Skip to content

Commit 8b0bfef

Browse files
author
Mike O'Brien
committed
Update to version v1.2.0
1 parent 7c72840 commit 8b0bfef

File tree

135 files changed

+16097
-1957
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

135 files changed

+16097
-1957
lines changed

‎CHANGELOG.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
55
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
66

7+
## [1.2.0] - 2021-03-22
8+
### Added
9+
- New AFSBP playbook with 12 new remediations
10+
- New Lambda Layer for use by solution lambdas
11+
- New Playbook architecture: Step Function, microservice Lambdas, Systems Manager runbooks
12+
- Corrected anonymous metrics to log only on final state (FAILED or RESOLVED)
13+
- Added logging to put anonymous metrics in solution logs as an audit trail
14+
- Corrected the anonymous metrics UUID to use standard 8-4-4-4-12 format
15+
- Encrypted CloudWatch logs for AFSBP state machine
16+
17+
### Changed
18+
- Consolidated CDK to a single installation
19+
- Moved common/core CDK modules to source/lib
20+
721
## [1.1.0] - 2020-11-15
822
### Changed
923
- Added support for AWS partitions other than 'aws' (aws-us-gov, aws-cn)

‎README.md‎

Lines changed: 79 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,66 @@
1-
# AWS Security Hub Automated Response and Remediation (ID SO0111)
2-
3-
AWS Security Hub Automated Response and Remediation is an add-on solution that enables AWS Security Hub customers to remediate security findings with a single click using predefined response and remediation actions called “Playbooks”. Alternately the playbooks can also be configured to remediate findings in AWS Security Hub automatically. The remediation is performed using AWS Lambda and in some cases using AWS Systems Manager, the playbooks execute steps to remediate security issues, such as unused keys, open security groups, password policies, VPC configurations and public S3 buckets. The solution contains the playbook remediations for some of the security standards defined as part of CIS AWS Foundations Benchmark v1.2.0.
4-
5-
## Getting Started
6-
To get started with the AWS Security Hub Automated Response and Remediation, please review the solution documentation. [AWS Security Hub Automated Response and Remediation](https://aws.amazon.com/solutions/implementations/aws-security-hub-automated-response-and-remediation/)
7-
8-
## Building from GitHub
9-
10-
### Overview of the Process
11-
12-
Building from GitHub source will allow you to modify the solution, such as adding custom actions or upgrading to a new release. The process consists of downloading the source from GitHub, creating buckets to be used for deployment, building the solution, and uploading the artifacts needed for deployment.
13-
14-
#### You will need:
1+
[🚀 Solution Landing
2+
Page](https://aws.amazon.com/solutions/implementations/aws-security-hub-automated-response-and-remediation/)
3+
\| [🚧 Feature
4+
request](https://github.com/awslabs/aws-security-hub-automated-response-and-remediation/issues/new?assignees=&labels=feature-request%2C+enhancement&template=feature_request.md&title=)
5+
\| [🐛 Bug
6+
Report](https://github.com/awslabs/aws-security-hub-automated-response-and-remediation%3E/issues/new?assignees=&labels=bug%2C+triage&template=bug_report.md&title=)
7+
8+
Note: If you want to use the solution without building from source, navigate to
9+
Solution Landing Page
10+
11+
## Table of contents
12+
13+
- [Solution Overview](#solution-overview)
14+
- [Architecture Diagram](#architecture-diagram)
15+
- [AWS CDK Constructs](#aws-solutions-constructs)
16+
- [Customizing the Solution](#customizing-the-solution)
17+
- [Prerequisites for Customization](#prerequisites-for-customization)
18+
- [Build](#build)
19+
- [Unit Test](#unit-test)
20+
- [Deploy](#deploy)
21+
- [File Structure](#file-structure)
22+
- [License](#license)
23+
24+
<a name="solution-overview"></a>
25+
# Solution Overview
26+
27+
AWS Security Hub Automated Response and Remediation is an add-on solution that
28+
enables AWS Security Hub customers to remediate security findings with a single
29+
click using predefined response and remediation actions called “Playbooks”.
30+
Alternately the playbooks can also be configured to remediate findings in AWS
31+
Security Hub automatically. The remediation is performed using AWS Lambda and in
32+
some cases using AWS Systems Manager, the playbooks execute steps to remediate
33+
security issues, such as unused keys, open security groups, password policies,
34+
VPC configurations and public S3 buckets. The solution contains the playbook
35+
remediations for some of the security standards defined as part of CIS AWS
36+
Foundations Benchmark v1.2.0 and for AWS Foundational Security Best Practices
37+
v1.0.0.
38+
39+
<a name="architecture-diagram"></a>
40+
# Architecture Diagram
41+
42+
![](./SHARR v1.2.jpg)
43+
44+
<a name="aws-solutions-constructs"></a>
45+
# AWS Solutions Constructs
46+
* aws-events-rule-lambda - creates event rules that trigger the appropriate remediation, as well as any necessary permissions.
47+
48+
<a name="customizing-the-solution"></a>
49+
# Customizing the Solution
50+
51+
<a name="prerequisites-for-customization"></a>
52+
## Prerequisites for Customization
1553

