new: added policy ecc-aws-067-unauthorized_api_calls_alarm_exists

epam · Oct 15, 2023 · 96f4899 · 96f4899
1 parent 9176e9f
commit 96f4899
Show file tree

Hide file tree

Showing 20 changed files with 396 additions and 38 deletions.
diff --git a/iam/All-permissions.json b/iam/All-permissions.json
@@ -29,6 +29,7 @@
                 "cloudtrail:GetTrailStatus",
                 "cloudwatch:GetMetricStatistics",
                 "cloudwatch:DescribeAlarms",
+                "cloudwatch:DescribeAlarmsForMetric",
                 "codebuild:BatchGetProjects",
                 "codebuild:ListProjects",
                 "codedeploy:GetDeploymentGroup",

diff --git a/non-compatible-policies/ecc-aws-067-unauthorized_api_calls_alarm_exists.yml b/non-compatible-policies/ecc-aws-067-unauthorized_api_calls_alarm_exists.yml
diff --git a/policies/ecc-aws-067-unauthorized_api_calls_alarm_exists.yml b/policies/ecc-aws-067-unauthorized_api_calls_alarm_exists.yml
@@ -0,0 +1,23 @@
+# Copyright (c) 2023 EPAM Systems, Inc.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+policies:
+  - name: ecc-aws-067-unauthorized_api_calls_alarm_exists
+    comment: '010016010300'
+    description: |
+      Log metric filter and alarm do not exist for unauthorized API calls
+    resource: aws.account
+    filters:
+      - type: check-cloudtrail
+        multi-region: true
+        running: true
+        include-management-events: true
+        log-metric-filter-pattern:
+            type: value
+            op: regex
+            value: '{ ?\(? ?\(? ?((\$\.errorCode ?= ?\"?\*UnauthorizedOperation\"?)|(\$\.errorCode ?= ?\"?AccessDenied\*\"?)) ?\)? ?\|\| ?\(? ?((\$\.errorCode ?= ?\"?AccessDenied\*\"?)|(\$\.errorCode ?= ?\"?\*UnauthorizedOperation\"?)) ?\)? ?\)? ?&& ?\(? ?\(? ?((\$\.sourceIPAddress ?[!]= ?\"?delivery\.logs\.amazonaws\.com\"?)|(\$\.eventName ?[!]= ?\"?HeadBucket\"?)) ?\)? ?&& ?\(?((\$\.sourceIPAddress ?[!]= ?\"?delivery\.logs\.amazonaws\.com\"?)|(\$\.eventName ?[!]= ?\"?HeadBucket\"?)) ?\)? ?\)? ?}'
+
+
diff --git a/terraform/ecc-aws-067-unauthorized_api_calls_alarm_exists/green_full/sns.tf b/terraform/ecc-aws-067-unauthorized_api_calls_alarm_exists/green_full/sns.tf
@@ -2,17 +2,29 @@ resource "aws_sns_topic" "this" {
   name = "067-sns-green"
 }
 
-resource "null_resource" "this" {
-  provisioner "local-exec" {
-    command = join(" ", [
-      "aws sns subscribe",
-      "--topic-arn ${aws_sns_topic.this.arn}",
-      "--protocol email",
-      "--notification-endpoint ${var.test-email}",
-      "--profile ${var.profile}",
-      "--region ${var.default-region}"
+resource "aws_sqs_queue" "this" {
+  name = "067-sqs-green"
+}
+
+resource "aws_sns_topic_subscription" "this" {
+  topic_arn = aws_sns_topic.this.arn
+  protocol  = "sqs"
+  endpoint  = aws_sqs_queue.this.arn
+}
+
+# uncomment to test email notification
+
+# resource "null_resource" "this" {
+#   provisioner "local-exec" {
+#     command = join(" ", [
+#       "aws sns subscribe",
+#       "--topic-arn ${aws_sns_topic.this.arn}",
+#       "--protocol email",
+#       "--notification-endpoint ${var.test-email}",
+#       "--profile ${var.profile}",
+#       "--region ${var.default-region}"
 
