Integrations

mutation update_Webhooks {
  updateVendia_Settings(
    input: {
      blockReportWebhooks: ["https://my.block-webhook.url"]
      deadLetterWebhooks: ["https://my.dead-letter-webhook.url"]
    }
    syncMode: ASYNC
  ) {
    transaction {
      _id
    }
  }
}

mutation update_Emails {
  updateVendia_Settings(
    input: {
      blockReportEmails: ["blockreports@companyxyz.com"]
      deadLetterEmails: ["deadletter@companyxyz.com"]
    }
    syncMode: ASYNC
  ) {
    transaction {
      _id
    }
  }
}

IMPORTANT: make sure you follow ALL the steps here to the very end. After enabling the integration by updating the settings, there is still a manual subscription step that must be run in the account where the Lambda function exists to complete the setup process.

1. Create a Lambda function in your AWS account if one does not already exist. For the sake of this example the function will be referred to as lambda-block-function-in-your-account.

2. Attach a Resource-based Policy to allow your node's SNS topic to invoke the Lambda function in your account.

aws lambda add-permission \
--function-name lambda-block-function-in-your-account \
--statement-id lambda-block-notification \
--action lambda:InvokeFunction \
--principal sns.amazonaws.com \
--source-arn arn:aws:sns:aws-region:your-node-aws-account-number:node-sns-topic-name

# Successful output should look like this:
{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "lambda-block-notification",
      "Effect": "Allow",
      "Principal": {
        "Service": "sns.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:aws-region:your-aws-account-number:function:lambda-block-function-in-your-account",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:sns:aws-region:your-node-aws-account-number:node-sns-topic-name"
        }
      }
    }
  ]
}

3. Query and record the existing node settings

View your node's existing settings. When we update settings we will overwrite any existing settings so take care to record any present values.

query getSettings {
  getVendia_Settings {
    blockReportEmails
    blockReportWebhooks
    deadLetterEmails
    deadLetterWebhooks
    resourceMapKeys
    resourceMapValues
    aws {
      blockReportFirehoses
      blockReportLambdas
      blockReportSQSQueues
      deadLetterLambdas
      deadLetterSQSQueues
      s3ReadAccounts
      dataDogMonitoring {
        ddApiKey
        ddExternalId
        ddLogEndpoint
        ddSendLogs
      }
    }
    apiSettings {
      auth {
        allowedAccounts
        authorizerArn
        authorizerType
      }
      apiKeys {
        usagePlan {
          quotaSettings {
            limit
            offset
            period
          }
          throttleSettings {
            burstLimit
            rateLimit
          }
        }
        value
      }
    }
  }
}

4. Update the node setting to subscribe the Lambda function

Run the following GraphQL mutation, taking care to use your AWS Lambda function ARN as appropriate. This example sets up both block notifications, using the blockReportLambdas setting within the aws object, and dead-letter notifications, use the deadLetterLambdas setting within the aws object.

NOTE: Adjust the query to accommodate any additional settings you already have applied.

mutation update_blockReportLambdas {
  updateVendia_Settings(
    input: {
      aws: {
        blockReportLambdas: [
          "arn:aws:lambda:aws-region:your-aws-account-number:function:lambda-block-function-in-your-account"
        ]
        deadLetterLambdas: [
          "arn:aws:lambda:aws-region:your-aws-account-number:function:lambda-dead-letter-function-in-your-account"
        ]
      }
    }
    syncMode: ASYNC
  ) {
    transaction {
      _id
    }
  }
}

5. Subscribe the Lambda function in your account to your node's SNS topic.

NOTE: The following AWS call must be made using the account containing the lambda function you wish to subscribe and the region your node is deployed to. Cross-region lambda invocation is supported — subscribed lambdas may reside in other regions provided your SNS subscription is created in the same region as your deployed node.

aws sns subscribe --protocol lambda \
--topic-arn arn:aws:sns:aws-region:your-node-aws-account-number:node-sns-topic-name \
--notification-endpoint arn:aws:lambda:aws-region:your-aws-account-number:function:lambda-block-function-in-your-account \
--region aws-region # eg us-east-1, eu-west-2, etc.  Should match Topic and Function region.

6. Run a sample data mutation

Validate a block notification message has been sent to the configured Lambda function. There should be a full block report available.

For more information on sending Amazon SNS messages to a AWS Lambda function in a different account, please refer to AWS documentation.

• Create a SQS queue in your AWS account if one does not already exist.

