|
| 1 | +# AMI Bakery Organization<!-- omit in toc --> |
| 2 | + |
| 3 | +Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. SPDX-License-Identifier: CC-BY-SA-4.0 |
| 4 | + |
| 5 | +## Table of Contents |
| 6 | + |
| 7 | +- [Table of Contents](#table-of-contents) |
| 8 | +- [Introduction](#introduction) |
| 9 | +- [Deployed Resource Details](#deployed-resource-details) |
| 10 | +- [Implementation Instructions](#implementation-instructions) |
| 11 | +- [Customization Instructions](#customization-instructions) |
| 12 | +- [Deletion Instructions](#deletion-instructions) |
| 13 | +- [References](#references) |
| 14 | + |
| 15 | +--- |
| 16 | + |
| 17 | +## Introduction |
| 18 | + |
| 19 | +The AMI Bakery Organization solution will automate creation of standardized and hardened Amazon Machine Operating Images with configurations and services that comply with security standards set by the Government and industry security standards/benchmarks such as and the Security Technical Implementation Guide (STIG) and the Center of Internet Security (CIS). |
| 20 | + |
| 21 | +The solution also provides an easy way to deploy security services such as Amazon Inspector, Amazon Macie, and Amazon GuardDuty that track and report potential vulnerabilities found within the environment. Additionally, the solution, once created, reduces the need to re-create new images when customers move from one multi-account to another as it can be shared and re-used. |
| 22 | + |
| 23 | +**Key solution features:** |
| 24 | + |
| 25 | +- Amazon Linux 2023 STIG hardened image |
| 26 | +- Ubuntu Pro CIS Level 1 hardened image |
| 27 | +- Microsoft Windows Server 2022 Base STIG hardened image |
| 28 | +- Windows CIS Level 1 - `Work on progress` |
| 29 | + |
| 30 | +--- |
| 31 | + |
| 32 | +## Deployed Resource Details |
| 33 | + |
| 34 | + |
| 35 | + |
| 36 | +### 1.0 Organization Management Account<!-- omit in toc --> |
| 37 | + |
| 38 | +#### 1.1 AWS CloudFormation<!-- omit in toc --> |
| 39 | + |
| 40 | +- All resources are deployed via AWS CloudFormation as a `StackSet` and `Stack Instance` within the `management account` or a CloudFormation `Stack` within a specific account. |
| 41 | +- The [Customizations for AWS Control Tower](https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/) solution deploys all templates as a CloudFormation `StackSet`. |
| 42 | +- For parameter details, review the [AWS CloudFormation templates](templates/). |
| 43 | + |
| 44 | +#### 1.2 Lambda Role<!-- omit in toc --> |
| 45 | + |
| 46 | +- The `Organizaton Management Lambda Role` is used by the Lambda function to assume a role in the target region. |
| 47 | + |
| 48 | +#### 1.3 DLQ<!-- omit in toc --> |
| 49 | + |
| 50 | +- SQS dead letter queue used for retaining any failed Lambda events. |
| 51 | + |
| 52 | +#### 1.4 Alarm Topic<!-- omit in toc --> |
| 53 | + |
| 54 | +- SNS Topic used to notify subscribers when messages hit the DLQ. |
| 55 | + |
| 56 | +#### 1.5 Lambda Function<!-- omit in toc --> |
| 57 | + |
| 58 | +- The Lambda function assumes a role in the Image Bakery Account and deploys resources to create Amazon Machine Images (AMIs). These resources include a Code Commit Repository to store CloudFormation Templates for creating AMIs, a Code Pipeline to deploy EC2 Image Builder to create AMIs, and other supporting resources such as an S3 Bucket and IAM Roles. The Lambda function also uploads an initial CloudFormation template to the Code Commit Repository. |
| 59 | + |
| 60 | +#### 1.6 CloudWatch Log Group<!-- omit in toc --> |
| 61 | + |
| 62 | +- All the `AWS Lambda Function` logs are sent to a CloudWatch Log Group `</aws/lambda/<LambdaFunctionName>` to help with debugging and traceability of the actions performed. |
| 63 | +- By default the `AWS Lambda Function` will create the CloudWatch Log Group and logs are encrypted with a CloudWatch Logs service managed encryption key. |
| 64 | +- Parameters are provided for changing the default log group retention and encryption KMS key. |
