Skip to content

Commit c6372a6

Browse files
arya23065arya23065
authored
Added automatic lambda code scan to Inspector (#179)
* Added automatic lambda code scan to Inspector * Fixed indentation * Fixed linting * Fixed more linting issues
1 parent f67dc65 commit c6372a6

File tree

15 files changed

+88
-56
lines changed

15 files changed

+88
-56
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2023-10-10](#2023-10-10)
67
- [2023-09-22](#2023-09-22)
78
- [2023-08-07](#2023-08-07)
89
- [2023-07-07](#2023-07-07)
@@ -44,6 +45,9 @@
4445
All notable changes to this project will be documented in this file.
4546

4647
---
48+
## 2023-10-10
49+
50+
- Updated [Inspector](https://github.com/aws-samples/aws-security-reference-architecture-examples/tree/main/aws_sra_examples/solutions/inspector/inspector_org) solution to enable automatic lambda code scan.
4751

4852
## 2023-09-22
4953

‎aws_sra_examples/easy_setup/customizations_for_aws_control_tower/manifest.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ resources:
194194

195195
# Inspector Solution
196196
- parameter_key: pScanComponents
197-
parameter_value: 'EC2, ECR, LAMBDA'
197+
parameter_value: 'EC2, ECR, LAMBDA, LAMBDA_CODE'
198198
- parameter_key: pEcrRescanDuration
199199
parameter_value: 'LIFETIME'
200200

‎aws_sra_examples/easy_setup/templates/sra-easy-setup.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,7 @@ Metadata:
226226
default: SRA Staging S3 Bucket Stack Name
227227

228228
pScanComponents:
229-
default: Comma separated list of scan components (EC2, ECR, LAMBDA)
229+
default: Comma separated list of scan components (EC2, ECR, LAMBDA, LAMBDA_CODE)
230230
pEcrRescanDuration:
231231
default: ECR Rescan Duration
232232
pDeployInspectorSolution:
@@ -522,8 +522,8 @@ Parameters:
522522
Type: String
523523

524524
pScanComponents:
525-
AllowedValues: [EC2, ECR, LAMBDA]
526-
Default: EC2, ECR, LAMBDA
525+
AllowedValues: [EC2, ECR, LAMBDA, LAMBDA_CODE]
526+
Default: EC2, ECR, LAMBDA, LAMBDA_CODE
527527
Description: Lambda Function Logging Level
528528
Type: CommaDelimitedList
529529
pEcrRescanDuration:

‎aws_sra_examples/quick_setup/customizations_for_aws_control_tower/manifest-v2.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ resources:
185185
- parameter_key: pDeployInspectorSolution
186186
parameter_value: 'Yes'
187187
- parameter_key: pScanComponents
188-
parameter_value: 'EC2, ECR, LAMBDA'
188+
parameter_value: 'EC2, ECR, LAMBDA, LAMBDA_CODE'
189189
- parameter_key: pEcrRescanDuration
190190
parameter_value: 'LIFETIME'
191191

‎aws_sra_examples/quick_setup/templates/sra-quick-setup-ssm.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ Metadata:
358358
pSRAStagingS3BucketName:
359359
default: SRA Staging S3 Bucket Name
360360
pScanComponents:
361-
default: Comma separated list of scan components (EC2, ECR, LAMBDA)
361+
default: Comma separated list of scan components (EC2, ECR, LAMBDA, LAMBDA_CODE)
362362
pSecurityContactAction:
363363
default: Security Alternate Contact Action
364364
pSecurityEmail:
@@ -929,8 +929,8 @@ Parameters:
929929
name can include numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen (-).
930930
Type: AWS::SSM::Parameter::Value<String>
931931
pScanComponents:
932-
AllowedValues: [EC2, ECR, LAMBDA]
933-
Default: EC2, ECR, LAMBDA
932+
AllowedValues: [EC2, ECR, LAMBDA, LAMBDA_CODE]
933+
Default: EC2, ECR, LAMBDA, LAMBDA_CODE
934934
Description: Lambda Function Logging Level
935935
Type: CommaDelimitedList
936936
pSecurityContactAction:

‎aws_sra_examples/solutions/inspector/inspector_org/README.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ The Inspector Organization solution will automate enabling Amazon Inspector by d
8585
#### 1.10 Inspector<!-- omit in toc -->
8686

8787
- The Inspector delegated administrator is registered within organizations in the `management account` using the Inspector APIs within each provided region.
88-
- EC2, ECR, and Lambda function scanning is set to be auto-enabled for all associated member accounts (newly associated and newly created accounts)
88+
- EC2, ECR, Lambda standard and Lambda code scanning is set to be auto-enabled for all associated member accounts (newly associated and newly created accounts)
8989

9090
#### 1.11 Lambda Layer<!-- omit in toc -->
9191

@@ -112,7 +112,7 @@ populated from the `SecurityAccountId` parameter within the `AWSControlTowerBP-B
112112
#### 2.3 Inspector (Delegated admin)<!-- omit in toc -->
113113

114114
- Inspector is enabled in the delegated admin account within each provided region.
115-
- EC2, ECR, and Lambda function scanning is enabled.
115+
- EC2, ECR, Lambda standard and Lambda code scanning is enabled.
116116

117117
---
118118

@@ -129,7 +129,7 @@ populated from the `SecurityAccountId` parameter within the `AWSControlTowerBP-B
129129
#### 3.3 Inspector (Members)<!-- omit in toc -->
130130

131131
- Inspector is enabled from the delegated administrator account.
132-
- EC2, ECR, and Lambda function scanning is enabled.
132+
- EC2, ECR, Lambda standard and Lambda code scanning is enabled.
133133

134134
---
135135

@@ -171,9 +171,9 @@ In the `management account (home region)`, launch an AWS CloudFormation **Stack*
171171
1. Verify that the delegated admin account is set for each region
172172
2. Log into the Audit account and navigate to the Inspector page
173173
1. Verify the Inspector service is enabled in each region
174-
2. Verify the auto-enable ec2, ecr, and lambda scanning for new accounts is ON in each region
175-
3. Verify all existing member accounts have inspector ec2, ecr, and lambda scanning enabled in each region
176-
3. Log into a member account and verify the inspector is enabled and configured to scan ec2, ecr, and lambda functions
174+
2. Verify the auto-enable ec2, ecr and lambda standard scanning for new accounts is ON in each region, and lambda code scanning in supported regions
175+
3. Verify all existing member accounts have inspector ec2, ecr, and lambda standard scanning enabled in each region, and lambda code scanning in supported regions
176+
3. Log into a member account and verify the inspector is enabled and configured to scan ec2, ecr, lambda functions and lambda code
177177

178178
#### Solution Update Instructions<!-- omit in toc -->
179179

@@ -205,3 +205,4 @@ In the `management account (home region)`, launch an AWS CloudFormation **Stack*
205205
- [Managing AWS SDKs in Lambda Functions](https://docs.aws.amazon.com/lambda/latest/operatorguide/sdks-functions.html)
206206
- [Lambda runtimes](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html)
207207
- [Python Boto3 SDK changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
208+
- [AWS Regions where Lambda code scanning is currently available](https://docs.aws.amazon.com/inspector/latest/user/inspector_regions.html)

‎aws_sra_examples/solutions/inspector/inspector_org/customizations_for_aws_control_tower/manifest-v2.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ resources:
3030
- parameter_key: pSRASolutionVersion
3131
parameter_value: 'v1.0'
3232
- parameter_key: pScanComponents
33-
parameter_value: EC2, ECR, LAMBDA
33+
parameter_value: EC2, ECR, LAMBDA, LAMBDA_CODE
3434
- parameter_key: pEcrRescanDuration
3535
parameter_value: 'LIFETIME'
3636
deploy_method: stack_set

‎aws_sra_examples/solutions/inspector/inspector_org/customizations_for_aws_control_tower/parameters/sra-inspector-org-main-ssm.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
},
3838
{
3939
"ParameterKey": "pScanComponents",
40-
"ParameterValue": "EC2, ECR, LAMBDA"
40+
"ParameterValue": "EC2, ECR, LAMBDA, LAMBDA_CODE"
4141
},
4242
{
4343
"ParameterKey": "pEcrRescanDuration",

