Skip to content

Commit 61812a1

Browse files
IevIeievgeniia ieromenko
IevIe
and
ievgeniia ieromenko
authored
Adding Detective Organization solution to Easy Setup, Quick Setup, CFCT Easy Setup and Quick Setup (#155)
* adding Detective to Easy Setup, Quick Setup * updated CHANGELOG --------- Co-authored-by: ievgeniia ieromenko <ieviero@amazon.com>
1 parent f3bd7ec commit 61812a1

File tree

6 files changed

+131
-1
lines changed

6 files changed

+131
-1
lines changed

‎CHANGELOG.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2023-07-01](#2023-07-01)
67
- [2023-06-21](#2023-06-21)
78
- [2023-06-20](#2023-06-20)
89
- [2023-06-01](#2023-06-01)
@@ -40,8 +41,16 @@ All notable changes to this project will be documented in this file.
4041

4142
---
4243

44+
## 2023-07-01
45+
46+
### Changed<!-- omit in toc -->
47+
48+
- Added [Detective Organization](aws_sra_examples/solutions/detective/detective_org) solution to [Easy Setup](aws_sra_examples/easy_setup) and [Quick Setup](aws_sra_examples/quick_setup/)
49+
4350
## 2023-06-21
4451

52+
### Changed<!-- omit in toc -->
53+
4554
- Added [GuardDuty Organization](aws_sra_examples/solutions/guardduty/guardduty_org) EKS, Malware, RDS, and Lambda protections to [Easy Setup](aws_sra_examples/easy_setup) and [Quick Setup](aws_sra_examples/quick_setup/) deployment options
4655
- Added [Inspector Organization](aws_sra_examples/solutions/inspector/inspector_org) solution to [Quick Setup](aws_sra_examples/quick_setup/) deployment option
4756

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ Follow the instructions within the [Quick Setup](aws_sra_examples/quick_setup) t
9898
| [S3 Block Account Public Access](aws_sra_examples/solutions/s3/s3_block_account_public_access) | Configures the account-level S3 BPA settings for all accounts within the organization. | Configures S3 BPA settings on buckets created by Control Tower only. | |
9999
| [Security Hub](aws_sra_examples/solutions/securityhub/securityhub_org) | Configures Security Hub within a delegated admin account for all accounts and governed regions within the organization. | | <ul><li>[Config Management Account](aws_sra_examples/solutions/config/config_management_account)</li></ul> |
100100
| [Inspector](aws_sra_examples/solutions/inspector/inspector_org) | Configure Inspector within a delegated admin account for all accounts and governed regions within the organization. | | |
101-
| [Detective](aws_sra_examples/solutions/detective/detective) | The Detective Organization solution will automate enabling Amazon Detective by delegating administration to an account (e.g. Audit or Security Tooling) and configuring Detective for all the existing and future AWS Organization accounts. **Note:** As of 06/07/2023, this solution is not included in the quick setup (it will be in a future code release) | | <ul><li>[GuardDuty](aws_sra_examples/solutions/guardduty/guardduty_org)</li></ul> |
101+
| [Detective](aws_sra_examples/solutions/detective/detective) | The Detective Organization solution will automate enabling Amazon Detective by delegating administration to an account (e.g. Audit or Security Tooling) and configuring Detective for all the existing and future AWS Organization accounts. | | <ul><li>[GuardDuty](aws_sra_examples/solutions/guardduty/guardduty_org)</li></ul> |
102102
## Utils
103103

104104
- packaging_scripts/stage-solution.sh (Package and stage all the AWS SRA example solutions. For more information see [Staging script details](aws_sra_examples/docs/DOWNLOAD-AND-STAGE-SOLUTIONS.md#staging-script-details))