• Update the SQS queue's Access Policy to ensure the queue can receive both the subscription confirmation message along with subsequent notifications generated by your node's SNS topic.

The policy need to be updated to look something like this:

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "__owner_statement",
      "Effect": "Allow",
      "Principal": {
        "AWS": "your-aws-account-number"
      },
      "Action": ["SQS:*"],
      "Resource": "arn:aws:sqs:aws-region:your-aws-account-number:your-queue-receiving-notifications"
    },
    {
      "Sid": "SendMessagesFromMyNode",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::your-node-aws-account-number:root"
      },
      "Action": "SQS:SendMessage",
      "Resource": "arn:aws:sqs:aws-region:your-aws-account-number:your-queue-receiving-notifications"
    },
    {
      "Sid": "AllowSubscriptionConfirmationMessage",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SQS:SendMessage",
      "Resource": "arn:aws:sqs:aws-region:your-aws-account-number:your-queue-receiving-notifications",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:sns:aws-region:your-node-aws-account-number:node-sns-topic-name"
        }
      }
    }
  ]
}

• Query and record the existing node settings

View your node's existing settings. When we update settings we will overwrite any existing settings so take care to record any present values.

query getSettings {
  getVendia_Settings {
    blockReportEmails
    blockReportWebhooks
    deadLetterEmails
    deadLetterWebhooks
    resourceMapKeys
    resourceMapValues
    aws {
      blockReportFirehoses
      blockReportLambdas
      blockReportSQSQueues
      deadLetterLambdas
      deadLetterSQSQueues
      s3ReadAccounts
      dataDogMonitoring {
        ddApiKey
        ddExternalId
        ddLogEndpoint
        ddSendLogs
      }
    }
    apiSettings {
      auth {
        allowedAccounts
        authorizerArn
        authorizerType
      }
      apiKeys {
        usagePlan {
          quotaSettings {
            limit
            offset
            period
          }
          throttleSettings {
            burstLimit
            rateLimit
          }
        }
        value
      }
    }
  }
}

• Update the node setting

Run the following GraphQL mutation, taking care to use your Amazon SQS ARN as appropriate. This example sets up both block notifications, using the blockReportSQSQueues setting within the aws object, and dead-letter notifications, use the deadLetterSQSQueues setting within the aws object.

NOTE: Adjust the query to accommodate any additional settings you already have applied.

mutation update_blockReportSqsQueues {
  updateVendia_Settings(
    input: {
      aws: {
        blockReportSQSQueues: [
          "arn:aws:sqs:aws-region:your-aws-account-number:your-queue-receiving-notifications"
        ]
        deadLetterSQSQueues: [
          "arn:aws:sqs:aws-region:your-aws-account-number:your-dead-letter-queue-receiving-notifications"
        ]
      }
    }
    syncMode: ASYNC
  ) {
    transaction {
      _id
    }
  }
}

• Confirm the SNS subscription

Go to the settings page of your SQS queue. You should see a message available. Poll for messages and open it. The message sent from your Vendia node's SNS topic will contain a SubscribeURL attribute. Copy and paste the value into a web browser to confirm the subscription.

NOTE: None of the node's block reports will be sent to the configured SQS queue until the subscription is confirmed.

• Run a sample data mutation

Validate a block notification message has been sent to the configured SQS queue. There should be a full block report available.

For more information on sending Amazon SNS messages to an Amazon SQS queue in a different account, please refer to AWS documentation.

• If you haven't already done so, log into the Azure CLI.

az login

• If you already know the ID of the subscription upon which you wish to operate, simply assign the value to your variable; alternatively, you can set the subscription ID variable using the subscription's name.

ACTIVE_SUBSCRIPTION_ID="<your-azure-subscription-id>"

ACTIVE_SUBSCRIPTION_NAME="<your-azure-subscription-name>"
ACTIVE_SUBSCRIPTION_ID="$(az account list \
  --query "[? name == '$ACTIVE_SUBSCRIPTION_NAME' ].id" \
  -o tsv)"

• Ensure you are operating on the intended Azure subscription.

az account set --subscription "$ACTIVE_SUBSCRIPTION_ID"

• Set up your Azure CLI session

To ensure you are operating upon the correct tenant, derive the ID of your tenant from for your subscription (as done during previous Azure CLI Session Setup).

ACTIVE_TENANT_ID="$(az account show --subscription "$ACTIVE_SUBSCRIPTION_ID" --query "tenantId" -o tsv)"

Determine the ID of the AAD Application provisioned with your Vendia node. The GUID is visible from your node's settings page in the web interface and will look something like 00000000-0000-0000-0000-000000000000.

