Skip to content

Commit 177df8f

Browse files
mk-amzmk-amz
committed
Merge branch 'main' of https://github.com/mk-amz/aws-security-reference-architecture-examples into feature/patch-mgmt
2 parents 49e081e + aa58485 commit 177df8f

File tree

16 files changed

+751
-3391
lines changed

16 files changed

+751
-3391
lines changed

‎CHANGELOG.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2024-05-03](#2024-05-03)
7+
- [2024-04-15](#2024-04-15)
68
- [2024-02-12](#2024-02-12)
79
- [2024-02-09](#2024-02-09)
810
- [2024-01-29](#2024-01-29)
@@ -51,6 +53,15 @@
5153
All notable changes to this project will be documented in this file.
5254

5355
---
56+
## 2024-05-03
57+
58+
- Updated [GuardDuty Organization](aws_sra_examples/solutions/guardduty/guardduty_org) solution to add Runtime Monitoring protection.
59+
- Updated [GuardDuty Organization](aws_sra_examples/solutions/guardduty/guardduty_org) solution default setting to deploy in all enabled regions.
60+
61+
## 2024-04-15
62+
63+
- Updated [Common CFCT Setup](aws_sra_examples/solutions/common/common_cfct_setup) solution to download the latest CfCT template.
64+
5465
## 2024-02-12
5566

5667
- Added [AMI Bakery](aws_sra_examples/solutions/ami_bakery/ami_bakery_org) solution for AMI image management.

