Skip to content

Commit 051761d

Browse files
igirardiigirardi
committed
Initial public release
0 parents  commit 051761d

27 files changed

+975
-0
lines changed

‎.flake8

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[flake8]
2+
max-line-length = 88
3+
select = C,E,F,W,B,B950
4+
extend-ignore = E203, E501

‎.gitignore

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
*.swp
2+
package-lock.json
3+
.pytest_cache
4+
*.egg-info
5+
6+
# Byte-compiled / optimized / DLL files
7+
__pycache__/
8+
*.py[cod]
9+
*$py.class
10+
11+
# Environments
12+
.env
13+
.venv
14+
env/
15+
venv/
16+
ENV/
17+
env.bak/
18+
venv.bak/
19+
20+
# CDK Context & Staging files
21+
.cdk.staging/
22+
cdk.out/
23+
24+
# Byte-compiled / optimized / DLL
25+
__pycache__/
26+
*.py[cod]
27+
*$py.class
28+
29+
# C extensions
30+
*.so
31+
32+
# Coverage.py
33+
.coverage
34+
coverage.xml
35+
htmlcov/
36+
37+
# Environment
38+
.venv/
39+
node_modules/
40+
41+
# macOS
42+
.DS_Store
43+
44+
# mypy
45+
.mypy_cache/
46+
47+
# PyCharm
48+
.idea/
49+
50+
# pyenv
51+
.python-version

‎.isort.cfg

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[settings]
2+
profile = black
3+
force_single_line = True
4+
single_line_exclusions = typing

‎.mypy.ini

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
[mypy]
2+
strict = True
3+
4+
[mypy-aws_cdk.*]
5+
ignore_missing_imports = True
6+
7+
[mypy-boto3.*]
8+
ignore_missing_imports = True

‎.pylintrc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
[MESSAGES CONTROL]
2+
disable = C0111

‎CHANGELOG.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Changelog
2+
All notable changes to this project will be documented in this file.
3+
4+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
5+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
6+
7+
## [1.0.0] - 2023-06-22
8+
### Added
9+
- Initial public release

‎CODE_OF_CONDUCT.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
## Code of Conduct
2+
This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).
3+
For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
4+
opensource-codeofconduct@amazon.com with any additional questions or comments.

‎CONTRIBUTING.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Contributing Guidelines
2+
3+
Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional
4+
documentation, we greatly value feedback and contributions from our community.
5+
6+
Please read through this document before submitting any issues or pull requests to ensure we have all the necessary
7+
information to effectively respond to your bug report or contribution.
8+
9+
10+
## Reporting Bugs/Feature Requests
11+
12+
We welcome you to use the GitHub issue tracker to report bugs or suggest features.
13+
14+
When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already
15+
reported the issue. Please try to include as much information as you can. Details like these are incredibly useful:
16+
17+
* A reproducible test case or series of steps
18+
* The version of our code being used
19+
* Any modifications you've made relevant to the bug
20+
* Anything unusual about your environment or deployment
21+
22+
23+
## Contributing via Pull Requests
24+
Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that:
25+
26+
1. You are working against the latest source on the *main* branch.
27+
2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already.
28+
3. You open an issue to discuss any significant work - we would hate for your time to be wasted.
29+
30+
To send us a pull request, please:
31+
32+
1. Fork the repository.
33+
2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change.
34+
3. Ensure local tests pass.
35+
4. Commit to your fork using clear commit messages.
36+
5. Send us a pull request, answering any default questions in the pull request interface.
37+
6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation.
38+
39+
GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and
40+
[creating a pull request](https://help.github.com/articles/creating-a-pull-request/).
41+
42+
43+
## Finding contributions to work on
44+
Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start.
45+
46+
47+
## Code of Conduct
48+
This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct).
49+
For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact
50+
opensource-codeofconduct@amazon.com with any additional questions or comments.
51+
52+
53+
## Security issue notifications
54+
If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue.
55+
56+
57+
## Licensing
58+
59+
See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution.

‎LICENSE

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
MIT No Attribution
2+
3+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy of
6+
this software and associated documentation files (the "Software"), to deal in
7+
the Software without restriction, including without limitation the rights to
8+
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
9+
the Software, and to permit persons to whom the Software is furnished to do so.
10+
11+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
12+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
13+
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
14+
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
15+
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
16+
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎NOTICE

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.