‎aws_sra_examples/easy_setup/customizations_for_aws_control_tower/manifest.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ resources:
2121
parameter_value: 'No'
2222
- parameter_key: pDeployConfigConformancePackSolution
2323
parameter_value: 'No'
24+
- parameter_key: pDeployDetectiveSolution
25+
parameter_value: 'No'
2426
- parameter_key: pDeployEC2DefaultEBSEncryptionSolution
2527
parameter_value: 'No'
2628
- parameter_key: pDeployFirewallManagerSolution
@@ -115,6 +117,12 @@ resources:
115117
parameter_value: ''
116118
- parameter_key: pConformancePackExcludedAccounts
117119
parameter_value: ''
120+
121+
# Detective Solution
122+
- parameter_key: pDatasourcePackages
123+
parameter_value: 'ASFF_SECURITYHUB_FINDING, EKS_AUDIT'
124+
- parameter_key: pGuarddutyEnabledForMoreThan48Hours
125+
parameter_value: 'false'
118126

119127
# EC2 Default EBS Encryption Solution
120128
- parameter_key: pExcludeEC2DefaultEBSEncryptionTags

‎aws_sra_examples/easy_setup/templates/sra-easy-setup.yaml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ Metadata:
3939
- pDeployConfigManagementSolution
4040
- pDeployConfigConformancePackSolution
4141
- pDeployEC2DefaultEBSEncryptionSolution
42+
- pDeployDetectiveSolution
4243
- pDeployFirewallManagerSolution
4344
- pDeployGuardDutySolution
4445
- pDeployIAMAccessAnalyzerSolution
@@ -93,6 +94,11 @@ Metadata:
9394
- pConformancePackTemplateName
9495
- pDeliveryS3KeyPrefix
9596
- pConformancePackExcludedAccounts
97+
- Label:
98+
default: Detective Solution
99+
Parameters:
100+
- pDatasourcePackages
101+
- pGuarddutyEnabledForMoreThan48Hours
96102
- Label:
97103
default: EC2 Default EBS Encryption Solution
98104
Parameters:
@@ -259,6 +265,8 @@ Metadata:
259265
default: Create Lambda Log Group
260266
pCreateVpcForSG:
261267
default: Create VPC For Security Group
268+
pDatasourcePackages:
269+
default: (Optional) Datasource packages to start
262270
pDeliveryS3KeyPrefix:
263271
default: (Optional) Delivery S3 Key Prefix
264272
pDeployAccountAlternateContactsSolution:
@@ -271,6 +279,8 @@ Metadata:
271279
default: Deploy the AWS Config Management Solution
272280
pDeployEC2DefaultEBSEncryptionSolution:
273281
default: Deploy the EC2 Default EBS Encryption Solution
282+
pDeployDetectiveSolution:
283+
default: Deploy the Detective Solution
274284
pDeployFirewallManagerSolution:
275285
default: Deploy the Firewall Manager Solution
276286
pDeployGuardDutySolution:
@@ -321,6 +331,8 @@ Metadata:
321331
default: (Optional) Exclude S3 Block Account Public Access Tags
322332
pFrequency:
323333
default: Frequency
334+
pGuarddutyEnabledForMoreThan48Hours:
335+
default: Guardduty Enabled More Than 48 Hours
324336
pGuardDutyFindingPublishingFrequency:
325337
default: GuardDuty Finding Publishing Frequency
326338
pGuardDutyOrgDeliveryBucketPrefix:
@@ -634,6 +646,11 @@ Parameters:
634646
Default: 'true'
635647
Description: Create a new VPC for the Firewall Manager Security Groups
636648
Type: String
649+
pDatasourcePackages:
650+
AllowedValues: [ASFF_SECURITYHUB_FINDING, EKS_AUDIT, '']
651+
Default: ASFF_SECURITYHUB_FINDING, EKS_AUDIT
652+
Description: Optional datasources used to populate the behavior graph. Valid values are ASFF_SECURITYHUB_FINDING and EKS_AUDIT
653+
Type: CommaDelimitedList
637654
pDeliveryS3KeyPrefix:
638655
AllowedPattern: '^$|^[a-zA-Z][-a-zA-Z0-9]*$'
639656
ConstraintDescription:
@@ -661,6 +678,11 @@ Parameters:
661678
Default: 'No'
662679
Description: Deploy the AWS Config Management solution. Note, if solution was previously deployed, choose 'Already Deployed'.
663680
Type: String
681+
pDeployDetectiveSolution:
682+
AllowedValues: ['Yes', 'No']
683+
Default: 'No'
684+
Description: Deploy the Detective solution
685+
Type: String
664686
pDeployEC2DefaultEBSEncryptionSolution:
665687
AllowedValues: ['Yes', 'No']
666688
Default: 'No'
@@ -797,6 +819,11 @@ Parameters:
797819
Default: 1hour
798820
Description: The frequency with which AWS Config delivers configuration snapshots.
799821
Type: String
822+
pGuarddutyEnabledForMoreThan48Hours:
823+
AllowedValues: ['true', 'false']
824+
Default: 'false'
825+
Description: Has Guardduty been enabled in the Organization for more than 48 hours?
826+
Type: String
800827
pGuardDutyFindingPublishingFrequency:
801828
AllowedValues: [FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS]
802829
Default: FIFTEEN_MINUTES
@@ -1122,6 +1149,7 @@ Conditions:
11221149
- !Condition cDeployConfigManagementSolution
11231150
- !Condition cDeployConfigManagementSolutionAlreadyDeployed
11241151
- !Equals [!Ref pDeployConfigConformancePackSolution, 'Yes']
1152+
cDeployDetectiveSolution: !Equals [!Ref pDeployDetectiveSolution, 'Yes']
11251153
cDeployEC2DefaultEBSEncryptionSolution: !Equals [!Ref pDeployEC2DefaultEBSEncryptionSolution, 'Yes']
11261154
cDeployFirewallManagerSolution: !Equals [!Ref pDeployFirewallManagerSolution, 'Yes']
11271155
cDeployGuardDutySolution: !Equals [!Ref pDeployGuardDutySolution, 'Yes']
@@ -1730,6 +1758,31 @@ Resources:
17301758
pSourceStackName: !If [cDeployConfigManagementSolution, !Ref rConfigManagementSolutionStack, '']
17311759
# pSRAStagingS3BucketName: !Ref pSRAStagingS3BucketName
17321760