‎aws_sra_examples/easy_setup/templates/sra-easy-setup.yaml

Lines changed: 46 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -147,16 +147,21 @@ Metadata:
147147
default: GuardDuty Solution
148148
Parameters:
149149
- pDisableGuardDuty
150+
- pGuardDutyCustomerGovernedRegionsOnly
151+
- pGuardDutyEnabledRegions
150152
- pAutoEnableS3Logs
151153
- pAutoEnableKubernetesAuditLogs
152154
- pAutoEnableMalwareProtection
153155
- pEnableRdsLoginEvents
154-
- pEnableEksRuntimeMonitoring
156+
- pEnableRuntimeMonitoring
155157
- pEnableEksAddonManagement
158+
- pEnableEcsFargateAgentManagement
159+
- pEnableEc2AgentManagement
156160
- pEnableLambdaNetworkLogs
157161
- pGuardDutyFindingPublishingFrequency
158162
- pGuardDutyOrgDeliveryBucketPrefix
159163
- pGuardDutyOrgDeliveryKeyAlias
164+
160165
- Label:
161166
default: IAM Access Analyzer Solution
162167
Parameters:
@@ -337,10 +342,14 @@ Metadata:
337342
default: Auto Enable Malware Protection
338343
pEnableRdsLoginEvents:
339344
default: Auto enable RDS Login Events
340-
pEnableEksRuntimeMonitoring:
341-
default: Auto enable EKS Runtime Monitoring
345+
pEnableRuntimeMonitoring:
346+
default: Auto enable Runtime Monitoring
342347
pEnableEksAddonManagement:
343348
default: Auto enable EKS Add-on Management
349+
pEnableEcsFargateAgentManagement:
350+
default: Auto enable ECS Fargate Agent Management
351+
pEnableEc2AgentManagement:
352+
default: Auto enable EC2 Agent Management
344353
pEnableLambdaNetworkLogs:
345354
default: Auto enable Lambda Network Logs
346355
pBillingContactAction:
@@ -443,6 +452,10 @@ Metadata:
443452
default: (Optional) Exclude EC2 Default EBS Encryption Tags
444453
pExcludeS3BlockAccountPublicAccessTags:
445454
default: (Optional) Exclude S3 Block Account Public Access Tags
455+
pGuardDutyCustomerGovernedRegionsOnly:
456+
default: Enable GuardDuty in Customer Governed Regions Only
457+
pGuardDutyEnabledRegions:
458+
default: (Optional) Enabled Regions
446459
pFrequency:
447460
default: Frequency
448461
pGuarddutyEnabledForMoreThan48Hours:
@@ -817,6 +830,16 @@ Parameters:
817830
Default: "true"
818831
Description: Auto enable EKS Add-on Management
819832
Type: String
833+
pEnableEcsFargateAgentManagement:
834+
AllowedValues: ['true', 'false']
835+
Default: 'true'
836+
Description: Auto enable ECS Fargate Agent Management
837+
Type: String
838+
pEnableEc2AgentManagement:
839+
AllowedValues: ['true', 'false']
840+
Default: 'true'
841+
Description: Auto enable EC2 Agent Management
842+
Type: String
820843
pEnableLambdaNetworkLogs:
821844
AllowedValues: ["true", "false"]
822845
Default: "true"
@@ -1129,6 +1152,21 @@ Parameters:
11291152
'(Optional) Resource Tags that denote an Account should be excluded from this solution in JSON format: [{"Key": "string", "Value": "string"},
11301153
... ]. For example, [{"Key": "exclude-s3-block-account-public-access", "Value": "true"}].'
11311154
Type: String
1155+
pGuardDutyCustomerGovernedRegionsOnly:
1156+
AllowedValues: ['true', 'false']
1157+
Default: 'false'
1158+
Description: Indicates whether to enable GuardDuty in the customer's Goverened Regions only. Example - Control Tower regions, or Common Prerequisites regions.
1159+
Type: String
1160+
pGuardDutyEnabledRegions:
1161+
AllowedPattern: '^$|^([a-z0-9-]{1,64})$|^(([a-z0-9-]{1,64},)*[a-z0-9-]{1,64})$'
1162+
ConstraintDescription:
1163+
Only lowercase letters, numbers, and hyphens ('-') allowed. (e.g. us-east-1) Additional AWS regions can be provided, separated by commas. (e.g.
1164+
us-east-1,ap-southeast-2)
1165+
Default: ''
1166+
Description:
1167+
(Optional) Enabled regions (AWS regions, separated by commas).
1168+
Type: String
1169+
11321170
pFrequency:
11331171
AllowedValues: [1hour, 3hours, 6hours, 12hours, 24hours]
11341172
Default: 1hour
@@ -2608,8 +2646,12 @@ Resources:
26082646
pAutoEnableKubernetesAuditLogs: !Ref pAutoEnableKubernetesAuditLogs
26092647
pAutoEnableMalwareProtection: !Ref pAutoEnableMalwareProtection
26102648
pEnableRdsLoginEvents: !Ref pEnableRdsLoginEvents
2611-
pEnableEksRuntimeMonitoring: !Ref pEnableEksRuntimeMonitoring
2649+
pControlTowerRegionsOnly: !Ref pGuardDutyCustomerGovernedRegionsOnly
2650+
pEnabledRegions: !Ref pGuardDutyEnabledRegions
2651+
pEnableRuntimeMonitoring: !Ref pEnableRuntimeMonitoring
26122652
pEnableEksAddonManagement: !Ref pEnableEksAddonManagement
2653+
pEnableEcsFargateAgentManagement: !Ref pEnableEcsFargateAgentManagement
2654+
pEnableEc2AgentManagement: !Ref pEnableEc2AgentManagement
26132655
pEnableLambdaNetworkLogs: !Ref pEnableLambdaNetworkLogs
26142656
pCreateLambdaLogGroup: !If [cCreateLambdaLogGroup, true, false]
26152657
pDisableGuardDuty: !If [cDisableGuardDuty, true, false]

‎aws_sra_examples/modules/guardduty-org-module/templates/sra-guardduty-org-module-main.yaml

Lines changed: 56 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,15 @@ Metadata:
5353
default: GuardDuty
5454
Parameters:
5555
- pDisableGuardDuty
56+
- pControlTowerRegionsOnly
57+
- pEnabledRegions
5658
- pAutoEnableS3Logs
5759
- pAutoEnableKubernetesAuditLogs
5860
- pAutoEnableMalwareProtection
5961
- pEnableRdsLoginEvents
60-
- pEnableEksRuntimeMonitoring
62+
- pEnableRuntimeMonitoring
63+
- pEnableEcsFargateAgentManagement
64+
- pEnableEc2AgentManagement
6165
- pEnableEksAddonManagement
6266
- pEnableLambdaNetworkLogs
6367
- pGuardDutyFindingPublishingFrequency
@@ -119,10 +123,14 @@ Metadata:
119123
default: pAutoEnableMalwareProtection
120124
pEnableRdsLoginEvents:
121125
default: pEnableRdsLoginEvents
122-
pEnableEksRuntimeMonitoring:
123-
default: pEnableEksRuntimeMonitoring
126+
pEnableRuntimeMonitoring:
127+
default: pEnableRuntimeMonitoring
124128
pEnableEksAddonManagement:
125129
default: pEnableEksAddonManagement
130+
pEnableEcsFargateAgentManagement:
131+
default: Auto enable ECS Fargate Agent Management
132+
pEnableEc2AgentManagement:
133+
default: Auto enable EC2 Agent Management
126134
pEnableLambdaNetworkLogs:
127135
default: pEnableLambdaNetworkLogs
128136
pGuardDutyFindingPublishingFrequency:
@@ -133,6 +141,10 @@ Metadata:
133141
default: pGuardDutyOrgDeliveryKeyAlias
134142
pCreateAWSControlTowerExecutionRole:
135143
default: Create AWS Control Tower Execution Role
144+
pControlTowerRegionsOnly:
145+
default: Control Tower Regions Only
146+
pEnabledRegions:
147+
default: (Optional) Enabled Regions
136148