‎README.md

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
# CTC - Deploy and manage AWS Control Tower Controls (sometimes called guardrails) using CDK and infrastructure as code
2+
3+
4+
5+
- [Goal](#goal)
6+
- [Overview](#overview)
7+
- [Setup](#setup)
8+
- [Requirements](#requirements)
9+
- [Controls Configuration File](#controls-configuration-file)
10+
- [Control Behavior And Guidance](#control-behavior-and-guidance)
11+
- [Deployment](#deployment)
12+
- [Useful Commands](#useful-commands)
13+
14+
15+
16+
## Goal
17+
18+
This pattern describes how to use AWS Control Tower Controls, AWS Cloud Development Kit (CDK) and infrastructure as code (IaC) to implement and administer preventive, detective and proactive security on the Amazon Web Services (AWS) Cloud, for example, you can use controls to help ensure that security logs and necessary cross-account access permissions are created, and not altered.
19+
20+
This IaC artifact (CTC or ControlTowerControls) is a collection of reusable resources that accelerate the delivery of preventive, detective and proactive security controls (sometimes called guardrails) on the AWS Cloud and helps with faster deployment to production. It is used to implement the foundational structure of an organization by following AWS Control Tower best practices.
21+
22+
CTC implements a deployment process throughout IaC deployment by using AWS services such AWS Cloud Development Kit and Cloudformation.
23+
24+
AWS CDK and CloudFormation services act as the IaC layer to provide reproducible and fast deployments with easy operations and administration.
25+
26+
A control is a high-level rule that provides ongoing governance for your overall AWS environment. It's expressed in plain language. AWS Control Tower implements preventive, detective, and proactive controls that help you govern your resources and monitor compliance across groups of AWS accounts.
27+
28+
A control applies to an entire organizational unit (OU), and every AWS account within the OU is affected by the control. Therefore, when users perform work in any AWS account in your landing zone, they're always subject to the controls that are governing their account's OU.
29+
30+
## Overview
31+
32+
The solution consists of the following:
33+
- A **set of Control Tower controls** to be deployed in the Control Tower master account with the desired controls to be deploy in the Lanzing Zone.
34+
35+
![Architecture](img/ctc-architecture.png)
36+
37+
38+
## Setup
39+
40+
### Requirements
41+
To deploy this solution, you need
42+
43+
44+
| Name | Version |
45+
|------|---------|
46+
| <a name="requirement_ct"></a> [AWS Control Tower](https://aws.amazon.com/controltower/) | >= 3.0 |
47+
| <a name="requirement_python"></a> [Python](https://www.python.org/) | >= 3.9 |
48+
| <a name="requirement_npm"></a> [npm](https://www.npmjs.com/) | >= 8.9.0 |
49+
| <a name="requirement_gem"></a> [gem](https://rubygems.org/) | >= 3.3.11 |
50+
51+
The `cdk.json` file tells the CDK Toolkit how to execute the code.
52+
The `package.json` file installs `cfn_nag` and requires `npm` and `gem` to be already installed.
53+
54+
Also, make sure that for deploying [proactive](https://docs.aws.amazon.com/controltower/latest/userguide/proactive-controls.html) controls you must previously apply an elective, SCP-based control with the identifier **CT.CLOUDFORMATION.PR.1** before you can activate proactive controls on an OU. See Disallow management of resource types, modules, and hooks within the AWS CloudFormation registry. If this SCP is not activated, you'll see an error message directing you to enable this control as a prerequisite, or showing it as a dependency for other proactive controls.
55+
56+
## Controls Configuration File
57+
Update the configuration file `constants.py` like the following example:
58+
```
59+
ACCOUNT_ID = <AWS Account Identifier>
60+
AWS_CONTROL_TOWER_REGION = <AWS Control Tower Region>
61+
GUARDRAILS_CONFIGURATION = [
62+
{
63+
"Enable-Control": {
64+
"AWS-GR_ENCRYPTED_VOLUMES",
65+
...
66+
},
67+
"OrganizationalUnitIds": ["<Organizational Unit Id>", "<Organizational Unit Id>"...],
68+
},
69+
{
70+
"Enable-Control": {
71+
"AWS-GR_SUBNET_AUTO_ASSIGN_PUBLIC_IP_DISABLED",
72+
...
73+
},
74+
"OrganizationalUnitIds": ["<Organizational Unit Id>"...],
75+
},
76+
]
77+
```
78+
79+
The organizational unit ids should follow the pattern `^ou-[0-9a-z]{4,32}-[a-z0-9]{8,32}$`, for example, `ou-1111-11111111`.
80+
81+
The `control_names` are found after the `“/”` of the `API controlIdentifier` see the next example of an `API controlIdentifier`: `arn:aws:controltower:REGION::control/CONTROL_NAME`.
82+
83+
84+
## Control Behavior And Guidance
85+
86+
[Controls are categorized according to their behavior and their guidance.](https://docs.aws.amazon.com/controltower/latest/userguide/controls.html)
87+
88+
[For a full list of preventive, detective and proactive available controls, see the The AWS Control Tower controls library.](https://docs.aws.amazon.com/controltower/latest/userguide/controls-reference.html)
89+
90+
91+
## Deployment
92+
93+
To manually create a virtualenv on MacOS and Linux:
94+
95+
```
96+
$ python3 -m venv .venv
97+
```
98+
99+
After the init process completes and the virtualenv is created, activate the virtualenv.
100+
101+
```
102+
$ source .venv/bin/activate
103+
```
104+
105+
For Windows platform, activate the virtualenv like this:
106+
107+
```
108+
% .venv\Scripts\activate.bat
109+
```
110+
111+
Once the virtualenv is activated, install the required dependencies.
112+
113+
```
114+
$ ./scripts/install_deps.sh
115+
```
116+
117+
Setup AWS CDK
118+
```
119+
$ npx cdk bootstrap
120+
```
121+
Synthesize and deploy the CloudFormation template.
122+
123+
```
124+
$ npx cdk synth
125+
$ npx cdk deploy
126+
```
127+
128+
## Useful Commands
129+
130+
* `npx cdk ls` list all stacks in the app
131+
* `npx cdk synth` emits the synthesized CloudFormation template
132+
* `npx cdk deploy` deploy this stack
133+
* `npx cdk destroy` destroy this stack
134+
* `npx cdk diff` compare deployed stack with current state
135+
* `npx cdk docs` open CDK documentation
136+
137+
## Authors
138+
139+
Pattern created by Ivan Girardi (AWS) and Iker Reina Fuente (AWS).
140+
141+
## Security
142+
143+
See [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information.
144+
145+
## License
146+
147+
This library is licensed under the MIT-0 License. See the [LICENSE](LICENSE) file.
148+
149+