‎aws_sra_examples/solutions/inspector/inspector_org/customizations_for_aws_control_tower/parameters/sra-inspector-org-main.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
},
5454
{
5555
"ParameterKey": "pScanComponents",
56-
"ParameterValue": "EC2, ECR, LAMBDA"
56+
"ParameterValue": "EC2, ECR, LAMBDA, LAMBDA_CODE"
5757
},
5858
{
5959
"ParameterKey": "pEcrRescanDuration",

‎aws_sra_examples/solutions/inspector/inspector_org/lambda/src/app.py‎

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
UNEXPECTED = "Unexpected!"
3737
SERVICE_NAME = "inspector2.amazonaws.com"
3838
SNS_PUBLISH_BATCH_MAX = 10
39-
ALL_INSPECTOR_SCAN_COMPONENTS = ["EC2", "ECR", "LAMBDA"]
39+
ALL_INSPECTOR_SCAN_COMPONENTS = ["EC2", "ECR", "LAMBDA", "LAMBDA_CODE"]
4040

4141
helper = CfnResource(json_logging=True, log_level=log_level, boto_level="CRITICAL", sleep_on_delete=120)
4242

@@ -172,7 +172,9 @@ def get_validated_parameters(event: Dict[str, Any]) -> dict:
172172
params.update(parameter_pattern_validator("SNS_TOPIC_ARN", os.environ.get("SNS_TOPIC_ARN"), pattern=sns_topic_pattern))
173173
params.update(
174174
parameter_pattern_validator(
175-
"SCAN_COMPONENTS", os.environ.get("SCAN_COMPONENTS"), pattern=r"(?i)^((ec2|ecr|lambda),?){0,2}(ec2|ecr|lambda){1}$"
175+
"SCAN_COMPONENTS",
176+
os.environ.get("SCAN_COMPONENTS"),
177+
pattern=r"(?i)^((ec2|ecr|lambda|lambda_code),?){0,3}(ec2|ecr|lambda|lambda_code){1}$",
176178
)
177179
)
178180
params.update(parameter_pattern_validator("ECR_SCAN_DURATION", os.environ.get("ECR_SCAN_DURATION"), pattern=r"^(LIFETIME|DAYS_30|DAYS_180){1}$"))
@@ -374,22 +376,17 @@ def setup_inspector_in_region(
374376
scan_components: list of components to scan
375377
ecr_scan_duration: ecr scan duration
376378
"""
377-
scan_component_dict: AutoEnableTypeDef = {"ec2": False, "ecr": False, "lambda": False}
379+
scan_component_dict: AutoEnableTypeDef = {"ec2": False, "ecr": False, "lambda": False, "lambdaCode": False}
378380
for scan_component in scan_components:
379-
if scan_component.lower() == "ec2":
380-
scan_component_dict["ec2"] = True
381-
elif scan_component.lower() == "ecr":
382-
scan_component_dict["ecr"] = True
383-
elif scan_component.lower() == "lambda":
384-
scan_component_dict["lambda"] = True
381+
scan_component_dict[common.snake_to_camel(scan_component)] = True # type: ignore
382+
383+
if scan_component_dict["lambdaCode"] and not scan_component_dict["lambda"]:
384+
scan_component_dict["lambda"] = True
385385

386386
disabled_components: list = []
387-
if scan_component_dict["ec2"] is False:
388-
disabled_components.append("ec2")
389-
if scan_component_dict["ecr"] is False:
390-
disabled_components.append("ecr")
391-
if scan_component_dict["lambda"] is False:
392-
disabled_components.append("lambda")
387+
for scan_component in scan_component_dict:
388+
if scan_component_dict[scan_component] is False: # type: ignore
389+
disabled_components.append(scan_component)
393390

394391
LOGGER.info(f"setup_inspector_in_region: scan_components - ({scan_components}) in {region}")
395392
LOGGER.info(f"setup_inspector_in_region: created scan_component_dict as ({scan_component_dict})")

0 commit comments

Comments
 (0)