Skip to content

Commit a40dc08

Browse files
cyphronixcyphronix
authored
Opt-in regions for GuardDuty solution (#224)
* update get regions logic * type ignore * type ignore * type ignore * update 404 link * temp fix for cmk rotation * update cfct template links * Update safety.yml switch from "check" to "scan" ("check" deprecated as of may 2024) * Update safety.yml adding api key * updating safety.yml * updating safety.yml * updating safety.yml * updating safety.yml * updating safety.yml * listregion perms * update permissions for listregions * add logger messages * autoenable ALL; default TRUE governed regions only * update pEnabledRegions * add logging * temp re-order operations for bug * test fix for regional sts endpoint issue * temp perm mods for apsoutheast4 * update fix for all opt-in regions * testing updates to policy for opt-in * final updates for opt-in regions to work * linter fixes * remove unneeded condition statement * remove unneeded condition statement * fix condition statement * troubleshooting policy conditions * troubleshooting policy * troubleshooting policy * adding each region specifically in perms * final updates to kms+s3 perms * update safety cli file * update safety cli file * update safety cli file * update safety cli file * update2 safety cli file * update3 safety cli file * update4 safety cli file * update4 safety cli file * update5 safety cli file * update6 safety cli file * update7 safety cli file * update8 safety cli file * update 9 safety cli file
1 parent 24bdb8b commit a40dc08

File tree

30 files changed

+237
-206
lines changed

30 files changed

+237
-206
lines changed

‎.github/workflows/safety.yml

-3
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,6 @@ jobs:
5959
- name: Safety scan
6060
env:
6161
API_KEY: ${{secrets.SAFETY_API_KEY}}
62-
TEST_VAR: ${{secrets.TEST_SECRET}}
6362
run: |
64-
echo "test variable:"
65-
echo "$TEST_VAR"
6663
poetry run pip install safety
6764
poetry run safety --key "$API_KEY" --stage cicd scan

‎CHANGELOG.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ Updated [Firewall Manager](https://github.com/aws-samples/aws-security-reference
141141

142142
### Changed<!-- omit in toc -->
143143

144-
- Updated [CfCT template](aws_sra_examples/solutions/common/common_cfct_setup/templates/customizations-for-aws-control-tower.template) to resolve issue #137.
144+
- Updated [CfCT template](aws_sra_examples/solutions/common/common_cfct_setup/templates/) to resolve issue #137.
145145

146146
## 2023-05-05
147147

@@ -171,7 +171,7 @@ Updated [Firewall Manager](https://github.com/aws-samples/aws-security-reference
171171

172172
### Changed<!-- omit in toc -->
173173

174-
- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/customizations-for-aws-control-tower.template) to the latest version v2.5.0 and added Checkov suppressions.
174+
- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/) to the latest version v2.5.0 and added Checkov suppressions.
175175

176176
## 2022-07-29
177177

@@ -198,7 +198,7 @@ Updated [Firewall Manager](https://github.com/aws-samples/aws-security-reference
198198

199199
- Added Checkov Lambda Function suppressions for CKV_AWS_115 (Reserved Concurrent Executions) and CKV_AWS_117 (Run within a VPC) to all solution templates with Lambda Function configurations.
200200
- Updated Lambda python files to fix mypy finding for log_level to always be a string value.
201-
- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/customizations-for-aws-control-tower.template) to the latest version v2.4.0 and added Checkov suppressions.
201+
- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/) to the latest version v2.4.0 and added Checkov suppressions.
202202
- Updated pyproject.toml dependencies to the latest versions.
203203
- Updated [Macie](aws_sra_examples/solutions/macie/macie_org) solution to increase retries and handle API errors when creating existing members.
204204
- Updated [EC2 Default EBS Encryption](aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption) to include default string value for the pExcludeEC2DefaultEBSEncryptionTags parameter.