VENDIA_AAD_APPLICATION_ID="<your-Vendia-application-id>"

• Provision a Service Principal within the AAD tenant to which your subscription belongs.

Create the service principal using the az ad CLI module and keep track of its object ID.

az ad sp create --id "$VENDIA_AAD_APPLICATION_ID"
VENDIA_SP_OBJECT_ID="$(az ad sp list --query "[].objectId" --filter "appId eq '$VENDIA_AAD_APPLICATION_ID'" -o tsv)"

If you do not already have an Azure Function created, Vendia recommends using one of the examples found within Microsoft's docs, choosing the one with the supported language you prefer.

In order to deliver notifications to your Azure Function, your Vendia AAD service principal needs to have been provisioned with a role containing Microsoft.Web/sites/write IAM permissions.

• Configure your Azure CLI session with details about your Azure Function App

FUNCTION_APP_RESOURCE_GROUP="<resource-group-containing-your-function-app>"
FUNCTION_APP_NAME="<function-app-containing-your-function>"
FUNCTION_APP_ID="$(az resource show --subscription $ACTIVE_SUBSCRIPTION_ID \
  --resource-group "$FUNCTION_APP_RESOURCE_GROUP" \
  --name "$FUNCTION_APP_NAME" \
  --resource-type "Microsoft.Web/sites" \
  --query "id" -o tsv)"

• Provision the Azure Function App with a role for your service principal

This example uses built-in role Website Contributor, since it is well-documented, has reasonably-scoped privileges and comes out-of-the-box. However, any role – including custom roles – allowing Microsoft.Web/sites/write should work.

FUNCTION_APP_SP_ROLE="Website Contributor"
az role assignment create --assignee "$VENDIA_SP_OBJECT_ID" \
  --role "$FUNCTION_APP_SP_ROLE" \
  --scope "$FUNCTION_APP_ID"

• Query and record the existing node settings

View your node's existing settings. When we update settings we will overwrite any existing settings so take care to record any present values.

query getSettings {
  getVendia_Settings {
    blockReportEmails
    blockReportWebhooks
    deadLetterEmails
    deadLetterWebhooks
    resourceMapKeys
    resourceMapValues
    azure {
      defaultTenantId
      defaultSubscriptionId
      blockReportFunctions {
        resourceGroupName
        functionAppName
        functionName
      }
      blockReportQueues {
        resourceGroupName
        storageAccountName
        queueName
      }
      deadLetterFunctions {
        resourceGroupName
        functionAppName
        functionName
      }
      deadLetterQueues {
        resourceGroupName
        storageAccountName
        queueName
      }
    }
    apiSettings {
      auth {
        allowedAccounts
        authorizerArn
        authorizerType
      }
      apiKeys {
        usagePlan {
          quotaSettings {
            limit
            offset
            period
          }
          throttleSettings {
            burstLimit
            rateLimit
          }
        }
        value
      }
    }
  }
}

• Update your node's settings to subscribe your Azure Function

Run the following GraphQL mutation, taking care to use your Azure Function's parameter values as appropriate. This example sets up both block notifications, using the blockReportFunctions setting within the azure object, and dead-letter notifications, use the deadLetterFunctions setting within the azure object.

NOTE: Adjust the query to accommodate any additional settings you already have applied.

mutation update_AzureBlockReportFunctionSettings {
  updateVendia_Settings(
    input: {
      azure: {
        defaultTenantId: "your-aad-tenant-id"
        defaultSubscriptionId: "your-azure-subscription-id"
        blockReportFunctions: [
          {
            resourceGroupName: "resource-group-containing-your-functions-app"
            functionAppName: "function-app-containing-your-function"
            functionName: "your-blockreport-function"
          }
        ]
        deadLetterFunctions: [
          {
            resourceGroupName: "resource-group-containing-your-functions-app"
            functionAppName: "function-app-containing-your-function"
            functionName: "your-deadletter-function"
          }
        ]
      }
    }
    syncMode: ASYNC
  ) {
    transaction {
      _id
    }
  }
}

• Wait for your settings mutation to complete

Since the update is asynchronous, query your node's settings until you see your new configuration reflected.

query getAzureBlockReportFunctionsSettings {
  getVendia_Settings {
    azure {
      defaultTenantId
      defaultSubscriptionId
      blockReportFunctions {
        resourceGroupName
        functionAppName
        functionName
      }
      deadLetterFunctions {
        resourceGroupName
        functionAppName
        functionName
      }
    }
  }
}

• Run a sample data mutation

Validate a block notification message has been sent to the configured Azure Function. There should be a full block report available.

