Merge pull request #26 from SumoLogic/sumo_270861

Sumo 270861: Enhacement extension for CVE fixes

Author: akhil-sumologic

.github/workflows/unittest.yml

@@ -2,6 +2,9 @@
 
 name: build-and-test
 
+permissions:
+  id-token: write
+  contents: read
 # Controls when the action will run. Triggers the workflow on push or pull request
 # events but only for the main branch
 on:
@@ -23,10 +26,18 @@ jobs:
       - name: Setup Go environment
         uses: actions/setup-go@v5
         with:
-          go-version: 1.22
+          go-version: 1.24
 
       - name: Checking compilation errors while generating image
         run: env GOOS=linux go build -o "sumologic-extension" "lambda-extensions/sumologic-extension.go"
 
+      - name: Configure AWS credentials via OIDC and IAM Role
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::956882708938:role/LambdaExtensionPublishRole
+          aws-region: us-east-1
+
       - name: Run Unit Tests
+        env:
+          AWS_REGION: us-east-1
         run: go test  ./...

containerimageexample/python-arm64/Dockerfile

@@ -1,27 +1,21 @@
 # Define global args
 ARG FUNCTION_DIR="app"
-ARG RUNTIME_VERSION="3.9"
-ARG DISTRO_VERSION="3.12"
-
+ARG RUNTIME_VERSION="3.13.7"
 # Stage 1 - bundle base image + runtime
-# Grab a fresh copy of the ARM 64 based image and install GCC
-FROM arm64v8/python:${RUNTIME_VERSION}-alpine${DISTRO_VERSION} AS python-alpine
-# Install GCC (Alpine uses musl but we compile and link dependencies with GCC)
-RUN apk add --no-cache \
-    libstdc++
+# Grab a fresh copy of the ARM 64 based image
+FROM arm64v8/python:${RUNTIME_VERSION}-slim-bookworm AS python-slim-bookworm
 
 # Stage 2 - build function and dependencies
-FROM python-alpine AS build-image
+FROM python-slim-bookworm AS build-image
 # Install aws-lambda-cpp build dependencies
-RUN apk add --no-cache \
-    build-base \
-    libtool \
-    autoconf \
-    automake \
-    libexecinfo-dev \
-    make \
-    cmake \
-    libcurl
+RUN apt-get update && \
+  apt-get install -y \
+  g++ \
+  make \
+  cmake \
+  unzip \
+  libcurl4-openssl-dev
+
 # Include global args in this stage of the build
 ARG FUNCTION_DIR
 ARG RUNTIME_VERSION
@@ -36,7 +30,7 @@ RUN pip install awslambdaric --target ${FUNCTION_DIR}
 
 # Stage 3 - final runtime image
 # Grab a fresh copy of the Python image
-FROM python-alpine
+FROM python-slim-bookworm
 # Include global arg in this stage of the build
 ARG FUNCTION_DIR
 # Set working directory to function root directory it also creates the directory and cd to that directory
@@ -45,8 +39,10 @@ WORKDIR ${FUNCTION_DIR}
 COPY --from=build-image ${FUNCTION_DIR} ./
 # (Optional) Add Lambda Runtime Interface Emulator and use a script in the ENTRYPOINT for simpler local runs
 ADD https://github.com/aws/aws-lambda-runtime-interface-emulator/releases/latest/download/aws-lambda-rie /usr/bin/aws-lambda-rie
+# Create the directory explicitly
+RUN mkdir -p /opt/extensions
 # SumoLogic Lambda extension
-ADD sumologic-extension-arm64.tar.gz /opt/
+COPY extensions/sumologic-extension /opt/extensions/
 COPY entry.sh /
 RUN chmod 755 /usr/bin/aws-lambda-rie /entry.sh
 ENTRYPOINT [ "/entry.sh" ]

containerimageexample/python-arm64/build_and_deploy_image.sh

@@ -1,14 +1,14 @@
-docker build -t lambda/hello-world-python:3.9-alpine3.12 .
+docker build --platform=linux/arm64 -t lambda/hello-world-python:3.13.7-slim-bookworm .
 
 ## Command to run container
-# docker run -p 9000:8080 lambda/hello-world-python:3.9-alpine3.12
+# docker run -p 9000:8080 lambda/hello-world-python:3.13.7-slim-bookworm
 
 ## Command to test
 # curl -XPOST "http://localhost:9000/2015-03-31/functions/function/invocations" -d '{}'
 
 ## Command to push image
 ACCOUNT_ID=956882708938
-aws ecr create-repository --repository-name hello-world-python-arm64 --image-scanning-configuration scanOnPush=true
-docker tag lambda/hello-world-python:3.9-alpine3.12 "${ACCOUNT_ID}.dkr.ecr.us-east-1.amazonaws.com/"hello-world-python-arm64:latest
+#aws ecr create-repository --repository-name hello-world-python-arm64 --image-scanning-configuration scanOnPush=true
+docker tag lambda/hello-world-python:3.13.7-slim-bookworm "${ACCOUNT_ID}.dkr.ecr.us-east-1.amazonaws.com/"hello-world-python-arm64:latest
 aws ecr get-login-password | docker login --username AWS --password-stdin "${ACCOUNT_ID}.dkr.ecr.us-east-1.amazonaws.com"
 docker push "${ACCOUNT_ID}.dkr.ecr.us-east-1.amazonaws.com/hello-world-python-arm64:latest"

containerimageexample/python-arm64/extensions/sumologic-extension

@@ -1,28 +1,34 @@
 module github.com/SumoLogic/sumologic-lambda-extensions
 
-go 1.22
+go 1.24.0
+
+toolchain go1.24.1
 
 require (
-	github.com/aws/aws-sdk-go v1.51.25
-	github.com/aws/aws-sdk-go-v2 v1.26.1
-	github.com/aws/aws-sdk-go-v2/config v1.27.11
-	github.com/aws/aws-sdk-go-v2/service/kms v1.31.0
+	github.com/aws/aws-sdk-go-v2 v1.39.1
+	github.com/aws/aws-sdk-go-v2/config v1.31.10
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.19.8
+	github.com/aws/aws-sdk-go-v2/service/kms v1.45.4
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.88.2
+	github.com/aws/aws-sdk-go-v2/service/sts v1.38.5
 	github.com/google/uuid v1.6.0
 	github.com/sirupsen/logrus v1.9.3
 )
 
 require (
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.11 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 // indirect
-	github.com/aws/smithy-go v1.20.2 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	golang.org/x/sys v0.19.0 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.14 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.8 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.8 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.8 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.29.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.0 // indirect
+	github.com/aws/smithy-go v1.23.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
 )