1654
* a Linux client with the AWS CLI v2 installed and python 3.7+, AWS CDK
1755
* source code downloaded from GitHub
1856
* two S3 buckets (minimum): 1 global and 1 for each region where you will deploy
57+
* An Amazon S3 Bucket for solution templates - accessed globally via https.
58+
* An Amazon S3 Bucket for source code - regional.
1959

20-
### Download from GitHub
60+
<a name="build"></a>
61+
## Build
62+
63+
Building from GitHub source will allow you to modify the solution, such as adding custom actions or upgrading to a new release. The process consists of downloading the source from GitHub, creating buckets to be used for deployment, building the solution, and uploading the artifacts needed for deployment.
2164

2265
Clone or download the repository to a local directory on your linux client. Note: if you intend to modify Ops Automator you may wish to create your own fork of the GitHub repo and work from that. This allows you to check in any changes you make to your private copy of the solution.
2366

@@ -32,20 +75,6 @@ git clone https://github.com/awslabs/aws-security-hub-automated-response-and-rem
3275
wget https://github.com/awslabs/aws-security-hub-automated-response-and-remediation/archive/master.zip
3376
```
3477

35-
#### Repository Organization
36-
aws-security-hub-automated-response-and-remediation uses AWS CDK for generating the cloudformation templates.
37-
```
38-
|-source/
39-
|-playbooks [ Playbooks CloudDevelopment Kit Code and lambda source code]
40-
|- core/ [ Cloud Development Kit common node module ]
41-
|- CIS/ [ CIS playbook code ]
42-
|- python_lib/ [ Python libraries used in the lambda source code in CIS playbooks ]
43-
|- python_tests/ [ Python unit tests for libraries used in the lambda source code ]
44-
|-solution_deploy [ Solution Cloud Development Kit node module ]
45-
```
46-
47-
### Build
48-
4978
AWS Solutions use two buckets: a bucket for global access to templates, which is accessed via HTTPS, and regional buckets for access to assets within the region, such as Lambda code. You will need:
5079

5180
* One global bucket that is access via the http end point. AWS CloudFormation templates are stored here. Ex. "mybucket"
@@ -79,14 +108,30 @@ cd ./deployment
79108
./upload_s3_dist.sh <region>
80109
```
81110

111+
<a name="unit-test"></a>
112+
## Unit Test
113+
114+
<a name="deploy"></a>
82115
## Deploy
83116

