Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update to exclude an3 controls not supported #24

Merged
merged 2 commits into from
Jul 16, 2021
Merged

update to exclude an3 controls not supported #24

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2944a43
update to exclude an3 controls not supported
mcalhoun Jul 16, 2021
215dc4e
fix typo
mcalhoun Jul 16, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions modules/control-disablements/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,18 @@ locals {
is_central_cloudtrail_account = data.aws_caller_identity.this.account_id == var.central_logging_account && local.is_global_resource_region
control_prefix = "arn:${data.aws_partition.this.id}:securityhub:${data.aws_region.this.name}:${data.aws_caller_identity.this.account_id}:control"

# These controls are not supported in ap-northeast-3 (AN3), so we have to do some trickery to exclude them.
an3_excluded_controls = [
"${local.control_prefix}/aws-foundational-security-best-practices/v/1.0.0/IAM.4",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.12",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.20"
]

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mcalhoun
maybe we can create a map of regions to lists of not supported controls?

not_supported_region_controls = {
   "ap-northeast-3" = [
     "${local.control_prefix}/aws-foundational-security-best-practices/v/1.0.0/IAM.4",
      "${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.12",
      "${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.20"
   ]
}

otherwise LGTM

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Honestly, it's just a broken region...everything else is supported everywhere.

all_global_region_controls = [
"${local.control_prefix}/aws-foundational-security-best-practices/v/1.0.0/Config.1",
"${local.control_prefix}/aws-foundational-security-best-practices/v/1.0.0/IAM.1",
"${local.control_prefix}/aws-foundational-security-best-practices/v/1.0.0/IAM.2",
"${local.control_prefix}/aws-foundational-security-best-practices/v/1.0.0/IAM.3",
"${local.control_prefix}/aws-foundational-security-best-practices/v/1.0.0/IAM.4",
"${local.control_prefix}/aws-foundational-security-best-practices/v/1.0.0/IAM.5",
"${local.control_prefix}/aws-foundational-security-best-practices/v/1.0.0/IAM.6",
"${local.control_prefix}/aws-foundational-security-best-practices/v/1.0.0/IAM.7",
Expand All @@ -29,15 +35,13 @@ locals {
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.9",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.10",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.11",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.12",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.13",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.14",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.16",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.20",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.22",
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/2.5",
]
included_global_region_controls = local.is_global_resource_region ? [] : local.all_global_region_controls
included_global_region_controls = local.is_global_resource_region ? [] : (data.aws_region.this.name == "ap-northeast-3" ? local.all_global_region_controls : concat(local.an3_excluded_controls, local.all_global_region_controls))

all_cloudtrail_controls = [
"${local.control_prefix}/cis-aws-foundations-benchmark/v/1.2.0/1.1",
Expand Down