‎aws_sra_examples/solutions/ami_bakery/ami_bakery_org/lambda/src/common.py

+5-19
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1+
# type: ignore
12
"""This script includes common functions.
23
34
Version: 1.0
45
56
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
67
SPDX-License-Identifier: MIT-0
78
"""
9+
810
from __future__ import annotations
911

1012
import logging
@@ -176,25 +178,9 @@ def get_enabled_regions(customer_regions: str, control_tower_regions_only: bool
176178
elif control_tower_regions_only:
177179
region_list = get_control_tower_regions()
178180
else:
179-
default_available_regions = [
180-
"ap-northeast-1",
181-
"ap-northeast-2",
182-
"ap-northeast-3",
183-
"ap-south-1",
184-
"ap-southeast-1",
185-
"ap-southeast-2",
186-
"ca-central-1",
187-
"eu-central-1",
188-
"eu-north-1",
189-
"eu-west-1",
190-
"eu-west-2",
191-
"eu-west-3",
192-
"sa-east-1",
193-
"us-east-1",
194-
"us-east-2",
195-
"us-west-1",
196-
"us-west-2",
197-
]
181+
default_available_regions = []
182+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
183+
default_available_regions.append(region["RegionName"])
198184
LOGGER.info({"Default_Available_Regions": default_available_regions})
199185
region_list = default_available_regions
200186

‎aws_sra_examples/solutions/ami_bakery/ami_bakery_org/templates/sra-ami-bakery-org-configuration.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -447,6 +447,17 @@ Resources:
447447
Effect: Allow
448448
Action: sqs:SendMessage
449449
Resource: !GetAtt rAMIBakeryOrgDLQ.Arn
450+
451+
- PolicyName: sra-ami-bakery-org-policy-acct
452+
PolicyDocument:
453+
Version: 2012-10-17
454+
Statement:
455+
- Sid: AcctListRegions
456+
Effect: Allow
457+
Action:
458+
- account:ListRegions
459+
Resource: '*'
460+
450461
Tags:
451462
- Key: sra-solution
452463
Value: !Ref pSRASolutionName

‎aws_sra_examples/solutions/config/config_conformance_pack_org/scripts/list_config_recorder_status.py

+5-19
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# type: ignore
12
"""Get a list of accounts that do not have AWS Config enabled.
23
34
The purpose of this script is to check if AWS Config is enabled in each AWS account and region within an AWS Control
@@ -12,6 +13,7 @@
1213
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
1314
SPDX-License-Identifier: MIT-0
1415
"""
16+
1517
from __future__ import annotations
1618

1719
import logging
@@ -125,25 +127,9 @@ def get_enabled_regions(control_tower_regions_only: bool = False) -> list: # no
125127
if control_tower_regions_only:
126128
region_list = get_control_tower_regions()
127129
else:
128-
default_available_regions = [
129-
"ap-northeast-1",
130-
"ap-northeast-2",
131-
"ap-northeast-3",
132-
"ap-south-1",
133-
"ap-southeast-1",
134-
"ap-southeast-2",
135-
"ca-central-1",
136-
"eu-central-1",
137-
"eu-north-1",
138-
"eu-west-1",
139-
"eu-west-2",
140-
"eu-west-3",
141-
"sa-east-1",
142-
"us-east-1",
143-
"us-east-2",
144-
"us-west-1",
145-
"us-west-2",
146-
]
130+
default_available_regions = []
131+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
132+
default_available_regions.append(region["RegionName"])
147133
LOGGER.info({"Default_Available_Regions": default_available_regions})
148134
region_list = default_available_regions
149135

‎aws_sra_examples/solutions/config/config_org/lambda/src/common.py

+5-19
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1+
# type: ignore
12
"""This script includes common functions.
23
34
Version: 1.0
45
56
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
67
SPDX-License-Identifier: MIT-0
78
"""
9+
810
from __future__ import annotations
911

1012
import logging
@@ -129,25 +131,9 @@ def get_enabled_regions(customer_regions: str, control_tower_regions_only: bool
129131
elif control_tower_regions_only:
130132
region_list = get_control_tower_regions()
131133
else:
132-
default_available_regions = [
133-
"ap-northeast-1",
134-
"ap-northeast-2",
135-
"ap-northeast-3",
136-
"ap-south-1",
137-
"ap-southeast-1",
138-
"ap-southeast-2",
139-
"ca-central-1",
140-
"eu-central-1",
141-
"eu-north-1",
142-
"eu-west-1",
143-
"eu-west-2",
144-
"eu-west-3",
145-
"sa-east-1",
146-
"us-east-1",
147-
"us-east-2",
148-
"us-west-1",
149-
"us-west-2",
150-
]
134+
default_available_regions = []
135+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
136+
default_available_regions.append(region["RegionName"])
151137
LOGGER.info({"Default_Available_Regions": default_available_regions})
152138
region_list = default_available_regions
153139