137149
Parameters:
138150
pSRAHelperBucketNamePrefix:
@@ -257,6 +269,19 @@ Parameters:
257269
Default: "1"
258270
Description: Random parameter
259271
Type: String
272+
pControlTowerRegionsOnly:
273+
Type: String
274+
Description: Only enable in the Control Tower governed regions (set to true for environments without AWS Control Tower)
275+
Default: 'false'
276+
AllowedValues: ['true', 'false']
277+
pEnabledRegions:
278+
AllowedPattern: '^$|^([a-z0-9-]{1,64})$|^(([a-z0-9-]{1,64},)*[a-z0-9-]{1,64})$'
279+
ConstraintDescription:
280+
Only lowercase letters, numbers, and hyphens ('-') allowed. (e.g. us-east-1) Additional AWS regions can be provided, separated by commas. (e.g.
281+
us-east-1,ap-southeast-2)
282+
Default: ''
283+
Description: (Optional) Enabled regions (AWS regions, separated by commas). Leave blank to enable all regions.
284+
Type: String
260285

261286

262287
pCreateLambdaLogGroup:
@@ -292,16 +317,26 @@ Parameters:
292317
Default: 'true'
293318
Description: Auto enable RDS Login Events
294319
Type: String
295-
pEnableEksRuntimeMonitoring:
320+
pEnableRuntimeMonitoring:
296321
AllowedValues: ['true', 'false']
297322
Default: 'true'
298-
Description: Auto enable EKS Runtime Monitoring
323+
Description: Auto enable Runtime Monitoring
299324
Type: String
300325
pEnableEksAddonManagement:
301326
AllowedValues: ['true', 'false']
302327
Default: 'true'
303328
Description: Auto enable EKS Add-on Management
304329
Type: String
330+
pEnableEcsFargateAgentManagement:
331+
AllowedValues: ['true', 'false']
332+
Default: 'true'
333+
Description: Auto enable ECS Fargate Agent Management
334+
Type: String
335+
pEnableEc2AgentManagement:
336+
AllowedValues: ['true', 'false']
337+
Default: 'true'
338+
Description: Auto enable EC2 Agent Management
339+
Type: String
305340
pEnableLambdaNetworkLogs:
306341
AllowedValues: ['true', 'false']
307342
Default: 'true'
@@ -331,6 +366,17 @@ Parameters:
331366
Description: (Optional) Email address for receiving SRA alarms
332367
Type: String
333368