84-
See the (AWS Security Hub Automated Response and Remediation Implementation Guide)[http://link] for deployment instructions, using the link to the SolutionDeployStack.template from your bucket, rather than the one for AWS Solutions. Ex. https://mybucket.s3.amazonaws.com/aws-security-hub-automated-response-and-remediation/v1.0.0.mybuild/aws-sharr-deploy.template
117+
See the (AWS Security Hub Automated Response and Remediation Implementation Guide)[http://link] for deployment instructions, using the link to the SolutionDeployStack.template from your bucket, rather than the one for AWS Solutions. Ex. https://mybucket-reference.s3.amazonaws.com/aws-security-hub-automated-response-and-remediation/v1.0.0.mybuild/aws-sharr-deploy.template
85118

86-
Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
119+
<a name="file-structure"></a>
120+
# File structure
87121

88-
Licensed under the Apache License Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
122+
aws-security-hub-automated-response-and-remediation uses AWS CDK for generating the cloudformation templates.
123+
<pre>
124+
|-source/
125+
|-playbooks [ Playbooks CloudDevelopment Kit Code and lambda source code]
126+
|- core/ [ Cloud Development Kit common node module ]
127+
|- CIS/ [ CIS playbook code ]
128+
|- python_lib/ [ Python libraries used in the lambda source code in CIS playbooks ]
129+
|- python_tests/ [ Python unit tests for libraries used in the lambda source code ]
130+
|-solution_deploy [ Solution Cloud Development Kit node module ]
131+
</pre>
89132

90-
http://www.apache.org/licenses/
133+
<a name="license"></a>
134+
# License
91135

92-
or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, express or implied. See the License for the specific language governing permissions and limitations under the License.
136+
See license
137+
[here](https://github.com/awslabs/%3Cinsert-solution-repo-name%3E/blob/master/LICENSE.txt)

‎SHARR v1.2.jpg‎

99.9 KB
Loading

‎deployment/build-s3-dist.sh‎

Lines changed: 70 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,10 @@
1717
# - version-code: version of the package
1818

1919
# Important: CDK global version number
20-
required_cdk_version=1.68.0
20+
# This controls the CDK and AWS Solutions Constructs version. Solutions
21+
# Constructs versions map 1:1 to CDK versions. When setting this value,
22+
# choose the latest AWS Solutions Constructs version.
23+
required_cdk_version=1.85.0
2124

2225
# Functions to reduce repetitive code
2326
# do_cmd will exit if the command has a non-zero return code.
@@ -148,7 +151,13 @@ do_cmd rm -rf $temp_work_dir
148151
do_cmd mkdir -p $temp_work_dir
149152

150153
echo "------------------------------------------------------------------------------"
151-
echo "[Copy] Copy source to temp and remove unwanted files"
154+
echo "[Init] Create folders"
155+
echo "------------------------------------------------------------------------------"
156+
mkdir ${build_dist_dir}/lambda
157+
mkdir -p ${template_dist_dir}/playbooks
158+
159+
echo "------------------------------------------------------------------------------"
160+
echo "[Copy] Copy source to temp, remove unwanted files"
152161
echo "------------------------------------------------------------------------------"
153162
do_cmd cp -r $source_dir $temp_work_dir # make a copy to work from
154163
cd $temp_work_dir
@@ -157,16 +166,18 @@ find . -name node_modules | while read file;do rm -rf $file; done
157166
# remove package-lock.json
158167
find . -name package-lock.json | while read file;do rm $file; done
159168

169+
# Propagate the $required_cdk_version to all of the package.json files.
170+
# This makes it very simple to update the version by changing the value above.
171+
cd $temp_work_dir/source
172+
find . -name package.json | while read package; do
173+
do_replace $package "###CDK###" $required_cdk_version
174+
done
175+
160176
echo "------------------------------------------------------------------------------"
161177
echo "[Install] CDK"
162178
echo "------------------------------------------------------------------------------"
163179

