

28-
data "aws_availability_zones" "this" {}
36+
data "aws_iam_policy_document" "role" {
37+
statement {
38+
actions = ["sts:AssumeRole"]
39+
effect = "Allow"
40+
41+
principals {
42+
identifiers = ["vpc-flow-logs.amazonaws.com"]
43+
type = "Service"
44+
}
45+
}
46+
}
47+
48+
data "aws_iam_policy_document" "role_policy_cloudwatch" {
49+
statement {
50+
actions = [
51+
"logs:CreateLogGroup",
52+
"logs:CreateLogStream",
53+
"logs:PutLogEvents",
54+
"logs:DescribeLogGroups",
55+
"logs:DescribeLogStreams"
56+
]
57+
effect = "Allow"
58+
resources = ["*"]
59+
}
60+
}
2961

3062
data "aws_iam_policy_document" "profile_sts" {
3163
statement {

‎deployment/terraform/lambda.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ resource "aws_lambda_function" "sa-east-1" {
239239
}
240240

241241
resource "aws_lambda_function" "us-east-1" {
242-
count = contains(var.lambda_regions, "ap-northeast-1") ? 1 : 0
242+
count = contains(var.lambda_regions, "us-east-1") ? 1 : 0
243243
provider = aws.us-east-1
244244

245245
filename = "${path.module}/dummy.zip"

‎deployment/terraform/main.tf‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,15 @@ locals {
3434
stop_awslambdaproxy = "docker rm -f ${var.name}"
3535

3636
default_subnet = element(tolist(data.aws_subnet_ids.default.ids), 0)
37-
custom_subnet = module.vpc_single_public.subnet[0]["id"]
37+
custom_subnet = try(aws_subnet.public[0].id, "")
3838
}
3939

4040
resource "random_id" "this" {
4141
byte_length = 1
42+
43+
keepers = {
44+
cidr_block = var.vpc_cidr_block
45+
}
4246
}
4347

4448
resource "random_string" "this" {
@@ -51,15 +55,6 @@ resource "random_password" "this" {
5155
special = false
5256
}
5357

54-
module "vpc_single_public" {
55-
source = "yurymkomarov/vpc-single-public/aws"
56-
version = "1.0.1"
57-
58-
create_vpc = var.create_vpc
59-
name = "${var.name}-vpc"
60-
cidr_block = "10.0.0.0/16"
61-
}
62-
6358
resource "aws_instance" "this" {
6459
ami = data.aws_ami.this.id
6560
instance_type = var.instance_type
@@ -163,7 +158,7 @@ resource "aws_security_group" "this" {
163158
for_each = toset(var.lambda_regions)
164159

165160
name = "${var.name}-${each.value}-${random_id.this.hex}"
166-
vpc_id = var.create_vpc ? module.vpc_single_public.vpc["id"] : data.aws_vpc.default.id
161+
vpc_id = var.create_vpc ? try(aws_vpc.this[0].id, "") : data.aws_vpc.default.id
167162

168163
dynamic "ingress" {
169164
for_each = var.ssh_cidr_blocks

‎deployment/terraform/variables.tf‎

Lines changed: 33 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
terraform {
2+
experiments = [variable_validation]
3+
}
4+
15
variable "aws_access_key" {
26
type = string
37
description = "AWS access key associated with an IAM user or role"
@@ -19,6 +23,35 @@ variable "name" {
1923
default = "terraform-aws-lambda-proxy-single-instance"
2024
}
2125

26+
variable "create_vpc" {
27+
type = bool
28+
description = "Create personal VPC."
29+
default = false
30+
}
31+
32+
variable "vpc_cidr_block" {
33+
type = string
34+
description = "CIDR block for the VPC."
35+
default = "10.0.0.0/16"
36+
}
37+
38+
variable "flow_log_enable" {
39+
type = bool
40+
description = "Enable Flow Log for VPC."
41+
default = true
42+
}
43+
44+
variable "flow_log_destination" {
45+
type = string
46+
description = "Provides a VPC/Subnet/ENI Flow Log to capture IP traffic for a specific network interface, subnet, or VPC."
47+
default = "cloudwatch"
48+
49+
validation {
50+
condition = contains(["cloudwatch", "s3"], var.flow_log_destination)
51+
error_message = "Logs can be sent only to a CloudWatch Log Group or a S3 Bucket."
52+
}
53+
}
54+
2255
variable "app_version" {
2356
type = string
2457
description = "AWS Lambda Proxy app version"
@@ -43,12 +76,6 @@ variable "elastic_ip" {
4376
default = true
4477
}
4578

46-
variable "create_vpc" {
47-
type = bool
48-
description = "Enable VPC creation"
49-
default = true
50-
}
51-
5279
variable "lambda_regions" {
5380
type = list(string)
5481
description = "The list of AWS regions names where proxy lambda will be deployed"

0 commit comments

Comments
 (0)