‎aws_sra_examples/solutions/config/config_org/templates/sra-config-org-configuration.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -474,6 +474,17 @@ Resources:
474474
Effect: Allow
475475
Action: sqs:SendMessage
476476
Resource: !GetAtt rConfigOrgDLQ.Arn
477+
478+
- PolicyName: sra-config-org-policy-acct
479+
PolicyDocument:
480+
Version: 2012-10-17
481+
Statement:
482+
- Sid: AcctListRegions
483+
Effect: Allow
484+
Action:
485+
- account:ListRegions
486+
Resource: '*'
487+
477488
Tags:
478489
- Key: sra-solution
479490
Value: !Ref pSRASolutionName

‎aws_sra_examples/solutions/detective/detective_org/lambda/src/common.py

+5-19
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1+
# type: ignore
12
"""This script includes common functions.
23
34
Version: 1.0
45
56
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
67
SPDX-License-Identifier: MIT-0
78
"""
9+
810
from __future__ import annotations
911

1012
import logging
@@ -129,25 +131,9 @@ def get_enabled_regions(customer_regions: str, control_tower_regions_only: bool
129131
elif control_tower_regions_only:
130132
region_list = get_control_tower_regions()
131133
else:
132-
default_available_regions = [
133-
"ap-northeast-1",
134-
"ap-northeast-2",
135-
"ap-northeast-3",
136-
"ap-south-1",
137-
"ap-southeast-1",
138-
"ap-southeast-2",
139-
"ca-central-1",
140-
"eu-central-1",
141-
"eu-north-1",
142-
"eu-west-1",
143-
"eu-west-2",
144-
"eu-west-3",
145-
"sa-east-1",
146-
"us-east-1",
147-
"us-east-2",
148-
"us-west-1",
149-
"us-west-2",
150-
]
134+
default_available_regions = []
135+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
136+
default_available_regions.append(region["RegionName"])
151137
LOGGER.info({"Default_Available_Regions": default_available_regions})
152138
region_list = default_available_regions
153139

‎aws_sra_examples/solutions/detective/detective_org/templates/sra-detective-org-configuration.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -379,6 +379,17 @@ Resources:
379379
Effect: Allow
380380
Action: sqs:SendMessage
381381
Resource: !GetAtt rDetectiveOrgDLQ.Arn
382+
383+
- PolicyName: sra-detective-org-policy-acct
384+
PolicyDocument:
385+
Version: 2012-10-17
386+
Statement:
387+
- Sid: AcctListRegions
388+
Effect: Allow
389+
Action:
390+
- account:ListRegions
391+
Resource: '*'
392+
382393
Tags:
383394
- Key: sra-solution
384395
Value: !Ref pSRASolutionName

‎aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption/lambda/src/app.py

+6-20
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# type: ignore
12
"""The purpose of this script is to configure the EC2 EBS default encryption within each account and region.
23
34
Version: 1.1
@@ -7,6 +8,7 @@
78
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
89
SPDX-License-Identifier: MIT-0
910
"""
11+
1012
from __future__ import annotations
1113

1214
import json
@@ -121,25 +123,9 @@ def get_enabled_regions(customer_regions: str = None, control_tower_regions_only
121123
elif control_tower_regions_only:
122124
region_list = get_control_tower_regions()
123125
else:
124-
default_available_regions = [
125-
"ap-northeast-1",
126-
"ap-northeast-2",
127-
"ap-northeast-3",
128-
"ap-south-1",
129-
"ap-southeast-1",
130-
"ap-southeast-2",
131-
"ca-central-1",
132-
"eu-central-1",
133-
"eu-north-1",
134-
"eu-west-1",
135-
"eu-west-2",
136-
"eu-west-3",
137-
"sa-east-1",
138-
"us-east-1",
139-
"us-east-2",
140-
"us-west-1",
141-
"us-west-2",
142-
]
126+
default_available_regions = []
127+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
128+
default_available_regions.append(region["RegionName"])
143129
LOGGER.info({"Default_Available_Regions": default_available_regions})
144130
region_list = default_available_regions
145131