164-
# install typescript once so we can build each of the packages below
165-
# If this must be done for the pipeline then we need to figure out how to detect
166-
# command-line (user) build so as not to do global install (requires root/sudo)
167-
# npm install -g typescript
168-
#
169-
cd $temp_work_dir/source/solution_deploy
180+
cd $temp_work_dir/source
170181
do_cmd npm install # local install per package.json
171182
do_cmd npm install aws-cdk@$required_cdk_version
172183
export PATH=$(npm bin):$PATH
@@ -179,48 +190,66 @@ if [[ $cdkver != $required_cdk_version ]]; then
179190
fi
180191
do_cmd npm run build # build javascript from typescript
181192

193+
echo "------------------------------------------------------------------------------"
194+
echo "[Pack] Lambda Layer (used by playbooks)"
195+
echo "------------------------------------------------------------------------------"
196+
cd $template_dir
197+
mkdir -p $temp_work_dir/source/solution_deploy/lambdalayer/python
198+
cp $source_dir/LambdaLayers/*.py $temp_work_dir/source/solution_deploy/lambdalayer/python
199+
pip install -r ./requirements.txt -t $temp_work_dir/source/solution_deploy/lambdalayer/python
200+
cd $temp_work_dir/source/solution_deploy/lambdalayer
201+
zip --recurse-paths ${build_dist_dir}/lambda/layer.zip python
202+
182203
echo "------------------------------------------------------------------------------"
183204
echo "[Pack] Custom Action Lambda"
184205
echo "------------------------------------------------------------------------------"
185206
cd $template_dir
186-
pip install -r ./requirements.txt -t $temp_work_dir/source/solution_deploy/source
187207
cd $temp_work_dir/source/solution_deploy/source
188-
mkdir ${build_dist_dir}/lambda
189-
zip --recurse-paths ${build_dist_dir}/lambda/createCustomAction.py.zip createCustomAction.py lib/* requests/* chardet/* certifi/* idna/* urllib3/*
208+
zip ${build_dist_dir}/lambda/createCustomAction.py.zip createCustomAction.py
209+
210+
echo "------------------------------------------------------------------------------"
211+
echo "[Pack] Orchestrator Lambdas"
212+
echo "------------------------------------------------------------------------------"
213+
cd $template_dir
214+
cd $temp_work_dir/source/Orchestrator
215+
ls | while read file; do
216+
zip ${build_dist_dir}/lambda/${file}.zip ${file}
217+
done
218+
# Copy LambdaLayer modules in preparation for running tests
219+
# These are not packaged with the Lambda
220+
do_cmd cp ../LambdaLayers/*.py .
190221

191222
echo "------------------------------------------------------------------------------"
192223
echo "[Create] Playbook Templates - CIS"
193224
echo "------------------------------------------------------------------------------"
194225
mkdir -p ${build_dist_dir}/playbooks/CIS
195-
mkdir -p ${template_dist_dir}/playbooks
196-
197-
# install npm locally in playbooks/core
198-
cd $temp_work_dir/source/playbooks/core
199-
npm install -s
200226

201-
# Install npm for the compliance pack:
202227
do_cmd cd $temp_work_dir/source/playbooks/CIS
203-
do_cmd npm install -s
204-
do_cmd npm run build
205228

206-
# Create the template for the compliance pack
207-
cdk --no-version-reporting synth CisStack > $template_dist_dir/playbooks/CIS.template
208-
cdk --no-version-reporting synth CisPermissionsStack > $template_dist_dir/playbooks/CISPermissions.template
229+
# Output YAML - this is currently the only way to do this for multiple templates
230+
for template in `cdk list`; do
231+
echo Create CIS template $template
232+
cdk --no-version-reporting synth $template > ${template_dist_dir}/playbooks/${template}.template
233+
done
234+
235+
# To maintain consistency with the original install documentation
236+
mv $template_dist_dir/playbooks/CISPermissionsStack.template $template_dist_dir/playbooks/CISPermissions.template
209237

