chore: add kinesis firehose for waf log

codeforjapan · Oct 2, 2021 · 25d5e66 · 25d5e66
1 parent 664b570
commit 25d5e66
Show file tree

Hide file tree

Showing 3 changed files with 142 additions and 4 deletions.
diff --git a/.cloudformation/cloud_front.yml b/.cloudformation/cloud_front.yml
@@ -22,6 +22,9 @@ Parameters:
   CFSSLCertificateId:
     Description: Type of this SSL id
     Type: String
+  WebACLArn:
+    Description: Type of this AWS WAF arn
+    Type: String
 
 Resources:
   # ------------------------------------------------------------#
@@ -127,6 +130,7 @@ Resources:
             ErrorCachingMinTTL: !Ref ErrorCacheTTL
           - ErrorCode: 504
             ErrorCachingMinTTL: !Ref ErrorCacheTTL
+        WebACLId: !Ref WebACLArn
       Tags:
         - Key: Name
           Value: !Sub ${AppEnvironment}-decidim-cfj-cloud-front
diff --git a/.cloudformation/waf.yml b/.cloudformation/waf.yml
@@ -9,6 +9,9 @@ Parameters:
     AllowedValues:
       - staging
       - production
+  KinesisDeliveryStreamArn:
+    Description: Type of Kinesis Firehose arn for WAF Log
+    Type: String
 
