watched-account.template.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: Sets up a role for monitoring via Security HQ and a Security Group lambda for real time alerting

Parameters:
  SecurityHQAccount:
    Type: String
    Description: The ID of the AWS Account the Security HQ application runs in
    AllowedPattern: "[0-9]{12}"
    ConstraintDescription: AWS Account IDs are 12-digit numbers
  SecurityHQDistBucket:
    Description: S3 bucket containing the Lambda artifacts
    Type: String
  Version:
    Description: Version of lambda artifact to deploy
    Type: String
  SnsTopicArn:
    Description: Arn of Anghammarad SNS topic
    Type: String

Mappings:
  Constants:
    BucketLambdaJarPath:
      Value: guardian/PROD/securitygroups-lambda/


Resources:
  # role that security HQ can assume
  # used to get relevant information for the account
  SecurityHQRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Action: sts:AssumeRole
          Principal:
            AWS: !Sub arn:aws:iam::${SecurityHQAccount}:root
      Policies:
      - PolicyName: security-hq-watched-account-access-policy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Resource: "*"
            Action:
            - s3:GetEncryptionConfiguration
            # Analyse security groups
            - trustedadvisor:Describe*
            - trustedadvisor:Refresh*
            - support:*
            - ec2:DescribeNetworkInterfaces
            - ec2:DescribeNetworkInterfaceAttribute
            - ec2:DescribeRegions
            - ec2:DescribeSecurityGroups
            - ec2:DescribeVpcs
            - elasticfilesystem:DescribeFileSystems
            - elasticfilesystem:DescribeMountTargets
            - elasticfilesystem:DescribeMountTargetSecurityGroups
            # IAM credentials overview
            - iam:GenerateCredentialReport
            - iam:GetCredentialReport
            - cloudformation:DescribeStacks
            # get AWS inspector results
            - inspector:List*
            - inspector:Describe*

  # POLICIES
  # shared policies for ConfigRule lambdas

  LambdaLogsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: Logging_permissions_for_Lambda_function
      PolicyDocument:
        Statement:
        - Effect: Allow
          Resource: arn:aws:logs:*:*:*
          Action:
          - logs:CreateLogGroup
          - logs:CreateLogStream
          - logs:PutLogEvents
      Roles:
      - !Ref SecurityGroupsLambdaRole

  LambdaS3AccountMappingPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: read_s3_to_get_account_mapping_file
    Properties:
      PolicyName: security-hq-install-bucket-policy
      PolicyDocument:
        Statement:
        # needs to be able to fetch artifacts and config from S3
        - Effect: Allow
          Resource:
          - !Sub arn:aws:s3:::${SecurityHQDistBucket}
          - !Sub arn:aws:s3:::${SecurityHQDistBucket}/*
          Action:
          - s3:ListBucketVersions
          - s3:ListBucket
          - s3:GetObjectVersion
          - s3:GetObject
      Roles:
      - !Ref SecurityGroupsLambdaRole

  LambdaConfigPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: AWS_Config_integration_for_lambda_function
      PolicyDocument:
        Statement:
        - Effect: Allow
          Resource: "*"
          Action:
          - config:Put*
          - config:Get*
          - config:List*
          - config:Describe*
        - Effect: Allow
          Resource: arn:aws:s3:::*/AWSLogs/*/Config/*
          Action:
            - s3:GetObject
      Roles:
      - !Ref SecurityGroupsLambdaRole

  # SECURITY GROUPS LAMBDA

  SecurityGroupsLambda:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: SHQ-security-groups-notifier
      Description: Checks for SGs that are open to the world, excepting ELB groups
      Handler: com.gu.hq.Lambda
      Runtime: java8
      MemorySize: 512
      Timeout: 300
      Role: !GetAtt SecurityGroupsLambdaRole.Arn
      Code:
        S3Bucket: !Ref SecurityHQDistBucket
        S3Key:
          Fn::Sub:
          - ${path}securitygroups-lambda-${version}.jar
          - path: !FindInMap [Constants, BucketLambdaJarPath, Value]
            version: !Ref Version
      Environment:
        Variables:
          SnsTopicArn: !Ref SnsTopicArn

  SecurityGroupsLambdaConfigInvocationPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt SecurityGroupsLambda.Arn
      Action: lambda:InvokeFunction
      Principal: config.amazonaws.com

  SecurityGroupsConfigRule:
    Type: AWS::Config::ConfigRule
    DependsOn: SecurityGroupsLambdaConfigInvocationPermission
    Properties:
      ConfigRuleName: security-groups-ingress
      Description: Watch SecurityGroup changes for insecure ingress rules
      Scope:
        ComplianceResourceTypes:
        - AWS::EC2::SecurityGroup
      Source:
        Owner: CUSTOM_LAMBDA
        SourceIdentifier: !GetAtt SecurityGroupsLambda.Arn
        SourceDetails:
        - EventSource: aws.config
          MessageType: ConfigurationItemChangeNotification

  SecurityGroupsLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Path: /
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Action: sts:AssumeRole
          Principal:
            Service:
            - lambda.amazonaws.com
      Policies:
      - PolicyName: SecurityGroupsLambdaExecutionPolicy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - elasticloadbalancing:DescribeLoadBalancers
            - ec2:DescribeSecurityGroups
            - sns:Publish
            Resource: "*"


Outputs:
  SecurityHQRole:
    Description: The ARN of a role that Security HQ can assume to lookup details on this account
    Value: !GetAtt SecurityHQRole.Arn