369+
Rules:
370+
CheckGuardDutyRuntimeEnabled:
371+
RuleCondition: !Equals [!Ref pEnableRuntimeMonitoring, 'false']
372+
Assertions:
373+
- Assert: !Not [!Equals [!Ref pEnableEksAddonManagement, 'true']]
374+
AssertDescription: "'Enable EKS Addon Management' requires Guardduty Runtime Monitoring to be enabled"
375+
- Assert: !Not [!Equals [!Ref pEnableEcsFargateAgentManagement, 'true']]
376+
AssertDescription: "'Enable Ecs Fargate Agent Management' requires Guardduty Runtime Monitoring to be enabled"
377+
- Assert: !Not [!Equals [!Ref pEnableEc2AgentManagement, 'true']]
378+
AssertDescription: "'Enable Ec2 Agent Management' requires Guardduty Runtime Monitoring to be enabled"
379+
334380
Conditions:
335381
cUsingKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
336382
cUseGraviton: !Or
@@ -1125,8 +1171,10 @@ Resources:
11251171
pAutoEnableKubernetesAuditLogs: !Ref pAutoEnableKubernetesAuditLogs
11261172
pAutoEnableMalwareProtection: !Ref pAutoEnableMalwareProtection
11271173
pEnableRdsLoginEvents: !Ref pEnableRdsLoginEvents
1128-
pEnableEksRuntimeMonitoring: !Ref pEnableEksRuntimeMonitoring
1174+
pEnableRuntimeMonitoring: !Ref pEnableRuntimeMonitoring
11291175
pEnableEksAddonManagement: !Ref pEnableEksAddonManagement
1176+
pEnableEcsFargateAgentManagement: !Ref pEnableEcsFargateAgentManagement
1177+
pEnableEc2AgentManagement: !Ref pEnableEc2AgentManagement
11301178
pEnableLambdaNetworkLogs: !Ref pEnableLambdaNetworkLogs
11311179
pCreateLambdaLogGroup: !Ref pCreateLambdaLogGroup
11321180
pDisableGuardDuty: !Ref pDisableGuardDuty
@@ -1145,6 +1193,8 @@ Resources:
11451193
pSecurityAccountId: !Ref pSecurityAccountId
11461194
pLogArchiveAccountId: !Ref pLogArchiveAccountId
11471195
pCreateAWSControlTowerExecutionRole: !Ref pCreateAWSControlTowerExecutionRole
1196+
pControlTowerRegionsOnly: !Ref pControlTowerRegionsOnly
1197+
pEnabledRegions: !Ref pEnabledRegions
11481198

11491199
Outputs:
11501200
oPublishingDestinationBucketName:

‎aws_sra_examples/modules/guardduty-org-module/templates/sra-guardduty-org-solution.yaml

Lines changed: 45 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -48,12 +48,16 @@ Metadata:
4848
default: GuardDuty Solution
4949
Parameters:
5050
- pDisableGuardDuty
51+
- pControlTowerRegionsOnly
52+
- pEnabledRegions
5153
- pAutoEnableS3Logs
5254
- pAutoEnableKubernetesAuditLogs
5355
- pAutoEnableMalwareProtection
5456
- pEnableRdsLoginEvents
55-
- pEnableEksRuntimeMonitoring
57+
- pEnableRuntimeMonitoring
5658
- pEnableEksAddonManagement
59+
- pEnableEcsFargateAgentManagement
60+
- pEnableEc2AgentManagement
5761
- pEnableLambdaNetworkLogs
5862
- pGuardDutyFindingPublishingFrequency
5963
- pGuardDutyOrgDeliveryBucketPrefix
@@ -129,10 +133,14 @@ Metadata:
129133
default: Auto Enable Malware Protection
130134
pEnableRdsLoginEvents:
131135
default: Auto enable RDS Login Events
132-
pEnableEksRuntimeMonitoring:
133-
default: Auto enable EKS Runtime Monitoring
136+
pEnableRuntimeMonitoring:
137+
default: Auto enable Runtime Monitoring
134138
pEnableEksAddonManagement:
135139
default: Auto enable EKS Add-on Management
140+
pEnableEcsFargateAgentManagement:
141+
default: Auto enable ECS Fargate Agent Management
142+
pEnableEc2AgentManagement:
143+
default: Auto enable EC2 Agent Management
136144
pEnableLambdaNetworkLogs:
137145
default: Auto enable Lambda Network Logs
138146
pGuardDutyFindingPublishingFrequency:
@@ -141,6 +149,10 @@ Metadata:
141149
default: GuardDuty Delivery Bucket Prefix
142150
pGuardDutyOrgDeliveryKeyAlias:
143151
default: GuardDuty Delivery KMS Key Alias
152+
pControlTowerRegionsOnly:
153+
default: Control Tower Regions Only
154+
pEnabledRegions:
155+
default: (Optional) Enabled Regions
144156