1761+
rDetectiveSolutionStack:
1762+
Type: AWS::CloudFormation::Stack
1763+
DependsOn: rCommonPrerequisitesMainSsm
1764+
Condition: cDeployDetectiveSolution
1765+
DeletionPolicy: Delete
1766+
UpdateReplacePolicy: Delete
1767+
Properties:
1768+
TemplateURL: !Sub https://${pSRAStagingS3BucketNamePrefix}-${AWS::AccountId}-${AWS::Region}.s3.${AWS::Region}.${AWS::URLSuffix}/sra-detective-org/templates/sra-detective-org-main-ssm.yaml
1769+
Parameters:
1770+
pComplianceFrequency: !Ref pComplianceFrequency
1771+
# pControlTowerRegionsOnly: !Ref pControlTowerRegionsOnly
1772+
pCreateLambdaLogGroup: !If [cCreateLambdaLogGroup, true, false]
1773+
pDatasourcePackages: !Join
1774+
- ','
1775+
- !Ref pDatasourcePackages
1776+
# pDelegatedAdminAccountId: !Ref pAuditAccountId
1777+
# pEnabledRegions: !Ref pEnabledRegions
1778+
pGuarddutyEnabledForMoreThan48Hours: !Ref pGuarddutyEnabledForMoreThan48Hours
1779+
pLambdaLogGroupKmsKey: !Ref pLambdaLogGroupKmsKey
1780+
pLambdaLogGroupRetention: !Ref pLambdaLogGroupRetention
1781+
pLambdaLogLevel: !Ref pLambdaLogLevel
1782+
# pOrganizationId: !Ref pOrganizationId
1783+
pSRAAlarmEmail: !Ref pSRAAlarmEmail
1784+
# pSRAStagingS3BucketName: !Ref pSRAStagingS3BucketName
1785+
17331786
rEC2DefaultEBSEncryptionSolutionStack:
17341787
Type: AWS::CloudFormation::Stack
17351788
DependsOn: rCommonPrerequisitesMainSsm