210238
if [[ -d ./lambda ]]; then
211239
do_cmd mkdir -p ${build_dir}/playbooks/CIS/tests # output directory
212240
do_cmd mkdir -p ${build_dir}/playbooks/CIS/lib
213241
do_cmd cp lambda/*.py ${build_dir}/playbooks/CIS
242+
do_cmd cp lambda/.coveragerc ${build_dir}/playbooks/CIS
214243
do_cmd cp -R lambda/tests/* ${build_dir}/playbooks/CIS/tests
215244
# All playbooks get all libs. This is OK right now, but may need to be
216245
# more specific later.
217246
do_cmd cp -R $temp_work_dir/source/playbooks/python_lib/* ${build_dir}/playbooks/CIS/lib
218247
do_cmd cp -R $temp_work_dir/source/playbooks/python_tests/* ${build_dir}/playbooks/CIS/tests
219-
do_cmd cp -R ${temp_work_dir}/source/solution_deploy/source/requests ${build_dir}/playbooks/CIS/
220-
do_cmd cp -R ${temp_work_dir}/source/solution_deploy/source/urllib3 ${build_dir}/playbooks/CIS/
221-
do_cmd cp -R ${temp_work_dir}/source/solution_deploy/source/chardet ${build_dir}/playbooks/CIS/
222-
do_cmd cp -R ${temp_work_dir}/source/solution_deploy/source/certifi ${build_dir}/playbooks/CIS/
223-
do_cmd cp -R ${temp_work_dir}/source/solution_deploy/source/idna ${build_dir}/playbooks/CIS/
248+
do_cmd cp -R ${temp_work_dir}/source/solution_deploy/lambdalayer/python/requests ${build_dir}/playbooks/CIS/
249+
do_cmd cp -R ${temp_work_dir}/source/solution_deploy/lambdalayer/python/urllib3 ${build_dir}/playbooks/CIS/
250+
do_cmd cp -R ${temp_work_dir}/source/solution_deploy/lambdalayer/python/chardet ${build_dir}/playbooks/CIS/
251+
do_cmd cp -R ${temp_work_dir}/source/solution_deploy/lambdalayer/python/certifi ${build_dir}/playbooks/CIS/
252+
do_cmd cp -R ${temp_work_dir}/source/solution_deploy/lambdalayer/python/idna ${build_dir}/playbooks/CIS/
224253
rm -rf ${build_dir}/playbooks/CIS/lib/__pycache__/
225254

226255
cd ${build_dir}/playbooks/CIS
@@ -229,7 +258,19 @@ if [[ -d ./lambda ]]; then
229258
done
230259
fi
231260

232-
cd ${template_dir}
261+
echo "------------------------------------------------------------------------------"
262+
echo "[Create] Playbook Templates - AFSBP"
263+
echo "------------------------------------------------------------------------------"
264+
mkdir -p ${build_dist_dir}/playbooks/AFSBP
265+
266+
do_cmd cd $temp_work_dir/source/playbooks/AFSBP
267+
268+
# Output YAML - this is currently the only way to do this for multiple templates
269+
for template in `cdk list`; do
270+
echo Create AFSBP template $template
271+
# do_cmd npm run build
272+
cdk --no-version-reporting synth $template > ${template_dist_dir}/playbooks/${template}.template
273+
done
233274

234275
echo "------------------------------------------------------------------------------"
235276
echo "[Create] Deployment Templates"
@@ -240,8 +281,7 @@ cd $temp_work_dir/source/solution_deploy
240281
# Output YAML - this is currently the only way to do this for multiple templates
241282
for template in `cdk ls`; do
242283
echo Create template $template
243-
# do_cmd npm run build
244-
cdk --no-version-reporting synth $template -c solutionId=$SOLUTION_ID > ${template_dist_dir}/${template}.template
284+
cdk --no-version-reporting synth $template > ${template_dist_dir}/${template}.template
245285
done
246286
cd ${template_dir}
247287

0 commit comments

Comments
 (0)