Part 3: Send your notifications to a Slack channel

Before you begin

Be sure that you've completed Part 2: Enabling notifications for Secrets Manager. Before you get started with part 3, you also need the following prerequisites:

• A Slack app with an incoming webhook URL enabled.

• A Slack channel to post your incoming notifications.

  The Slack app must be added to your channel so that incoming messages are displayed. For more information, see the Slack documentation.

Create a Cloud Functions action

Similar to the Cloud Functions actionA code snippet that can be explicitly invoked, or run in response to an event. that you created in the previous tutorial, you can create another action that posts an incoming notification to Slack.

1. In the IBM Cloud console, click the Menu icon > Functions.

2. In the navigation, click Actions > Create.

3. Give the action a name. For example, sm-notifications-slack.

4. Choose the default package.

5. Select a Node.js runtime.

6. Click Create.

7. Obtain your new webhook URL.

   Now that you've created your action and obtained a new webhook URL, you can add it as an Event Notifications destination. Continue to the next step.

Update your Event Notifications settings

Next, update your Event Notifications settings so that the service can begin to forward any incoming events from Secrets Manager to your new Cloud Functions action.

1. In the console, click the Menu icon > Resource list.

2. From the list of resources, select your Event Notifications instance.

3. In the Event Notifications UI, go to Destinations.

4. Create a destination so that your alerts can be forwarded to the Cloud Functions webhook that you created the previous step.

   1. From the navigation, click Destinations > Add.
   2. Provide a name for your destination. For example, Slack.
   3. Select Webhook as the destination type.
   4. Paste the URL that you copied from the Cloud Functions UI.
   5. From the list of HTTP verbs, select POST.
   6. Click Add.

   After you create your destination, copy your destination ID. You use this value to prepare your Functions code in a later step.

Prepare your sample code

Now you can prepare the sample code for your Cloud Functions action.

1. Copy the following JavaScript code and update the placeholder values.

   const axios = require('axios');
   const jwtVerify = require('jsonwebtoken').verify;
   
   // Generate an IAM token
   async function getIAMToken() {
       const options = {
           url: 'https://iam.cloud.ibm.com/identity/token',
           method: 'POST',
           header: 'Content-Type: application/x-www-form-urlencoded',
           data: 'grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=API_KEY'
       };
   
       const response = await axios(options);
       const responseData = response.data;
       console.log("\nGenerated an IAM token..");
       return responseData.access_token;
   }
   
   // Get a public key to verify notifications
   async function getPublicKey() {
       const accessToken = await getIAMToken();
   
       const options = {
           method: 'GET',
           url: '<event_notifications_endpoint_url>/destinations/<destination_id>/public_key',
           headers: {
               'authorization': 'Bearer ' + accessToken
           }
       };
   
       const response = await axios(options);
       const responseData = response.data;
       console.log('\nRetrieved a public key from Event Notifications..');
       return responseData.public_key;
   }
   
   async function main(params) {
   
       try {
           const publicKey = await getPublicKey();
   
           // Verify the notification data using the retrieved public key
           const decodedNotification = await jwtVerify(params.__ow_body, publicKey).data.data;
           console.log(`\nDecoded an incoming event notification from Secrets Manager:\n${JSON.stringify(decodedNotification)}`);
   
           text = `Secrets Manager notification\n\`\`\`${JSON.stringify(decodedNotification)}\`\`\``;
   
           const article = { "text": text };
   
           // Post the decoded notification to Slack
           await axios.post('<slack_webhook_url>', article)
           console.log('\nNotification successfully forwarded to Slack!');
   
       } catch (error) {
           console.error(error);
       }
   }
   

   Table 1. Variables to replace in your Functions code

   Variable	Description
   API_KEY	An IBM Cloud API key with Manager access on the Event Notifications service.
   <event_notifications_endpoint_url>	The base URL of your Event Notifications service instance. For more information, see the Event Notifications API documentation.
   <destination_id>	The ID of the Event Notifications destination that you created in step 2.
   <slack_webhook_url>	The incoming webhook URL that is associated with your Slack app. For example, https://hooks.slack.com/services/<id> For more information, see the Slack documentation.

2. Paste the code into your Functions action.

   1. In the console, go Menu icon > Functions > Actions to return to the Functions UI.
   2. From your list of actions, select the action that you created in step 1.
   3. Paste the code that you modified.
   4. Click Save.

Test your connection to Slack

Finally, verify that you're able to post your notifications to Slack. You can use the Settings > Event Notifications section in the Secrets Manager UI to send a test event.

1. In the IBM Cloud console, go to your Secrets Manager instance.

2. Go to Settings > Event Notifications, and click Send test event.

3. Check the Slack channel that is associated with your webhook to verify the results.

   If the Functions action completed successfully, you receive a Slack message that is similar to the following example:

   Secrets Manager notification
   
   {"event_type":"test_event","secret_type":"test_secret_type","secrets":[{"event_time":"2022-03-09T21:14:32Z","secret_group_id":"default","secret_id":"27d3368f-bb4a-2792-a4b0-ee79a5383866","secret_name":"test_secret_name"}],"source_instance_api_public_url":"https://<instance_id>.<region>.secrets-manager.appdomain.cloud/api","source_instance_crn":"crn:v1:bluemix:public:secrets-manager:<region>:a/<account_id>:<instance_id>::","source_instance_dashboard_url":"https://cloud.ibm.com/services/secrets-manager/<your_service_dashboard_url>","source_service":"SecretsManager"}
   

4. Optional. Check your Cloud Functions activations logs if you encounter issues.

   From the Cloud Functions activations dashboard, you can check to see your activated action. Notification successfully forwarded to Slack! is displayed in the response details if the code runs successfully.

   If you see HTTP 4XX errors in the logs, make sure that the API key in your action code has the correct level of access. For JWT signature errors, verify that the Event Notifications destination ID in the action code corresponds with your Cloud Functions webhook.

Conclusion

Great job! In this tutorial series, you learned how to:

• Connect your Secrets Manager service instance to Event Notifications.
• Create two Cloud Functions actions that forward your incoming notification content to GitHub and Slack.

From now on, a GitHub issue and Slack post are created each time that a certificate in your Secrets Manager service instance expires or is about to expire.