Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature/sqsunencryption #32

Open
wants to merge 8 commits into
base: dev
Choose a base branch
from
Open

Feature/sqsunencryption #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
3272e1c
Added SQS encrytion changes.
Dec 21, 2018
6f8f0d6
Updated with deployment issue fixes.
Dec 21, 2018
28a32c8
Updated with SQS encryption db changes
Dec 21, 2018
43abff5
Updated db changes.
Dec 21, 2018
162d4d3
Updated with deployment changes.
Dec 24, 2018
6638de5
Updated with SQS encryption changes.
Dec 26, 2018
21bbb65
Updated with documentation.
Dec 27, 2018
6738e5e
Updated with SQS unencryption documentation
Dec 27, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion deployment/build_packages.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ SCRIPT_PATH="$( cd "$(dirname "$0")" ; pwd -P )"
PACKAGES_DIR="${SCRIPT_PATH}/packages/"
LIBRARY="${SCRIPT_PATH}/../hammer/library"

LAMBDAS="ami-info logs-forwarder ddb-tables-backup sg-issues-identification s3-acl-issues-identification s3-policy-issues-identification iam-keyrotation-issues-identification iam-user-inactive-keys-identification cloudtrails-issues-identification ebs-unencrypted-volume-identification ebs-public-snapshots-identification rds-public-snapshots-identification sqs-public-policy-identification s3-unencrypted-bucket-issues-identification rds-unencrypted-instance-identification"
LAMBDAS="ami-info logs-forwarder ddb-tables-backup sg-issues-identification s3-acl-issues-identification s3-policy-issues-identification iam-keyrotation-issues-identification iam-user-inactive-keys-identification cloudtrails-issues-identification ebs-unencrypted-volume-identification ebs-public-snapshots-identification rds-public-snapshots-identification sqs-public-policy-identification s3-unencrypted-bucket-issues-identification rds-unencrypted-instance-identification sqs-unencrypted-queues-identification"

pushd "${SCRIPT_PATH}" > /dev/null
pushd ../hammer/identification/lambdas > /dev/null
Expand Down
33 changes: 33 additions & 0 deletions deployment/cf-templates/ddb.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -428,6 +428,39 @@
},
"TableName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" }, "rds-unencrypted" ] ]}
}
},

"DynamoDBSQSQueueUnencrypted": {
"Type": "AWS::DynamoDB::Table",
"DeletionPolicy": "Retain",
"DependsOn": ["DynamoDBCredentials"],
"Properties": {
"AttributeDefinitions": [
{
"AttributeName": "account_id",
"AttributeType": "S"
},
{
"AttributeName": "issue_id",
"AttributeType": "S"
}
],
"KeySchema": [
{
"AttributeName": "account_id",
"KeyType": "HASH"
},
{
"AttributeName": "issue_id",
"KeyType": "RANGE"
}
],
"ProvisionedThroughput": {
"ReadCapacityUnits": "10",
"WriteCapacityUnits": "2"
},
"TableName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" }, "sqs-unencrypted" ] ]}
}
}
}
}
226 changes: 225 additions & 1 deletion deployment/cf-templates/identification.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,8 @@
"SourceIdentificationIAMUserInactiveKeys",
"SourceIdentificationEBSVolumes",
"SourceIdentificationEBSSnapshots",
"SourceIdentificationRDSSnapshots"
"SourceIdentificationRDSSnapshots",
"SourceIdentificationSQSEncryption"
]
},
{
Expand Down Expand Up @@ -88,6 +89,9 @@
},
"SourceIdentificationRDSSnapshots": {
"default": "Relative path to public RDS snapshots lambda sources"
},
"SourceIdentificationSQSEncryption":{
"default": "Relative path to Unencrypted SQS queues lambda sources"
}
}
}
Expand Down Expand Up @@ -176,6 +180,10 @@
"SourceIdentificationRDSEncryption": {
"Type": "String",
"Default": "rds-unencrypted-instance-identification.zip"
},
"SourceIdentificationSQSEncryption": {
"Type": "String",
"Default": "sqs-unencrypted-queues-identification.zip"
}
},
"Conditions": {
Expand Down Expand Up @@ -230,6 +238,9 @@
"IdentificationMetricRDSEncryptionError": {
"value": "RDSEncryptionError"
},
"IdentificationMetricSQSEncryptionError": {
"value": "SQSEncryptionError"
},
"SNSDisplayNameSecurityGroups": {
"value": "describe-security-groups-sns"
},
Expand Down Expand Up @@ -302,6 +313,12 @@
"SNSTopicNameRDSEncryption": {
"value": "describe-rds-encryption-lambda"
},
"SNSDisplayNameSQSEncryption": {
"value": "describe-sqs-encryption-sns"
},
"SNSTopicNameSQSEncryption": {
"value": "describe-sqs-encryption-lambda"
},
"LogsForwarderLambdaFunctionName": {
"value": "logs-forwarder"
},
Expand Down Expand Up @@ -379,6 +396,12 @@
},
"IdentifyRDSEncryptionLambdaFunctionName": {
"value": "describe-rds-encryption"
},
"InitiateSQSEncryptionLambdaFunctionName": {
"value": "initiate-sqs-encryption"
},
"IdentifySQSEncryptionLambdaFunctionName": {
"value": "describe-sqs-encryption"
}
}
},
Expand Down Expand Up @@ -1840,6 +1863,107 @@
}
},