@@ -321,7 +307,7 @@ def process_accounts(event: Union[CloudFormationCustomResourceEvent, dict], para
321307
if is_account_with_exclude_tags(account, params):
322308
continue
323309

324-
if event.get("local_testing") == "true" or event.get("ResourceProperties", {}).get("local_testing") == "true": # type: ignore
310+
if event.get("local_testing") == "true" or event.get("ResourceProperties", {}).get("local_testing") == "true":
325311
local_testing(account, params)
326312
else:
327313
sns_message = {"Action": params["action"], "AccountId": account["Id"]}

‎aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption/templates/sra-ec2-default-ebs-encryption.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,17 @@ Resources:
397397
Action: sqs:SendMessage
398398
Resource: !GetAtt rEC2DefaultEBSEncryptionDLQ.Arn
399399

400+
- PolicyName: sra-ec2-default-ebs-encryption-policy-acct
401+
PolicyDocument:
402+
Version: 2012-10-17
403+
Statement:
404+
- Sid: AcctListRegions
405+
Effect: Allow
406+
Action:
407+
- account:ListRegions
408+
Resource: '*'
409+
410+
400411
Tags:
401412
- Key: sra-solution
402413
Value: !Ref pSRASolutionName

‎aws_sra_examples/solutions/guardduty/guardduty_org/lambda/src/app.py

+2-1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
1313
SPDX-License-Identifier: MIT-0
1414
"""
15+
1516
from __future__ import annotations
1617

1718
import json
@@ -44,7 +45,7 @@
4445
PRINCIPAL_NAME = "malware-protection.guardduty.amazonaws.com"
4546
SERVICE_NAME = "guardduty.amazonaws.com"
4647
UNEXPECTED = "Unexpected!"
47-
MAX_RUN_COUNT = 30 # 5 minute wait = 30 x 10 seconds
48+
MAX_RUN_COUNT = 60 # 5 minute wait = 30 x 10 seconds
4849
SLEEP_SECONDS = 10
4950
BOTO3_CONFIG = Config(retries={"max_attempts": 10, "mode": "standard"})
5051

‎aws_sra_examples/solutions/guardduty/guardduty_org/lambda/src/common.py

+8-19
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1+
# type: ignore
12
"""This script includes common functions.
23
34
Version: 1.1
45
56
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
67
SPDX-License-Identifier: MIT-0
78
"""
9+
810
from __future__ import annotations
911

1012
import logging
@@ -51,6 +53,9 @@ def assume_role(role: str, role_session_name: str, account: str = None, session:
5153
Returns:
5254
Session object for the specified AWS account
5355
"""
56+
# set regional endpoint environment variable to account for potential opt-in regions
57+
os.environ["AWS_STS_REGIONAL_ENDPOINTS"] = "regional"
58+
5459
if not session:
5560
session = boto3.Session()
5661
sts_client: STSClient = session.client("sts", config=BOTO3_CONFIG)
@@ -143,25 +148,9 @@ def get_enabled_regions(customer_regions: str, control_tower_regions_only: bool
143148
elif control_tower_regions_only:
144149
region_list = get_control_tower_regions()
145150
else:
146-
default_available_regions = [
147-
"ap-northeast-1",
148-
"ap-northeast-2",
149-
"ap-northeast-3",
150-
"ap-south-1",
151-
"ap-southeast-1",
152-
"ap-southeast-2",
153-
"ca-central-1",
154-
"eu-central-1",
155-
"eu-north-1",
156-
"eu-west-1",
157-
"eu-west-2",
158-
"eu-west-3",
159-
"sa-east-1",
160-
"us-east-1",
161-
"us-east-2",
162-
"us-west-1",
163-
"us-west-2",
164-
]
151+
default_available_regions = []
152+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
153+
default_available_regions.append(region["RegionName"])
165154
LOGGER.info({"Default_Available_Regions": default_available_regions})
166155
region_list = default_available_regions
167156

0 commit comments

Comments
 (0)