Support Alert Processor in VPC, Various Bug Fixes

[jacknagz]

to: @austinbyers @ryandeivert
cc: @airbnb/streamalert-maintainers
size: medium

Background

The primary purpose of this PR is to support the Alert Processor running from within an AWS VPC (Virtual Private Cloud). The benefit of this change is that alerting logic will be able to reach into private services/resources behind a firewall or security groups in AWS cloud. An example of this is an alert with Phantom as an output, or any other orchestration trigger as a result of a StreamAlert.

Along the way, I identified other small bugs with the CLI that I have also fixed.

Changes

• Modify the tf_stream_alert Terraform module to support running the Alert Processor from within a VPC.
• Fix the stream_alert_cli.py terraform status command.
• Added an option to stream_alert_cli.py terraform destroy to allow destruction of selective modules.
• Fix the handler import path for the alert_processor

Usage

Important! To enable thealert_processor from within a VPC, you must first add the following to your cluster config:

Example:

# terraform/prod.tf

        "stream_alert_prod": {
             ...
            "alert_processor_vpc_subnet_ids": [
              "subnet-55566a3f"
            ],
            "alert_processor_vpc_security_group_ids": [
              "sg-e777f9ab"
            ],
            "alert_processor_vpc_enabled": true,
            ...
        }

You will have to destroy the existing alert processor, you can do it with the following command:

$ cd terraform
$ terraform destroy -target=module.stream_alert_<cluster-name>.aws_lambda_function.streamalert_alert_processor

Then, run:

$ python stream_alert_cli.py terraform build

[chunyong-lin]

Terraform code lgtm.