This repository has been archived by the owner on Jan 23, 2025. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 119
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: add remaining cis aws 1.4 rules (#916)
* feat: add remaining cis aws 1.4 rules * fix linting * fix failing tests * add missing docs
- Loading branch information
Showing
18 changed files
with
403 additions
and
48 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
|
|
||
|
|
||
| Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or | ||
| intentional modifications that may lead to unauthorized access or other security breaches. | ||
| This monitoring technique helps you to ensure that any unexpected changes performed | ||
| within your AWS Organizations can be investigated and any unwanted changes can be | ||
| rolled back. | ||
|
|
||
|
|
||
| ### Impact | ||
| Lack of observability into critical organisation changes | ||
|
|
||
| <!-- DO NOT CHANGE --> | ||
| {{ remediationActions }} | ||
|
|
||
| ### Links | ||
| - https://docs.aws.amazon.com/organizations/latest/userguide/orgs_security_incident-response.html | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
|
|
||
|
|
||
| Configuring all VPC default security groups to restrict all traffic will encourage least | ||
| privilege security group development and mindful placement of AWS resources into | ||
| security groups which will in-turn reduce the exposure of those resources. | ||
|
|
||
|
|
||
| ### Impact | ||
| Easier to accidentally expose resources - goes against principle of least privilege | ||
|
|
||
| <!-- DO NOT CHANGE --> | ||
| {{ remediationActions }} | ||
|
|
||
| ### Links | ||
| - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/default-custom-security-groups.html | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
47 changes: 47 additions & 0 deletions
47
internal/rules/aws/cloudwatch/require_org_changes_alarm.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| package cloudwatch | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/defsec/internal/rules" | ||
| "github.com/aquasecurity/defsec/pkg/framework" | ||
| "github.com/aquasecurity/defsec/pkg/providers" | ||
| "github.com/aquasecurity/defsec/pkg/scan" | ||
| "github.com/aquasecurity/defsec/pkg/severity" | ||
| "github.com/aquasecurity/defsec/pkg/state" | ||
| "github.com/aquasecurity/defsec/pkg/types" | ||
| ) | ||
|
|
||
| var CheckRequireOrgChangesAlarm = rules.Register( | ||
| scan.Rule{ | ||
| AVDID: "AVD-AWS-0174", | ||
| Provider: providers.AWSProvider, | ||
| Service: "cloudwatch", | ||
| ShortCode: "require-org-changes-alarm", | ||
| Summary: "Ensure a log metric filter and alarm exist for organisation changes", | ||
| Impact: "Lack of observability into critical organisation changes", | ||
| Resolution: "Create an alarm to alert on organisation changes", | ||
| Frameworks: map[framework.Framework][]string{ | ||
| framework.CIS_AWS_1_4: { | ||
| "4.15", | ||
| }, | ||
| }, | ||
| Explanation: ` | ||
| Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or | ||
| intentional modifications that may lead to unauthorized access or other security breaches. | ||
| This monitoring technique helps you to ensure that any unexpected changes performed | ||
| within your AWS Organizations can be investigated and any unwanted changes can be | ||
| rolled back. | ||
| `, | ||
| Links: []string{ | ||
| "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_security_incident-response.html", | ||
| }, | ||
| Severity: severity.Low, | ||
| }, | ||
| func(s *state.State) (results scan.Results) { | ||
| if metricAlarm := s.AWS.CloudWatch.GetAlarmByMetricName("OrganizationEvents"); metricAlarm == nil { | ||
| results.Add("CloudWatch has no alarm associated with organisation events", types.NewUnmanagedMetadata()) | ||
| } else { | ||
| results.AddPassed(metricAlarm) | ||
| } | ||
| return | ||
| }, | ||
| ) |
56 changes: 56 additions & 0 deletions
56
internal/rules/aws/cloudwatch/require_org_changes_alarm_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| package cloudwatch | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| defsecTypes "github.com/aquasecurity/defsec/pkg/types" | ||
|
|
||
| "github.com/aquasecurity/defsec/pkg/providers/aws/cloudwatch" | ||
| "github.com/aquasecurity/defsec/pkg/scan" | ||
| "github.com/aquasecurity/defsec/pkg/state" | ||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestCheckRequireOrgChangesAlarm(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| cloudwatch cloudwatch.CloudWatch | ||
| expected bool | ||
| }{ | ||
| { | ||
| name: "alarm exists", | ||
| cloudwatch: cloudwatch.CloudWatch{ | ||
| Alarms: []cloudwatch.Alarm{ | ||
| { | ||
| Metadata: defsecTypes.NewTestMetadata(), | ||
| MetricName: defsecTypes.String("OrganizationEvents", defsecTypes.NewTestMetadata()), | ||
| }, | ||
| }, | ||
| }, | ||
| expected: false, | ||
| }, | ||
| { | ||
| name: "alarm does not exist", | ||
| cloudwatch: cloudwatch.CloudWatch{}, | ||
| expected: true, | ||
| }, | ||
| } | ||
| for _, test := range tests { | ||
| t.Run(test.name, func(t *testing.T) { | ||
| var testState state.State | ||
| testState.AWS.CloudWatch = test.cloudwatch | ||
| results := CheckRequireOrgChangesAlarm.Evaluate(&testState) | ||
| var found bool | ||
| for _, result := range results { | ||
| if result.Status() == scan.StatusFailed && result.Rule().LongID() == CheckRequireOrgChangesAlarm.Rule().LongID() { | ||
| found = true | ||
| } | ||
| } | ||
| if test.expected { | ||
| assert.True(t, found, "Rule should have been found") | ||
| } else { | ||
| assert.False(t, found, "Rule should not have been found") | ||
| } | ||
| }) | ||
| } | ||
| } |
Oops, something went wrong.