"LambdaInitiateSQSEncryptionEvaluation": {
"Type": "AWS::Lambda::Function",
"DependsOn": ["SNSNotifyLambdaEvaluateSQSEncryption", "LogGroupLambdaInitiateSQSEncryptionEvaluation"],
"Properties": {
"Code": {
"S3Bucket": { "Ref": "SourceS3Bucket" },
"S3Key": { "Ref": "SourceIdentificationSQSEncryption" }
},
"Environment": {
"Variables": {
"SNS_SQS_ENCRYPT_ARN": { "Ref": "SNSNotifyLambdaEvaluateSQSEncryption" }
}
},
"Description": "Lambda function for initiate to identify unencrypted SQS queues.",
"FunctionName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" },
{ "Fn::FindInMap": ["NamingStandards", "InitiateSQSEncryptionLambdaFunctionName", "value"] } ]
]},
"Handler": "initiate_to_desc_sqs_unencrypted_queues.lambda_handler",
"MemorySize": 128,
"Timeout": "300",
"Role": {"Fn::Join" : ["", [ "arn:aws:iam::",
{ "Ref": "AWS::AccountId" },
":role/",
{ "Ref": "ResourcesPrefix" },
{ "Ref": "IdentificationIAMRole" }
] ]},
"Runtime": "python3.6"
}
},
"LogGroupLambdaInitiateSQSEncryptionEvaluation": {
"Type" : "AWS::Logs::LogGroup",
"Properties" : {
"LogGroupName": {"Fn::Join": ["", [ "/aws/lambda/",
{ "Ref": "ResourcesPrefix" },
{ "Fn::FindInMap": ["NamingStandards",
"InitiateSQSEncryptionLambdaFunctionName",
"value"]
} ] ] },
"RetentionInDays": "7"
}
},
"SubscriptionFilterLambdaInitiateSQSEncryptionEvaluation": {
"Type" : "AWS::Logs::SubscriptionFilter",
"DependsOn": ["LambdaLogsForwarder",
"PermissionToInvokeLambdaLogsForwarderCloudWatchLogs",
"LogGroupLambdaInitiateSQSEncryptionEvaluation"],
"Properties" : {
"DestinationArn" : { "Fn::GetAtt" : [ "LambdaLogsForwarder", "Arn" ] },
"FilterPattern" : "[level != START && level != END && level != DEBUG, ...]",
"LogGroupName" : { "Ref": "LogGroupLambdaInitiateSQSEncryptionEvaluation" }
}
},