| 65 | + |
| 66 | +#### 2.0 Image Bakery Account<!-- omit in toc --> |
| 67 | + |
| 68 | +#### 2.1-2.3 Lambda Roles<!-- omit in toc --> |
| 69 | + |
| 70 | +- The `Configuration Role` is assumed by the Lambda function and used to create resources in the Image Bakery Account such as the Code Commit Repository, Code Pipeline, and S3 Bucket. |
| 71 | +- The `Code Pipeline Role` is assumed by te Code Pipeline and used to create resources in the Image Bakery Account such as the EC2 Image Builder. |
| 72 | +- The `Cloud Formation Role` is assumed by EC2 Image Builder and used to create Amazon Machine Images (AMIs) in the Image Bakery Account. |
| 73 | + |
| 74 | +#### 2.4 S3 bucket<!-- omit in toc --> |
| 75 | + |
| 76 | +- Amazon S3 Bucket for storing Code Commit artifacts. |
| 77 | + |
| 78 | +#### 2.5 Code Commit Repository<!-- omit in toc --> |
| 79 | + |
| 80 | +- A Code Commit Repository to store CloudFormation Templates that define EC2 Image Builder, Recipes, Components, etc. |
| 81 | + |
| 82 | +#### 2.6 CloudFormation<!-- omit in toc --> |
| 83 | + |
| 84 | +- AWS CloudFormation Templates describe the EC2 Image Builder, Recipes, Components, etc. used to build Amazon Machine Images (AMIs). |
| 85 | + |
| 86 | +#### 2.7 CodePipeline<!-- omit in toc --> |
| 87 | + |
| 88 | +- AWS CodePipeline monitors the CodeCommit Repository for changes to the CloudFormation Templates. When the Repository is updated, CodePipeline automatically updates EC2 Image builder. |
| 89 | + |
| 90 | +#### 2.8 EC2 Image Builder Pipeline<!-- omit in toc --> |
| 91 | + |
| 92 | +- EC2 ImageBuilder builds new Amazon Machine Images (AMIs) based on the CloudFormation Templates in the CodeCommit Repository. |
| 93 | + |
| 94 | +#### 2.9 Amazon Machine Images<!-- omit in toc --> |
| 95 | + |
| 96 | +- Amazon Machine Images (AMIs) are built by EC2 Image Builder. Then can then be used to launch EC2 Instances. |
| 97 | + |
| 98 | +--- |
| 99 | + |
| 100 | +## Implementation Instructions |
| 101 | + |
| 102 | +### Prerequisites<!-- omit in toc --> |
| 103 | + |
| 104 | +1. [Download and Stage the SRA Solutions](../../../docs/DOWNLOAD-AND-STAGE-SOLUTIONS.md). **Note:** This only needs to be done once for all the solutions. |
| 105 | +2. Verify that the [SRA Prerequisites Solution](../../common/common_prerequisites/) has been deployed. |
| 106 | + |
| 107 | +### Solution Deployment<!-- omit in toc --> |
| 108 | + |
| 109 | +Choose a Deployment Method: |
| 110 | + |
| 111 | +- [AWS CloudFormation](#aws-cloudformation) |
| 112 | +- [Customizations for AWS Control Tower](../../../docs/CFCT-DEPLOYMENT-INSTRUCTIONS.md) |
| 113 | + |
| 114 | +#### AWS CloudFormation<!-- omit in toc --> |
| 115 | + |
| 116 | +In the `management account (home region)`, launch an AWS CloudFormation **Stack** using one of the options below: |
| 117 | + |
| 118 | +- **Option 1:** (Recommended) Use the [sra-ami-bakery-org-main-ssm.yaml](templates/sra-ami-bakery-org-main-ssm.yaml) template. This is a more automated approach where some of the CloudFormation parameters are populated from SSM parameters created by |
| 119 | + the [SRA Prerequisites Solution](../../common/common_prerequisites/). |
| 120 | + |
| 121 | + ```bash |
| 122 | + aws cloudformation deploy --template-file $HOME/aws-security-reference-architecture-examples/aws_sra_examples/solutions/ami_bakery/ami_bakery_org/templates/sra-ami-bakery-org-main-ssm.yaml --stack-name sra-ami-bakery-org-main-ssm --capabilities CAPABILITY_NAMED_IAM --parameter-overrides pAMIBakeryAccountId=<YOUR_ACCOUNT_ID> pAMIBakeryRegion=<YOUR_REGION> pAMIBakeryFileName=<SOLUTION_FILE_NAME.YAML> |
| 123 | + |
| 124 | +**Note:** Below are available Cloudformation solution file templates, you can change the file names to meet your needs. |
| 125 | + |
| 126 | +1. [sra-ami-bakery-org-amazon-linux-stig-hardened.yaml](lambda/src/sra-ami-bakery-org-amazon-linux-stig-hardened.yaml) |
| 127 | +2. [sra-ami-bakery-org-ubuntu-pro-20-04-cis-level-1-hardened.yaml](lambda/src/sra-ami-bakery-org-ubuntu-pro-20-04-cis-level-1-hardened.yaml) |
