lambda_function.py

import json
import boto3
import requests
from datetime import datetime, timezone
from google.oauth2 import service_account
from google.auth.transport.requests import Request

def lambda_handler(event, context):
    headers = {
        'Access-Control-Allow-Origin': '*',
        'Access-Control-Allow-Headers': 'Content-Type',
        'Access-Control-Allow-Methods': 'POST,OPTIONS'
    }
    method = event.get('requestContext', {}).get('http', {}).get('method', '')
    if method == 'OPTIONS':
        return {'statusCode': 200, 'headers': headers, 'body': ''}
    try:
        body = json.loads(event.get('body', '{}'))

        secrets = boto3.client('secretsmanager', region_name='us-east-1')
        secret_value = secrets.get_secret_value(SecretId='gcp-service-account-key')
        secret_dict = json.loads(secret_value['SecretString'])
        gcp_creds = json.loads(secret_dict['gcp_credentials'])

        credentials = service_account.Credentials.from_service_account_info(
            gcp_creds,
            scopes=['https://www.googleapis.com/auth/cloud-platform']
        )
        
        credentials.refresh(Request())

        timestamp = datetime.now(timezone.utc).isoformat()
        blob_name = f'logs/{datetime.now(timezone.utc).strftime("%Y/%m/%d")}/{context.aws_request_id}.json'

        log_entry = {
            'timestamp': timestamp,
            'source_cloud': 'aws',
            'source_service': 'lambda',
            'source_region': 'us-east-1',
            'event_type': body.get('event_type', 'form_submission'),
            'payload': body
        }

        bucket = 'cross-cloud-audit-logs-bj'
        upload_url = f'https://storage.googleapis.com/upload/storage/v1/b/{bucket}/o'

        response = requests.post(
            upload_url,
            params={'uploadType': 'media', 'name': blob_name},
            headers={
                'Authorization': f'Bearer {credentials.token}',
                'Content-Type': 'application/json'
            },
            data=json.dumps(log_entry, indent=2)
        )

        if response.status_code not in (200, 201):
            raise Exception(f'GCS upload failed: {response.status_code} {response.text}')

        return {
            'statusCode': 200,
            'headers': headers,
            'body': json.dumps({
                'message': 'Audit log written successfully',
                'log_path': f'gs://{bucket}/{blob_name}',
                'written_from': 'AWS Lambda',
                'destination': 'Google Cloud Storage'
            })
        }
    except Exception as e:
        return {
            'statusCode': 500,
            'headers': headers,
            'body': json.dumps({'error': str(e)})
        }