"LambdaEvaluateSQSEncryption": {
"Type": "AWS::Lambda::Function",
"DependsOn": ["LogGroupLambdaEvaluateSQSEncryption"],
"Properties": {
"Code": {
"S3Bucket": { "Ref": "SourceS3Bucket" },
"S3Key": { "Ref": "SourceIdentificationSQSEncryption" }
},
"Description": "Lambda function to describe un-encrypted SQS queues.",
"FunctionName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" },
{ "Fn::FindInMap": ["NamingStandards", "IdentifySQSEncryptionLambdaFunctionName", "value"] } ]
]},
"Handler": "describe_sqs_unencrypted_queues.lambda_handler",
"MemorySize": 256,
"Timeout": "300",
"Role": {"Fn::Join" : ["", [ "arn:aws:iam::",
{ "Ref": "AWS::AccountId" },
":role/",
{ "Ref": "ResourcesPrefix" },
{ "Ref": "IdentificationIAMRole" }
] ]},
"Runtime": "python3.6"
}
},
"LogGroupLambdaEvaluateSQSEncryption": {
"Type" : "AWS::Logs::LogGroup",
"Properties" : {
"LogGroupName": {"Fn::Join": ["", [ "/aws/lambda/",
{ "Ref": "ResourcesPrefix" },
{ "Fn::FindInMap": ["NamingStandards",
"IdentifySQSEncryptionLambdaFunctionName",
"value"]
} ] ] },
"RetentionInDays": "7"
}
},
"SubscriptionFilterLambdaEvaluateSQSEncryption": {
"Type" : "AWS::Logs::SubscriptionFilter",
"DependsOn": ["LambdaLogsForwarder",
"PermissionToInvokeLambdaLogsForwarderCloudWatchLogs",
"LogGroupLambdaEvaluateSQSEncryption"],
"Properties" : {
"DestinationArn" : { "Fn::GetAtt" : [ "LambdaLogsForwarder", "Arn" ] },
"FilterPattern" : "[level != START && level != END && level != DEBUG, ...]",
"LogGroupName" : { "Ref": "LogGroupLambdaEvaluateSQSEncryption" }
}
},

"EventBackupDDB": {
"Type": "AWS::Events::Rule",
"DependsOn": ["LambdaBackupDDB"],
Expand Down Expand Up @@ -2004,6 +2128,22 @@
]
}
},
"EventInitiateEvaluationSQSEncryption": {
"Type": "AWS::Events::Rule",
"DependsOn": ["LambdaInitiateSQSEncryptionEvaluation"],
"Properties": {
"Description": "Hammer ScheduledRule to initiate sqs queue encryption evaluations",
"Name": {"Fn::Join" : ["", [{ "Ref": "ResourcesPrefix" }, "InitiateEvaluationSQSEncryption"] ] },
"ScheduleExpression": {"Fn::Join": ["", [ "cron(", "40 ", { "Ref": "IdentificationCheckRateExpression" }, ")" ] ]},
"State": "ENABLED",
"Targets": [
{
"Arn": { "Fn::GetAtt": ["LambdaInitiateSQSEncryptionEvaluation", "Arn"] },
"Id": "LambdaInitiateSQSEncryptionEvaluation"
}
]
}
},

"PermissionToInvokeLambdaLogsForwarderCloudWatchLogs": {
"Type": "AWS::Lambda::Permission",
Expand Down Expand Up @@ -2147,6 +2287,16 @@
"SourceArn": { "Fn::GetAtt": ["EventInitiateEvaluationRDSEncryption", "Arn"] }
}
},
"PermissionToInvokeLambdaInitiateSQSEncryptionEvaluationCloudWatchEvents": {
"Type": "AWS::Lambda::Permission",
"DependsOn": ["LambdaInitiateSQSEncryptionEvaluation", "EventInitiateEvaluationSQSEncryption"],
"Properties": {
"FunctionName": { "Ref": "LambdaInitiateSQSEncryptionEvaluation" },
"Action": "lambda:InvokeFunction",
"Principal": "events.amazonaws.com",
"SourceArn": { "Fn::GetAtt": ["EventInitiateEvaluationSQSEncryption", "Arn"] }
}
},

"SNSNotifyLambdaEvaluateSG": {
"Type": "AWS::SNS::Topic",
Expand Down Expand Up @@ -2364,6 +2514,24 @@
}]
}
},
"SNSNotifyLambdaEvaluateSQSEncryption": {
"Type": "AWS::SNS::Topic",
"DependsOn": "LambdaEvaluateSQSEncryption",
"Properties": {
"DisplayName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" },
{ "Fn::FindInMap": ["NamingStandards", "SNSDisplayNameSQSEncryption", "value"] } ]
]},
"TopicName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" },
{ "Fn::FindInMap": ["NamingStandards", "SNSTopicNameSQSEncryption", "value"] } ]
]},
"Subscription": [{
"Endpoint": {
"Fn::GetAtt": ["LambdaEvaluateSQSEncryption", "Arn"]
},
"Protocol": "lambda"
}]
}
},