‎app.py

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: MIT-0
3+
4+
# Permission is hereby granted, free of charge, to any person obtaining a copy of
5+
# this software and associated documentation files (the "Software"), to deal in
6+
# the Software without restriction, including without limitation the rights to
7+
# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
8+
# the Software, and to permit persons to whom the Software is furnished to do so.
9+
10+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
11+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
12+
# FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
13+
# COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
14+
# IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
15+
# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
16+
17+
import aws_cdk
18+
import cdk_nag
19+
20+
from constants import ACCOUNT_ID
21+
from constants import AWS_CONTROL_TOWER_REGION
22+
from stacks.aws_control_tower_guardrails_stack import AwsControlTowerGuardrailsStack
23+
24+
env = aws_cdk.Environment(region=AWS_CONTROL_TOWER_REGION, account=ACCOUNT_ID)
25+
26+
app = aws_cdk.App()
27+
AwsControlTowerGuardrailsStack(app, "aws-control-tower-guardrails", env=env)
28+
aws_cdk.Aspects.of(app).add(cdk_nag.AwsSolutionsChecks())
29+
30+
app.synth()

‎cdk.json

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{
2+
"app": "python3 app.py",
3+
"watch": {
4+
"include": [
5+
"**"
6+
],
7+
"exclude": [
8+
"README.md",
9+
"cdk*.json",
10+
"requirements*.txt",
11+
"source.bat",
12+
"**/__init__.py",
13+
"python/__pycache__",
14+
"tests"
15+
]
16+
},
17+
"context": {
18+
"@aws-cdk/aws-apigateway:usagePlanKeyOrderInsensitiveId": true,
19+
"@aws-cdk/core:stackRelativeExports": true,
20+
"@aws-cdk/aws-rds:lowercaseDbIdentifier": true,
21+
"@aws-cdk/aws-lambda:recognizeVersionProps": true,
22+
"@aws-cdk/aws-lambda:recognizeLayerVersion": true,
23+
"@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021": true,
24+
"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
25+
"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
26+
"@aws-cdk/core:checkSecretUsage": true,
27+
"@aws-cdk/aws-iam:minimizePolicies": true,
28+
"@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
29+
"@aws-cdk/core:validateSnapshotRemovalPolicy": true,
30+
"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
31+
"@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
32+
"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
33+
"@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
34+
"@aws-cdk/core:enablePartitionLiterals": true,
35+
"@aws-cdk/core:target-partitions": [
36+
"aws",
37+
"aws-cn"
38+
]
39+
}
40+
}

0 commit comments

Comments
 (0)