| 128 | +3. [sra-ami-bakery-org-windows-server-2022-stig-hardened.yaml](lambda/src/sra-ami-bakery-org-windows-server-2022-stig-hardened.yaml) |
| 129 | + |
| 130 | +- **Option 2:** Deploy [sra-ami-bakery-org-main-ssm.yaml](templates/sra-ami-bakery-org-main-ssm.yaml) template using [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html) console - Create Stack. |
| 131 | + |
| 132 | +#### Verify Solution Deployment<!-- omit in toc --> |
| 133 | + |
| 134 | +1. Log into the EC2 ImageBuilder console. |
| 135 | +2. Navigate to the `Image pipelines` tab on the top left pane. It will display `sra-ami-bakery-org-image-type-pipeline` under the pipeline name column with Pipeline status set to `Green`. |
| 136 | + `Note:` |
| 137 | + `i.` You can manually create the image by running the pipeline with the following steps: `Click on Pipeline -> Actions dropdown -> Run pipeline` OR |
| 138 | + `2.` Leave the Pipeline to automatically create it for you daily at midnight (UTC). |
| 139 | +3. Verify that the image has been created by selecting the `Images` tab on the left pane or under the `Output Images` column below the pipeline's Summary |
| 140 | +
|
| 141 | +## Customization Instructions |
| 142 | +
|
| 143 | +The AMI Bakery solution can be customized to meet customer needs. This can be done by updating the image recipe of each supplied Cloudformation solution file template with the addition of one or more Amazon-managed or customer-managed components. |
| 144 | +**Note:** To avoid errors when updating the recipe, the EC2 Image Builder Recipe version number, i.e, `pSRAAMIBakeryImageRecipeVersionNumber` parameter value in the available Cloudformation solution file templates above must be changed from the default value `1.0.0` to something like `1.1.0` or any version number in `^[0-9]+\.[0-9]+\.[0-9]+$` pattern. |
| 145 | +You can make the changes either in the available CloudFormation files BEFORE the deployment OR from inside the CodeCommit repo after the deployment. Once updated from inside the CodeCommit repo console, go back to `AWS CodePipeline console`, open the solution's pipeline, and click `Release change` for the change to take effect. |
| 146 | + |
| 147 | +- **Example 1:** Adding Amazon Managed Microsoft Web Server IIS into [Windows Server 2022 Image](lambda/src/sra-ami-bakery-org-windows-server-2022-stig-hardened.yaml) |
| 148 | + 1. Add the Component's ARN as follows: `- ComponentArn: arn:aws:imagebuilder:us-east-1:aws:component/windows-server-iis/x.x.x` under the `rSRAAMIBakeryAMIBakeryImageBuilderRecipe`'s `Components` property. |
| 149 | + 2. You can do the same for all Amazon managed tools/clients found in the EC2 Image Builder component's console for other images (Amazon Linux and Ubuntu Pro 20.04) in your region. |
| 150 | + |
| 151 | +- **Example 2:** Adding a custom component (Customer-Managed) for Apache Httpd Web server with PHP and MariaDB into [Amazon Linux 2023 Image](lambda/src/sra-ami-bakery-org-amazon-linux-stig-hardened.yaml) |
| 152 | + 1. Copy the code below and paste it into the file right at the top of the `rSRAAMIBakeryAMIBakeryImageBuilderRecipe` resource under the CloudFormation `Resources` section. |
| 153 | +
|
| 154 | + ```cloudformation |
| 155 | + rInstallApachePHPMariaDB: |
| 156 | + Type: AWS::ImageBuilder::Component |
| 157 | + Properties: |
| 158 | + Name: apache-install |
| 159 | + Version: !Ref pSRAAMIBakeryImageRecipeVersionNumber |
| 160 | + Platform: Linux |
| 161 | + Data: | |
| 162 | + name: InstallApachePHPMariaDB |
| 163 | + description: This will install Apache Httpd Web server with PHP and MariaDB |
| 164 | + schemaVersion: 1.0 |
| 165 | + phases: |
| 166 | + - name: build |
| 167 | + steps: |
| 168 | + - name: Install |
| 169 | + action: ExecuteBash |
| 170 | + inputs: |
| 171 | + commands: |
| 172 | + - sudo yum update -y |
| 173 | + - sudo yum install -y amazon-linux-extras |
| 174 | + - sudo amazon-linux-extras install mariadb10.5 |