 Resources:
 # ------------------------------------------------------------#
@@ -37,7 +40,7 @@ Resources:
         - Name: !Sub ${AppEnvironment}-AWSManagedRulesKnownBadInputsRuleSet
           Priority: 1
           OverrideAction:
-            Count: {}
+            None: {}
           VisibilityConfig:
             SampledRequestsEnabled: true
             CloudWatchMetricsEnabled: true
@@ -49,7 +52,7 @@ Resources:
         - Name: !Sub ${AppEnvironment}-AWSManagedRulesAmazonIpReputationList
           Priority: 2
           OverrideAction:
-            Count: {}
+            None: {}
           VisibilityConfig:
             SampledRequestsEnabled: true
             CloudWatchMetricsEnabled: true
@@ -61,7 +64,7 @@ Resources:
         - Name: !Sub ${AppEnvironment}-AWSManagedRulesLinuxRuleSet
           Priority: 3
           OverrideAction:
-            Count: {}
+            None: {}
           VisibilityConfig:
             SampledRequestsEnabled: true
             CloudWatchMetricsEnabled: true
@@ -73,7 +76,7 @@ Resources:
         - Name: !Sub ${AppEnvironment}-AWSManagedRulesSQLiRuleSet
           Priority: 4
           OverrideAction:
-            Count: {}
+            None: {}
           VisibilityConfig:
             SampledRequestsEnabled: true
             CloudWatchMetricsEnabled: true
@@ -87,3 +90,23 @@ Resources:
         SampledRequestsEnabled: true
         CloudWatchMetricsEnabled: true
         MetricName: !Sub ${AppEnvironment}-cfj-decidim-web-acl
+  WafLoggingConfig:
+    Type: AWS::WAFv2::LoggingConfiguration
+    Properties:
+      LogDestinationConfigs:
+        - !Sub ${KinesisDeliveryStreamArn}
+      RedactedFields:
+        - Method: {}
+        - QueryString: {}
+        - UriPath: {}
+      ResourceArn: !Sub "${WebAclCloudFront.Arn}"
+      LoggingFilter:
+        DefaultBehavior: DROP
+        Filters:
+          - Behavior: KEEP
+            Conditions:
+              - ActionCondition:
+                  Action: BLOCK
+              - ActionCondition:
+                  Action: COUNT
+            Requirement: MEETS_ANY
diff --git a/.cloudformation/waf_kinesis_log.yml b/.cloudformation/waf_kinesis_log.yml
@@ -0,0 +1,111 @@
+AWSTemplateFormatVersion: '2010-09-09'
+Description: Kinesis Firehose for WAF logs
+
+Parameters:
+  AppEnvironment:
+    Description: Type of app environment.
+    Type: String
+    Default: staging
+    AllowedValues:
+      - staging
+      - production
+
+Resources:
+  S3Bucket:
+    Type: AWS::S3::Bucket
+    Properties:
+      BucketName: !Sub ${AppEnvironment}-cfj-decidim-waf-log
+      AccessControl: LogDeliveryWrite
+      LifecycleConfiguration:
+        Rules:
+          - Id: !Sub ${AppEnvironment}-cfj-decidim-waf-log-life-cycle
+            Status: Enabled
+            Transitions:
+              - StorageClass: STANDARD_IA
+                TransitionInDays: 30
+
+  WAFLogDeliveryStream:
+    Type: AWS::KinesisFirehose::DeliveryStream
+    Properties:
+      DeliveryStreamName: !Sub "aws-waf-logs-${AppEnvironment}-cfj-decidim"
+      DeliveryStreamType: DirectPut
+      S3DestinationConfiguration:
+        BucketARN: !Sub "${S3Bucket.Arn}"
+        BufferingHints:
+          SizeInMBs: 5
+          IntervalInSeconds: 300
+        CloudWatchLoggingOptions:
+          Enabled: true
+          LogGroupName: !Sub "/aws/kinesisfirehose/aws-waf-logs-${AppEnvironment}-cfj-decidim"
+          LogStreamName: S3Delivery
+        CompressionFormat: GZIP
+        EncryptionConfiguration:
+          NoEncryptionConfig: NoEncryption
+        ErrorOutputPrefix: ""
+        Prefix: ""
+        RoleARN: !Sub "${FirehoseRole.Arn}"
+
+  WAFLogDeliveryStreamLogGroup:
+    Type: AWS::Logs::LogGroup
+    Properties:
+      LogGroupName: !Sub "/aws/kinesisfirehose/aws-waf-logs-${AppEnvironment}-cfj-decidim"
+
+  WAFLogDeliveryStreamLogStream:
+    Type: AWS::Logs::LogStream
+    Properties:
+      LogGroupName: !Ref WAFLogDeliveryStreamLogGroup
+      LogStreamName: S3Delivery
+
+  FirehoseRole:
+    Type: AWS::IAM::Role
+    DeletionPolicy: Retain
+    Properties:
+      RoleName: !Sub "${AppEnvironment}-cfj-decidim-FirehoseRole"
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Action: sts:AssumeRole
+            Effect: Allow
+            Principal:
+              Service: firehose.amazonaws.com
+      Policies:
+        - PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Action:
+                  - glue:GetTable
+                  - glue:GetTableVersion
+                  - glue:GetTableVersions
+                Effect: Allow
+                Resource: "*"
+              - Action:
+                  - s3:AbortMultipartUpload
+                  - s3:GetBucketLocation
+                  - s3:GetObject
+                  - s3:ListBucket
+                  - s3:ListBucketMultipartUploads
+                  - s3:PutObject
+                Effect: Allow
+                Resource:
+                  - !Sub "${S3Bucket.Arn}"
+                  - !Sub "${S3Bucket.Arn}/*"
+                  - arn:aws:s3:::%FIREHOSE_BUCKET_NAME%
+                  - arn:aws:s3:::%FIREHOSE_BUCKET_NAME%/*
+              - Action: kms:Decrypt
+                Effect: Allow
+                Resource: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/%SSE_KEY_ID%"
+              - Action:
+                  - lambda:InvokeFunction
+                  - lambda:GetFunctionConfiguration
+                Effect: Allow
+                Resource: !Sub "arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:%FIREHOSE_DEFAULT_FUNCTION%:%FIREHOSE_DEFAULT_VERSION%"
+              - Action: logs:PutLogEvents
+                Effect: Allow
+                Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/kinesisfirehose/${S3Bucket}:log-stream:*"
+              - Action:
+                  - kinesis:DescribeStream
+                  - kinesis:GetShardIterator
+                  - kinesis:GetRecords
+                Effect: Allow
+                Resource: !Sub "arn:aws:kinesis:${AWS::Region}:${AWS::AccountId}:stream/%FIREHOSE_STREAM_NAME%"
+          PolicyName: firehose_delivery_role_policy