Microsoft's docs provide examples of how to create a storage account, while queues can be created in a myriad of ways: via Azure Portal, via Azure CLI, via PowerShell, or programmatically using the Azure SDK for the language of your choice.

In order to deliver notifications to your Azure Queue Storage, your Vendia AAD service principal needs to have been provisioned with a role containing Microsoft.Storage/storageAccounts/write IAM permissions.

• Configure your Azure CLI session with details about your Azure Storage Account

STORAGE_ACCOUNT_RESOURCE_GROUP="<name of the resource group containing your storage account>"
STORAGE_ACCOUNT_NAME="<name of the storage account containing your queue>"
STORAGE_ACCOUNT_ID=$(az resource show --subscription $ACTIVE_SUBSCRIPTION_ID \
  --resource-group "$STORAGE_ACCOUNT_RESOURCE_GROUP" \
  --name "$STORAGE_ACCOUNT_NAME" \
  --resource-type "Microsoft.Storage/storageAccounts" \
  --query "id" -o tsv)

• Provision the Azure Storage Account with a role for your service principal

This example uses built-in role Storage Account Contributor, since it is well-documented, has reasonably-scoped privileges and comes out-of-the-box. However, any role – including custom roles – allowing Microsoft.storage/storageAccounts/write should work.

STORAGE_ACCOUNT_SP_ROLE="Storage Account Contributor"
az role assignment create --assignee "$VENDIA_SP_OBJECT_ID" \
  --role "$STORAGE_ACCOUNT_SP_ROLE" \
  --scope "$STORAGE_ACCOUNT_ID"

• Query and record the existing node settings

View your node's existing settings. When we update settings we will overwrite any existing settings so take care to record any present values.

query getSettings {
  getVendia_Settings {
    blockReportEmails
    blockReportWebhooks
    deadLetterEmails
    deadLetterWebhooks
    resourceMapKeys
    resourceMapValues
    azure {
      defaultTenantId
      defaultSubscriptionId
      blockReportFunctions {
        resourceGroupName
        functionAppName
        functionName
      }
      blockReportQueues {
        resourceGroupName
        storageAccountName
        queueName
      }
      deadLetterFunctions {
        resourceGroupName
        functionAppName
        functionName
      }
      deadLetterQueues {
        resourceGroupName
        storageAccountName
        queueName
      }
    }
    apiSettings {
      auth {
        allowedAccounts
        authorizerArn
        authorizerType
      }
      apiKeys {
        usagePlan {
          quotaSettings {
            limit
            offset
            period
          }
          throttleSettings {
            burstLimit
            rateLimit
          }
        }
        value
      }
    }
  }
}

• Update the node setting to subscribe your Azure Queue Storage

Run the following GraphQL mutation, taking care to use your Azure Queue Storage's parameter values as appropriate. This example sets up both block notifications, using the blockReportQueues setting within the azure object, and dead-letter notifications, use the deadLetterQueues setting within the azure object.

NOTE: Adjust the query to accommodate any additional settings you already have applied.

mutation update_AzureBlockReportQueueSettings {
  updateVendia_Settings(
    input: {
      azure: {
        defaultTenantId: "your-aad-tenant-id"
        defaultSubscriptionId: "your-azure-subscription-id"
        blockReportQueues: [
          {
            resourceGroupName: "resource-group-containing-your-storage-account"
            storageAccountName: "storageaccountcontainingyourqueue"
            queueName: "your-blockreport-queue"
          }
        ]
        deadLetterQueues: [
          {
            resourceGroupName: "resource-group-containing-your-storage-account"
            storageAccountName: "storageaccountcontainingyourqueue"
            queueName: "your-deadletter-queue"
          }
        ]
      }
    }
    syncMode: ASYNC
  ) {
    transaction {
      _id
    }
  }
}

• Ensure your settings saved

Since the update is an asynchronous mutation, query your node's settings for your new configuration.

query getAzureBlockReportQueueSettings {
  getVendia_Settings {
    azure {
      defaultTenantId
      defaultSubscriptionId
      blockReportQueues {
        resourceGroupName
        storageAccountName
        queueName
      }
      deadLetterQueues {
        resourceGroupName
        storageAccountName
        queueName
      }
    }
  }
}

• Run a sample data mutation

Validate a block notification message has been sent to the configured Azure Queue Storage. There should be a full block report available.