‎aws_sra_examples/quick_setup/customizations_for_aws_control_tower/manifest-v2.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,14 @@ resources:
9595
- parameter_key: pConformancePackExcludedAccounts
9696
parameter_value: ''
9797

98+
# Detective Solution
99+
- parameter_key: pDeployDetectiveSolution
100+
parameter_value: 'Yes'
101+
- parameter_key: pDatasourcePackages
102+
parameter_value: 'ASFF_SECURITYHUB_FINDING, EKS_AUDIT'
103+
- parameter_key: pGuarddutyEnabledForMoreThan48Hours
104+
parameter_value: 'false'
105+
98106
# EC2 Default EBS Encryption Solution
99107
- parameter_key: pDeployEC2DefaultEBSEncryptionSolution
100108
parameter_value: 'Yes'

‎aws_sra_examples/quick_setup/templates/sra-quick-setup-ssm.yaml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,12 @@ Metadata:
6464
- pConformancePackTemplateName
6565
- pDeliveryS3KeyPrefix
6666
- pConformancePackExcludedAccounts
67+
- Label:
68+
default: Detective Solution
69+
Parameters:
70+
- pDeployDetectiveSolution
71+
- pDatasourcePackages
72+
- pGuarddutyEnabledForMoreThan48Hours
6773
- Label:
6874
default: EC2 Default EBS Encryption Solution
6975
Parameters:
@@ -217,6 +223,8 @@ Metadata:
217223
default: Create Lambda Log Group
218224
pCreateVpcForSG:
219225
default: Create VPC For Security Group
226+
pDatasourcePackages:
227+
default: (Optional) Datasource packages to start
220228
pDeliveryS3KeyPrefix:
221229
default: (Optional) Delivery S3 Key Prefix
222230
pDeployAccountAlternateContactsSolution:
@@ -227,6 +235,8 @@ Metadata:
227235
default: Deploy the AWS Config Conformance Pack Solution
228236
pDeployConfigManagementSolution:
229237
default: Deploy the AWS Config Management Solution
238+
pDeployDetectiveSolution:
239+
default: Deploy the Detective Solution
230240
pDeployEC2DefaultEBSEncryptionSolution:
231241
default: Deploy the EC2 Default EBS Encryption Solution
232242
pDeployFirewallManagerSolution:
@@ -283,6 +293,8 @@ Metadata:
283293
default: (Optional) Exclude S3 Block Account Public Access Tags
284294
pFrequency:
285295
default: Frequency
296+
pGuarddutyEnabledForMoreThan48Hours:
297+
default: Guardduty Enabled More Than 48 Hours
286298
pGuardDutyFindingPublishingFrequency:
287299
default: GuardDuty Finding Publishing Frequency
288300
pGuardDutyOrgDeliveryBucketPrefix:
@@ -534,6 +546,11 @@ Parameters:
534546
Default: 'true'
535547
Description: Create a new VPC for the Firewall Manager Security Groups
536548
Type: String
549+
pDatasourcePackages:
550+
AllowedValues: [ASFF_SECURITYHUB_FINDING, EKS_AUDIT, '']
551+
Default: ASFF_SECURITYHUB_FINDING, EKS_AUDIT
552+
Description: Optional datasources used to populate the behavior graph. Valid values are ASFF_SECURITYHUB_FINDING and EKS_AUDIT
553+
Type: CommaDelimitedList
537554
pDeliveryS3KeyPrefix:
538555
AllowedPattern: '^$|^[a-zA-Z][-a-zA-Z0-9]*$'
539556
ConstraintDescription:
@@ -561,6 +578,11 @@ Parameters:
561578
Default: 'Yes'
562579
Description: Deploy the AWS Config Management solution. Note, if solution was previously deployed, choose 'Already Deployed'.
563580
Type: String
581+
pDeployDetectiveSolution:
582+
AllowedValues: ['Yes', 'No']
583+
Default: 'Yes'
584+
Description: Deploy the Detective solution
585+
Type: String
564586
pDeployEC2DefaultEBSEncryptionSolution:
565587
AllowedValues: ['Yes', 'No']
566588
Default: 'Yes'
@@ -707,6 +729,11 @@ Parameters:
707729
Default: 1hour
708730
Description: The frequency with which AWS Config delivers configuration snapshots.
709731
Type: String
732+
pGuarddutyEnabledForMoreThan48Hours:
733+
AllowedValues: ['true', 'false']
734+
Default: 'false'
735+
Description: Has Guardduty been enabled in the Organization for more than 48 hours?
736+
Type: String
710737
pGuardDutyFindingPublishingFrequency:
711738
AllowedValues: [FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS]
712739
Default: FIFTEEN_MINUTES
@@ -1026,6 +1053,7 @@ Conditions:
10261053
- !Condition cDeployConfigManagementSolution
10271054
- !Condition cDeployConfigManagementSolutionAlreadyDeployed
10281055
- !Equals [!Ref pDeployConfigConformancePackSolution, 'Yes']
1056+
cDeployDetectiveSolution: !Equals [!Ref pDeployDetectiveSolution, 'Yes']
10291057
cDeployEC2DefaultEBSEncryptionSolution: !Equals [!Ref pDeployEC2DefaultEBSEncryptionSolution, 'Yes']
10301058
cDeployFirewallManagerSolution: !Equals [!Ref pDeployFirewallManagerSolution, 'Yes']
10311059
cDeployGuardDutySolution: !Equals [!Ref pDeployGuardDutySolution, 'Yes']
@@ -1149,6 +1177,30 @@ Resources:
11491177
pSourceStackName: !If [cDeployConfigManagementSolution, !Ref rConfigManagementSolutionStack, '']
11501178
# pSRAStagingS3BucketName: !Ref pSRAStagingS3BucketName
11511179

