-
Notifications
You must be signed in to change notification settings - Fork 116
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
New AWS Cloudtrail rule: include global service events
- Loading branch information
Showing
13 changed files
with
279 additions
and
51 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
|
|
||
| Enable include global service events for Cloudtrail | ||
|
|
||
| ```yaml--- | ||
| Resources: | ||
| GoodExampleTrail: | ||
| Type: AWS::CloudTrail::Trail | ||
| Properties: | ||
| IncludeGlobalServiceEvents: true | ||
| S3BucketName: "my-bucket" | ||
| TrailName: "Cloudtrail" | ||
| ``` | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
|
|
||
| Enable include global service events for Cloudtrail | ||
|
|
||
| ```hcl | ||
| resource "aws_cloudtrail" "good_example" { | ||
| include_global_service_events = true | ||
| s3_bucket_name = "abcdefgh" | ||
| } | ||
| ``` | ||
|
|
||
| #### Remediation Links | ||
| - https://registry.terraform.io/providers/rgeraskin/aws2/latest/docs/resources/cloudtrail#include_global_service_events | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
|
|
||
| Include Global Service Events is a default value for Cloudtrail and it publishes events from global services that are not region specific such as IAM, STS and CloudFront. It is feasible that a rogue actor compromising an AWS account might want to disable this field to remove trace of their actions. | ||
|
|
||
| ### Impact | ||
| Events from global services such as IAM are not being published to the log files | ||
|
|
||
| <!-- DO NOT CHANGE --> | ||
| {{ remediationActions }} | ||
|
|
||
| ### Links | ||
| - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-global-service-events | ||
|
|
||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
29 changes: 29 additions & 0 deletions
29
rules/cloud/policies/aws/cloudtrail/include_global_service_events.cf.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| package cloudtrail | ||
|
|
||
| var cloudFormationIncludeGlobalServiceEventsGoodExamples = []string{ | ||
| `--- | ||
| Resources: | ||
| GoodExampleTrail: | ||
| Type: AWS::CloudTrail::Trail | ||
| Properties: | ||
| IncludeGlobalServiceEvents: true | ||
| S3BucketName: "my-bucket" | ||
| TrailName: "Cloudtrail" | ||
| `, | ||
| } | ||
|
|
||
| var cloudFormationIncludeGlobalServiceEventsBadExamples = []string{ | ||
| `--- | ||
| Resources: | ||
| BadExampleTrail: | ||
| Type: AWS::CloudTrail::Trail | ||
| Properties: | ||
| IncludeGlobalServiceEvents: false | ||
| S3BucketName: "my-bucket" | ||
| TrailName: "Cloudtrail" | ||
| `, | ||
| } | ||
|
|
||
| var cloudFormationIncludeGlobalServiceEventsLinks = []string{} | ||
|
|
||
| var cloudFormationIncludeGlobalServiceEventsRemediationMarkdown = `` |
51 changes: 51 additions & 0 deletions
51
rules/cloud/policies/aws/cloudtrail/include_global_service_events.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| package cloudtrail | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/defsec/internal/rules" | ||
| "github.com/aquasecurity/defsec/pkg/providers" | ||
| "github.com/aquasecurity/defsec/pkg/scan" | ||
| "github.com/aquasecurity/defsec/pkg/severity" | ||
| "github.com/aquasecurity/defsec/pkg/state" | ||
| ) | ||
|
|
||
| var checkIncludeGlobalServiceEvents = rules.Register( | ||
| scan.Rule{ | ||
| AVDID: "AVD-AWS-0343", | ||
| Provider: providers.AWSProvider, | ||
| Service: "cloudtrail", | ||
| ShortCode: "include-global-service-events", | ||
| Summary: "Specifies whether Cloudtrail is publishing events from global services such as IAM to the log files. ", | ||
| Impact: "Events from global services such as IAM are not being published to the log files", | ||
| Resolution: "Enable include global service events for Cloudtrail", | ||
| Explanation: `Include Global Service Events is a default value for Cloudtrail and it publishes events from global services that are not region specific such as IAM, STS and CloudFront. It is feasible that a rogue actor compromising an AWS account might want to disable this field to remove trace of their actions.`, | ||
| Links: []string{ | ||
| "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-concepts.html#cloudtrail-concepts-global-service-events", | ||