145157
Parameters:
146158
pRepoURL:
@@ -302,16 +314,26 @@ Parameters:
302314
Default: 'true'
303315
Description: Auto enable RDS Login Events
304316
Type: String
305-
pEnableEksRuntimeMonitoring:
317+
pEnableRuntimeMonitoring:
306318
AllowedValues: ['true', 'false']
307319
Default: 'true'
308-
Description: Auto enable EKS Runtime Monitoring
320+
Description: Auto enable Runtime Monitoring
309321
Type: String
310322
pEnableEksAddonManagement:
311323
AllowedValues: ['true', 'false']
312324
Default: 'true'
313325
Description: Auto enable EKS Add-on Management
314326
Type: String
327+
pEnableEcsFargateAgentManagement:
328+
AllowedValues: ['true', 'false']
329+
Default: 'true'
330+
Description: Auto enable ECS Fargate Agent Management
331+
Type: String
332+
pEnableEc2AgentManagement:
333+
AllowedValues: ['true', 'false']
334+
Default: 'true'
335+
Description: Auto enable EC2 Agent Management
336+
Type: String
315337
pEnableLambdaNetworkLogs:
316338
AllowedValues: ['true', 'false']
317339
Default: 'true'
@@ -334,6 +356,19 @@ Parameters:
334356
Default: sra-guardduty-org-delivery-key
335357
Description: GuardDuty Delivery KMS Key Alias
336358
Type: String
359+
pControlTowerRegionsOnly:
360+
Type: String
361+
Description: Only enable in the Control Tower governed regions (set to true for environments without AWS Control Tower)
362+
Default: 'false'
363+
AllowedValues: ['true', 'false']
364+
pEnabledRegions:
365+
AllowedPattern: '^$|^([a-z0-9-]{1,64})$|^(([a-z0-9-]{1,64},)*[a-z0-9-]{1,64})$'
366+
ConstraintDescription:
367+
Only lowercase letters, numbers, and hyphens ('-') allowed. (e.g. us-east-1) Additional AWS regions can be provided, separated by commas. (e.g.
368+
us-east-1,ap-southeast-2)
369+
Default: ''
370+
Description: (Optional) Enabled regions (AWS regions, separated by commas). Leave blank to enable all regions.
371+
Type: String
337372

338373
# Rules:
339374

@@ -846,8 +881,10 @@ Resources:
846881
pAutoEnableKubernetesAuditLogs: !Ref pAutoEnableKubernetesAuditLogs
847882
pAutoEnableMalwareProtection: !Ref pAutoEnableMalwareProtection
848883
pEnableRdsLoginEvents: !Ref pEnableRdsLoginEvents
849-
pEnableEksRuntimeMonitoring: !Ref pEnableEksRuntimeMonitoring
884+
pEnableRuntimeMonitoring: !Ref pEnableRuntimeMonitoring
850885
pEnableEksAddonManagement: !Ref pEnableEksAddonManagement
886+
pEnableEcsFargateAgentManagement: !Ref pEnableEcsFargateAgentManagement
887+
pEnableEc2AgentManagement: !Ref pEnableEc2AgentManagement
851888
pEnableLambdaNetworkLogs: !Ref pEnableLambdaNetworkLogs
852889
pCreateLambdaLogGroup: !If [cCreateLambdaLogGroup, true, false]
853890
pDisableGuardDuty: !If [cDisableGuardDuty, true, false]
@@ -858,6 +895,8 @@ Resources:
858895
pLambdaLogGroupRetention: !Ref pLambdaLogGroupRetention
859896
pLambdaLogLevel: !Ref pLambdaLogLevel
860897
pSRAAlarmEmail: !Ref pSRAAlarmEmail
898+
pControlTowerRegionsOnly: !Ref pControlTowerRegionsOnly
899+
pEnabledRegions: !Ref pEnabledRegions
861900

862901
CommonPrerequisitesMainSsmWaitHandle:
863902
Condition: cCommonPrerequisitesNotInstalled

‎aws_sra_examples/solutions/ami_bakery/ami_bakery_org/lambda/src/codepipeline.py

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,9 @@
1818

1919
if TYPE_CHECKING:
2020
from mypy_boto3_codecommit.client import CodeCommitClient
21-
from mypy_boto3_codecommit.type_defs import (
22-
CreateRepositoryOutputTypeDef,
23-
DeleteRepositoryOutputTypeDef,
24-
EmptyResponseMetadataTypeDef,
25-
PutFileOutputTypeDef,
26-
)
21+
from mypy_boto3_codecommit.type_defs import CreateRepositoryOutputTypeDef, DeleteRepositoryOutputTypeDef, PutFileOutputTypeDef
2722
from mypy_boto3_codepipeline.client import CodePipelineClient
28-
from mypy_boto3_codepipeline.type_defs import CreatePipelineOutputTypeDef, PipelineDeclarationTypeDef
23+
from mypy_boto3_codepipeline.type_defs import CreatePipelineOutputTypeDef, EmptyResponseMetadataTypeDef, PipelineDeclarationTypeDef
2924

3025
LOGGER = logging.getLogger("sra")
3126

0 commit comments

Comments
 (0)