1180+
rDetectiveSolutionStack:
1181+
Type: AWS::CloudFormation::Stack
1182+
Condition: cDeployDetectiveSolution
1183+
DeletionPolicy: Delete
1184+
UpdateReplacePolicy: Delete
1185+
Properties:
1186+
TemplateURL: !Sub https://${pSRAStagingS3BucketName}.s3.${AWS::Region}.${AWS::URLSuffix}/sra-detective-org/templates/sra-detective-org-main-ssm.yaml
1187+
Parameters:
1188+
pComplianceFrequency: !Ref pComplianceFrequency
1189+
# pControlTowerRegionsOnly: !Ref pControlTowerRegionsOnly
1190+
pCreateLambdaLogGroup: !If [cCreateLambdaLogGroup, true, false]
1191+
pDatasourcePackages: !Join
1192+
- ','
1193+
- !Ref pDatasourcePackages
1194+
# pDelegatedAdminAccountId: !Ref pAuditAccountId
1195+
# pEnabledRegions: !Ref pEnabledRegions
1196+
pGuarddutyEnabledForMoreThan48Hours: !Ref pGuarddutyEnabledForMoreThan48Hours
1197+
pLambdaLogGroupKmsKey: !Ref pLambdaLogGroupKmsKey
1198+
pLambdaLogGroupRetention: !Ref pLambdaLogGroupRetention
1199+
pLambdaLogLevel: !Ref pLambdaLogLevel
1200+
# pOrganizationId: !Ref pOrganizationId
1201+
pSRAAlarmEmail: !Ref pSRAAlarmEmail
1202+
# pSRAStagingS3BucketName: !Ref pSRAStagingS3BucketName
1203+
11521204
rEC2DefaultEBSEncryptionSolutionStack:
11531205
Type: AWS::CloudFormation::Stack
11541206
Condition: cDeployEC2DefaultEBSEncryptionSolution

0 commit comments

Comments
 (0)