| }, | ||
| Terraform: &scan.EngineMetadata{ | ||
| GoodExamples: terraformIncludeGlobalServiceEventsGoodExamples, | ||
| BadExamples: terraformIncludeGlobalServiceEventsBadExamples, | ||
| Links: terraformIncludeGlobalServiceEventsLinks, | ||
| RemediationMarkdown: terraformIncludeGlobalServiceEventsRemediationMarkdown, | ||
| }, | ||
| CloudFormation: &scan.EngineMetadata{ | ||
| GoodExamples: cloudFormationIncludeGlobalServiceEventsGoodExamples, | ||
| BadExamples: cloudFormationIncludeGlobalServiceEventsBadExamples, | ||
| Links: cloudFormationIncludeGlobalServiceEventsLinks, | ||
| RemediationMarkdown: cloudFormationIncludeGlobalServiceEventsRemediationMarkdown, | ||
| }, | ||
| Severity: severity.Medium, | ||
| }, | ||
| func(s *state.State) (results scan.Results) { | ||
| for _, trail := range s.AWS.CloudTrail.Trails { | ||
| if trail.IncludeGlobalServiceEvents.IsFalse() { | ||
| results.Add( | ||
| "Trail is not publishing events from global services such as IAM to the log files.", | ||
| trail.IncludeGlobalServiceEvents, | ||
| ) | ||
| } else { | ||
| results.AddPassed(&trail) | ||
| } | ||
| } | ||
| return | ||
| }, | ||
| ) |
25 changes: 25 additions & 0 deletions
25
rules/cloud/policies/aws/cloudtrail/include_global_service_events.tf.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| package cloudtrail | ||
|
|
||
| var terraformIncludeGlobalServiceEventsGoodExamples = []string{ | ||
| ` | ||
| resource "aws_cloudtrail" "good_example" { | ||
| include_global_service_events = true | ||
| s3_bucket_name = "abcdefgh" | ||
| } | ||
| `, | ||
| } | ||
|
|
||
| var terraformIncludeGlobalServiceEventsBadExamples = []string{ | ||
| ` | ||
| resource "aws_cloudtrail" "bad_example" { | ||
| include_global_service_events = false | ||
| s3_bucket_name = "abcdefgh" | ||
| } | ||
| `, | ||
| } | ||
|
|
||
| var terraformIncludeGlobalServiceEventsLinks = []string{ | ||
| `https://registry.terraform.io/providers/rgeraskin/aws2/latest/docs/resources/cloudtrail#include_global_service_events`, | ||
| } | ||
|
|
||
| var terraformIncludeGlobalServiceEventsRemediationMarkdown = `` |
65 changes: 65 additions & 0 deletions
65
rules/cloud/policies/aws/cloudtrail/include_global_service_events_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| package cloudtrail | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| defsecTypes "github.com/aquasecurity/defsec/pkg/types" | ||
|
|
||
| "github.com/aquasecurity/defsec/pkg/state" | ||
|
|
||
| "github.com/aquasecurity/defsec/pkg/providers/aws/cloudtrail" | ||
| "github.com/aquasecurity/defsec/pkg/scan" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestCheckIncludeGlobalServiceEvents(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| input cloudtrail.CloudTrail | ||
| expected bool | ||
| }{ | ||
| { | ||
| name: "AWS CloudTrail without include global service events", | ||
| input: cloudtrail.CloudTrail{ | ||
| Trails: []cloudtrail.Trail{ | ||
| { | ||
| Metadata: defsecTypes.NewTestMetadata(), | ||
| IncludeGlobalServiceEvents: defsecTypes.Bool(false, defsecTypes.NewTestMetadata()), | ||
| }, | ||
| }, | ||
| }, | ||
| expected: true, | ||
| }, | ||
| { | ||
| name: "AWS CloudTrail with include global service events", | ||
| input: cloudtrail.CloudTrail{ | ||
| Trails: []cloudtrail.Trail{ | ||
| { | ||
| Metadata: defsecTypes.NewTestMetadata(), | ||
| IncludeGlobalServiceEvents: defsecTypes.Bool(true, defsecTypes.NewTestMetadata()), | ||
| }, | ||
| }, | ||
| }, | ||
| expected: false, | ||
| }, | ||
| } | ||
| for _, test := range tests { | ||
| t.Run(test.name, func(t *testing.T) { | ||
| var testState state.State | ||
| testState.AWS.CloudTrail = test.input | ||
| results := checkIncludeGlobalServiceEvents.Evaluate(&testState) | ||
| var found bool | ||
| for _, result := range results { | ||
| if result.Status() == scan.StatusFailed && result.Rule().LongID() == checkIncludeGlobalServiceEvents.Rule().LongID() { | ||
| found = true | ||
| } | ||
| } | ||
| if test.expected { | ||
| assert.True(t, found, "Rule should have been found") | ||
| } else { | ||
| assert.False(t, found, "Rule should not have been found") | ||
| } | ||
| }) | ||
| } | ||
| } |