import json
import gzip
import json
import base64
import boto3
import uuid
import time
import random
import string
import array

def lambda_handler(event, context):
    secret_id = event["secretid"]
    user_type = event["usertype"]

    #get the information of the secret
    sm_client = boto3.client('secretsmanager')
    sm_response = sm_client.get_secret_value(
        SecretId=secret_id
    )
    secret_name = sm_response["Name"]
    str_length = len(secret_name)   
    slash_index = secret_name.find("/")
    platform_id = secret_name[0:slash_index]
    user_name = secret_name[slash_index+1:str_length]
    
    #generate a random password
    new_passwd = get_random_password()
    
    #change AD user's password
    if(user_type=="AD"):
        change_ad_user_password(platform_id, user_name, new_passwd)
        
    #change local user's password
    if(user_type=="Local"):
        change_local_user_password(platform_id, user_name, new_passwd)
        
    #change password's value in Secret Manager
    change_secret_value(secret_id, new_passwd)
    
    
def change_ad_user_password(ad_id, user_name, new_passwd):
    ad_client = boto3.client('ds')
    ad_response = ad_client.reset_user_password(
        DirectoryId=ad_id,
        UserName=user_name,
        NewPassword=new_passwd
    )
    
def change_local_user_password(instance_id, user_name, new_passwd):
    #change local user password by SSM's SendCommand
    command = "& ""${env:SYSTEMROOT}\\system32\\net.exe"" user "+ user_name +" " + new_passwd + " /ACTIVE:YES /LOGONPASSWORDCHG:NO /EXPIRES:NEVER /PASSWORDREQ:YES"
    ssm_client = boto3.client('ssm')
    response = ssm_client.send_command(
        InstanceIds=[
            instance_id,
        ],
        DocumentName='AWS-RunPowerShellScript',
        Parameters={
            'commands': [
                command,
            ]
        }
    )
    
def change_secret_value(secret_id, new_passwd):
    secret_string = '{"password":"'+new_passwd+'"}'
    sm_client = boto3.client('secretsmanager')
    sm_response = sm_client.put_secret_value(
        SecretId=secret_id,
        SecretString=secret_string
    )

def get_random_password():
    # maximum length of password needed
    # this can be changed to suit your password length
    MAX_LEN = 16
 
    # declare arrays of the character that we need in out password
    # Represented as chars to enable easy string concatenation
    DIGITS = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9'] 
    LOCASE_CHARACTERS = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h',
                         'i', 'j', 'k', 'm', 'n', 'o', 'p', 'q',
                         'r', 's', 't', 'u', 'v', 'w', 'x', 'y',
                         'z']
 
    UPCASE_CHARACTERS = ['A', 'B', 'C', 'D', 'E', 'F', 'G', 'H',
                         'I', 'J', 'K', 'M', 'N', 'O', 'P', 'Q',
                         'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y',
                         'Z']
     
    SYMBOLS = ['@', '#', '$', '%', '=', ':', '?', '.', '/', '|', '~', '>',
               '*', '(', ')', '<']
 
    # combines all the character arrays above to form one array
    COMBINED_LIST = DIGITS + UPCASE_CHARACTERS + LOCASE_CHARACTERS + SYMBOLS
     
    # randomly select at least one character from each character set above
    rand_digit = random.choice(DIGITS)
    rand_upper = random.choice(UPCASE_CHARACTERS)
    rand_lower = random.choice(LOCASE_CHARACTERS)
    rand_symbol = random.choice(SYMBOLS)
 
    # combine the character randomly selected above
    # at this stage, the password contains only 4 characters but
    # we want a 12-character password
    temp_pass = rand_digit + rand_upper + rand_lower + rand_symbol
     
     
    # now that we are sure we have at least one character from each
    # set of characters, we fill the rest of
    # the password length by selecting randomly from the combined
    # list of character above.
    for x in range(MAX_LEN - 4):
        temp_pass = temp_pass + random.choice(COMBINED_LIST)
     
        # convert temporary password into array and shuffle to
        # prevent it from having a consistent pattern
        # where the beginning of the password is predictable
        temp_pass_list = array.array('u', temp_pass)
        random.shuffle(temp_pass_list)
 
    # traverse the temporary password array and append the chars
    # to form the password
    password = ""
    for x in temp_pass_list:
            password = password + x
            
    return password

{
            "Effect": "Allow",
            "Action": [
                "secretsmanager:PutSecretValue",
                "secretsmanager:GetSecretValue",
                "ssm:SendCommand",
                "ds:ResetUserPassword",
                "secretsmanager:ListSecrets"
            ],
            "Resource": [
                "*"
            ]
 }

{
  "Comment": "A description of my state machine",
  "StartAt": "Wait 8 hours",
  "States": {
    "Wait 8 hours": {
      "Type": "Wait",
      "Seconds": 30,
      "Next": "Lambda - Change Password",
      "OutputPath": "$"
    },
    "Lambda - Change Password": {
      "Type": "Task",
      "Resource": "arn:aws-cn:states:::lambda:invoke",
      "OutputPath": "$.Payload",
      "Parameters": {
        "Payload.$": "$",
        "FunctionName": "arn:aws-cn:lambda:cn-northwest-1:{AWS Account ID}:function:RotateUserPassword-ChangePassword:$LATEST"
      },
      "Retry": [
        {
          "ErrorEquals": [
            "Lambda.ServiceException",
            "Lambda.AWSLambdaException",
            "Lambda.SdkClientException"
          ],
          "IntervalSeconds": 2,
          "MaxAttempts": 6,
          "BackoffRate": 2
        }
      ],
      "End": true
    }
  }
}

import json
import gzip
import json
import base64
import boto3
import uuid
import time

def lambda_handler(event, context):
    cw_data = event['awslogs']['data']
    compressed_payload = base64.b64decode(cw_data)
    uncompressed_payload = gzip.decompress(compressed_payload)
    payload = json.loads(uncompressed_payload)
    #print('how many events:', len(payload['logEvents']))
    log_events = payload['logEvents']

    #iterate all log events    
    for event in log_events:
        output = event['message']
        data = json.loads(output)
        secret_id = data['requestParameters']['secretId']
        user_type = ""
        #Run step function to change user password
        if ":secret:d-" in secret_id:
            user_type = "AD"
        if ":secret:i-" in secret_id:
            user_type = "Local"
        if user_type == "AD" or user_type == "Local":
            client = boto3.client('stepfunctions')
            sf_input = "{\"secretid\" : \""+ secret_id +"\", \"usertype\" : \""+ user_type + "\"}"
            response = client.start_execution(
                stateMachineArn='arn:aws-cn:states:cn-northwest-1: {AWS Account ID}:stateMachine:RotateUserPasswordStepFunction',
                input = sf_input
            )

{
            "Effect": "Allow",
            "Action": [
                "states:StartExecution"
            ],
            "Resource": [
                "*"
            ]
 }