Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added policy to check cloudwatch_integration for cloudtrail #1072

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
13 changes: 13 additions & 0 deletions avd_docs/aws/cloudtrail/AVD-AWS-0182/docs.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@

Ensures CloudTrail logs are being properly delivered to CloudWatch

### Impact
<!-- Add Impact here -->

<!-- DO NOT CHANGE -->
{{ remediationActions }}

### Links
- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html#send-cloudtrail-events-to-cloudwatch-logs-console


5 changes: 4 additions & 1 deletion avd_docs/kubernetes/general/AVD-KSV-0107/docs.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,13 @@

apiVersion and kind has been deprecated
apiVersion '' and kind '' has been deprecated on: '' and planned for removal on:''
SanaaYousaf marked this conversation as resolved.
Show resolved Hide resolved

### Impact
<!-- Add Impact here -->

<!-- DO NOT CHANGE -->
{{ remediationActions }}

### Links
-

SanaaYousaf marked this conversation as resolved.
Show resolved Hide resolved

4 changes: 2 additions & 2 deletions avd_docs/kubernetes/general/AVD-KSV-0108/docs.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@
Services with external IP addresses allows direct access from the internet and might expose risk for CVE-2020-8554

### Impact
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
https://www.cvedetails.com/cve/CVE-2020-8554/
<!-- Add Impact here -->
SanaaYousaf marked this conversation as resolved.
Show resolved Hide resolved

SanaaYousaf marked this conversation as resolved.
Show resolved Hide resolved
<!-- DO NOT CHANGE -->
{{ remediationActions }}

Expand Down
2 changes: 1 addition & 1 deletion avd_docs/kubernetes/general/AVD-KSV-0109/docs.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
Storing secrets in configMaps is unsafe

### Impact
Unsafe storage of secret content in configMaps could lead to the information being compromised.
<!-- Add Impact here -->
SanaaYousaf marked this conversation as resolved.
Show resolved Hide resolved

<!-- DO NOT CHANGE -->
{{ remediationActions }}
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# METADATA
# title: "CloudTrail To CloudWatch"
# description: "Ensures CloudTrail logs are being properly delivered to CloudWatch"
# scope: package
# schemas:
# - input: schema.input
# related_resources:
# - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html#send-cloudtrail-events-to-cloudwatch-logs-console
# custom:
# avd_id: AVD-AWS-0182
# provider: aws
# service: cloudtrail
# severity: LOW
# short_code: ensure-cloudwatch-integration
# recommended_action: "Enable CloudTrail CloudWatch integration for all regions"
# input:
# selector:
# - type: cloud
package builtin.aws.cloudtrail.aws0182

deny[res] {
trail := input.aws.cloudtrail.trails[_]
trail.cloudwatchlogsloggrouparn.value == ""
res := result.new("Trail does not have CloudWatch logging configured", trail.cloudwatchlogsloggrouparn)
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
package builtin.aws.cloudtrail.aws0182

test_detects_when_not_configured {
r := deny with input as {"aws": {"cloudtrail": {"trails": [{"cloudwatchlogsloggrouparn": {"value": ""}}]}}}
count(r) == 1
}

test_when_configured {
r := deny with input as {"aws": {"cloudtrail": {"trails": [{"cloudwatchlogsloggrouparn": {"value": "arn:aws:logs:us-east-1:123456789012:log-group:my-log-group"}}]}}}
count(r) == 0
}