"PermissionToInvokeLambdaEvaluateSgSNS": {
"Type": "AWS::Lambda::Permission",
Expand Down Expand Up @@ -2485,6 +2653,16 @@
"FunctionName": { "Fn::GetAtt": ["LambdaEvaluateRDSEncryption", "Arn"] }
}
},
"PermissionToInvokeLambdaEvaluateSQSEncryptionSNS": {
"Type": "AWS::Lambda::Permission",
"DependsOn": ["SNSNotifyLambdaEvaluateSQSEncryption", "LambdaEvaluateSQSEncryption"],
"Properties": {
"Action": "lambda:InvokeFunction",
"Principal": "sns.amazonaws.com",
"SourceArn": { "Ref": "SNSNotifyLambdaEvaluateSQSEncryption" },
"FunctionName": { "Fn::GetAtt": ["LambdaEvaluateSQSEncryption", "Arn"] }
}
},

"SNSIdentificationErrors": {
"Type": "AWS::SNS::Topic",
Expand Down Expand Up @@ -3088,6 +3266,52 @@
"Threshold": 0,
"TreatMissingData": "notBreaching"
}
},
"AlarmErrorsLambdaInitiateSQSEncryptionEvaluation": {
"Type": "AWS::CloudWatch::Alarm",
"DependsOn": ["SNSIdentificationErrors", "LambdaInitiateSQSEncryptionEvaluation"],
"Properties": {
"AlarmActions": [ { "Ref": "SNSIdentificationErrors" } ],
"OKActions": [ { "Ref": "SNSIdentificationErrors" } ],
"AlarmName": {"Fn::Join": ["/", [ { "Ref": "LambdaInitiateSQSEncryptionEvaluation" }, "LambdaError" ] ]},
"EvaluationPeriods": 1,
"Namespace": "AWS/Lambda",
"MetricName": "Errors",
"Dimensions": [
{
"Name": "FunctionName",
"Value": { "Ref": "LambdaInitiateSQSEncryptionEvaluation" }
}
],
"Period": 3600,
"Statistic": "Maximum",
"ComparisonOperator" : "GreaterThanThreshold",
"Threshold": 0,
"TreatMissingData": "notBreaching"
}
},
"AlarmErrorsLambdaSQSEncryptionEvaluation": {
"Type": "AWS::CloudWatch::Alarm",
"DependsOn": ["SNSIdentificationErrors", "LambdaEvaluateSQSEncryption"],
"Properties": {
"AlarmActions": [ { "Ref": "SNSIdentificationErrors" } ],
"OKActions": [ { "Ref": "SNSIdentificationErrors" } ],
"AlarmName": {"Fn::Join": ["/", [ { "Ref": "LambdaEvaluateSQSEncryption" }, "LambdaError" ] ]},
"EvaluationPeriods": 1,
"Namespace": "AWS/Lambda",
"MetricName": "Errors",
"Dimensions": [
{
"Name": "FunctionName",
"Value": { "Ref": "LambdaEvaluateSQSEncryption" }
}
],
"Period": 3600,
"Statistic": "Maximum",
"ComparisonOperator" : "GreaterThanThreshold",
"Threshold": 0,
"TreatMissingData": "notBreaching"
}
}
},
"Outputs": {
Expand Down
7 changes: 7 additions & 0 deletions deployment/configs/config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,13 @@
"remediation": false,
"remediation_retention_period": 0
},
"sqs_encryption": {
"enabled": true,
"ddb.table_name": "hammer-sqs-unencrypted",
"reporting": true,
"remediation": false,
"remediation_retention_period": 21
},
"rds_encryption": {
"enabled": true,
"ddb.table_name": "hammer-rds-unencrypted",
Expand Down
3 changes: 3 additions & 0 deletions deployment/configs/whitelist.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,5 +43,8 @@
"s3_encryption": {
},
"rds_encryption": {
},
"sqs_encryption":{

}
}
Loading