| 175 | + - sudo amazon-linux-extras install php8.2 |
| 176 | + - sudo yum install -y httpd |
| 177 | + - sudo systemctl start httpd |
| 178 | + - sudo systemctl enable httpd |
| 179 | + ``` |
| 180 | +
|
| 181 | + 2. Add the customized Component's ARN `- ComponentArn: !Ref rInstallApachePHPMariaDB` under the `rSRAAMIBakeryAMIBakeryImageBuilderRecipe`'s `Components` property. |
| 182 | + |
| 183 | +## Deletion Instructions |
| 184 | +
|
| 185 | +Choose one of the two options below: |
| 186 | +
|
| 187 | +- **Option 1:** Use AWS Management Console |
| 188 | + |
| 189 | +1. In the `management account (home region)`, delete the AWS CloudFormation **Stack** (`sra-ami-bakery-org-main-ssm`). **Note:** This will delete all SRA Staging resources |
| 190 | +2. In the `management account (home region)`, verify that the Lambda function processing is complete by confirming no more CloudWatch logs are generated. |
| 191 | +3. In the `management account (home region)`, delete the AWS CloudWatch **Log Group** (e.g. /aws/lambda/<solution_name>) for the Lambda function deployed. |
| 192 | +4. In the `account (home region)` identified by `pAMIBakeryAccountId` parameter, delete the AWS CloudFormation **Stack** (`sra-ami-bakery-org-cloudformation-stack`). Note: This will delete your solution with associated resources (IAM roles and policies, EC2 Image Builder resources, S3 Bucket, Codepipeline resources, etc) |
| 193 | +5. Delete `sra-ami-bakery-org-cloudformation-role` role in the IAM console in the `account (home region)` identified by `pAMIBakeryAccountId` parameter **Note:** this will delete both cloudformation role and associated policy |
| 194 | +6. Go to EC2 Image Builder console and choose Images from the navigation pane. Select the image versions created by the AMI Bakery solution. Select the images and on the Actions menu, choose Delete. |
| 195 | +
|
| 196 | +- **Option 2:** Use AWS CLI |
| 197 | +- **Note:** For steps `1 and 2`, we assume you are running the commands below against the `management (home region)`, and for **Steps** `3 - 5`, we assume you are running them in the `account (home region)` identified by `pAMIBakeryAccountId` parameter. |
| 198 | + |
| 199 | +1. `aws cloudformation delete-stack --stack-name sra-ami-bakery-org-main-ssm`. **Note:** This will delete all SRA Staging resources |
| 200 | +2. `aws logs delete-log-group --log-group-name /aws/lambda/sra-ami-bakery-org`. **Note:** This will delete the log group for AMI bakery solution |
| 201 | +3. `aws cloudformation delete-stack --stack-name sra-ami-bakery-org-cloudformation-stack`. **Note:** This will delete your solution with associated resources (IAM roles and policies, EC2 Imagebuilder resources, S3 Bucket, CodepiPeline resources, etc) |
| 202 | +4. `aws iam delete-role-policy --role-name sra-ami-bakery-org-cloudformation-role --policy-name sra-ami-bakery-org-cloudformation-policy`. **Note:** This will delete CloudFormation policy |
| 203 | +5. `aws iam delete-role --role-name sra-ami-bakery-org-cloudformation-role`. **Note:** This will delete CloudFormation role. |
| 204 | +6. `aws imagebuilder delete-image --image-build-version-arn <ARN_OF_THE_IMAGE_RESOURCE_VERSION_TO_BE_DELETED >`. **Note:** The image's arn can be fetched using this command `aws imagebuilder list-mages` |
| 205 | + |
| 206 | +--- |
| 207 | + |
| 208 | +## References |
| 209 | + |
| 210 | +- [Managing AWS SDKs in Lambda Functions](https://docs.aws.amazon.com/lambda/latest/operatorguide/sdks-functions.html) |
| 211 | +- [Lambda runtimes](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html) |
| 212 | +- [Python Boto3 SDK changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst) |
| 213 | +- [CIS compliance with Ubuntu LTS](https://ubuntu.com/security/certifications/docs/usg/cis) |
| 214 | +- [Creating AMI mappings for CloudFormation](https://octopus.com/blog/ami-mappings-cloudformation) |
| 215 | +- [Building an Ubuntu PRO CIS hardened AMI with EC2 Image Builder](https://www.youtube.com/watch?v=ALFuCc5kfpE) |
0 commit comments