-      ]
-    )
-  }
-}
+#       ]
+#     )
+#   }
+# }
diff --git a/terraform/ecc-aws-067-unauthorized_api_calls_alarm_exists/green_full/trail.tf b/terraform/ecc-aws-067-unauthorized_api_calls_alarm_exists/green_full/trail.tf
@@ -7,6 +7,14 @@ resource "aws_cloudtrail" "this" {
   cloud_watch_logs_group_arn    = "${aws_cloudwatch_log_group.this.arn}:*"
   include_global_service_events = true
   is_multi_region_trail         = true
+
+  advanced_event_selector {
+    field_selector {
+      field  = "eventCategory"
+      equals = ["Management"]
+    }
+  }
+
   depends_on = [
     aws_s3_bucket.this,
     aws_s3_bucket_policy.this

diff --git a/terraform/ecc-aws-067-unauthorized_api_calls_alarm_exists/iam/067-policy.json b/terraform/ecc-aws-067-unauthorized_api_calls_alarm_exists/iam/067-policy.json
@@ -4,15 +4,14 @@
         {
             "Effect": "Allow",
             "Action": [ 
+                "iam:ListAccountAliases",
                 "cloudtrail:DescribeTrails",
                 "cloudtrail:GetTrailStatus",
                 "cloudtrail:GetEventSelectors",
-                "sns:GetTopicAttributes",
-                "sns:ListTopics",
                 "cloudwatch:DescribeAlarms",
                 "logs:DescribeMetricFilters",
-                "logs:DescribeLogGroups",
-                "iam:ListAccountAliases"
+                "cloudwatch:DescribeAlarmsForMetric",
+                "sns:GetTopicAttributes"
             ],
             "Resource": "*"
         }

diff --git a/terraform/ecc-aws-067-unauthorized_api_calls_alarm_exists/red4/sns.tf b/terraform/ecc-aws-067-unauthorized_api_calls_alarm_exists/red4/sns.tf
@@ -1,3 +1,3 @@
-resource "aws_sns_topic" "sns" {
+resource "aws_sns_topic" "this" {
   name = "067-c7n-sns-red4"
 }
diff --git a/...ws-067-unauthorized_api_calls_alarm_exists/placebo-green/cloudtrail.DescribeTrails_1.json b/...ws-067-unauthorized_api_calls_alarm_exists/placebo-green/cloudtrail.DescribeTrails_1.json
@@ -0,0 +1,22 @@
+{
+    "status_code": 200,
+    "data": {
+        "trailList": [
+            {
+                "Name": "c7n-067-cloudtrail-green",
+                "S3BucketName": "067-bucket-7401094-green",
+                "IncludeGlobalServiceEvents": true,
+                "IsMultiRegionTrail": true,
+                "HomeRegion": "us-east-1",
+                "TrailARN": "arn:aws:cloudtrail:us-east-1:644160558196:trail/c7n-067-cloudtrail-green",
+                "LogFileValidationEnabled": false,
+                "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:644160558196:log-group:067_log_group_green:*",
+                "CloudWatchLogsRoleArn": "arn:aws:iam::644160558196:role/067_role_green",
+                "HasCustomEventSelectors": true,
+                "HasInsightSelectors": false,
+                "IsOrganizationTrail": false
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/...067-unauthorized_api_calls_alarm_exists/placebo-green/cloudtrail.GetEventSelectors_1.json b/...067-unauthorized_api_calls_alarm_exists/placebo-green/cloudtrail.GetEventSelectors_1.json
@@ -0,0 +1,19 @@
+{
+    "status_code": 200,
+    "data": {
+        "TrailARN": "arn:aws:cloudtrail:us-east-1:644160558196:trail/c7n-067-cloudtrail-green",
+        "AdvancedEventSelectors": [
+            {
+                "FieldSelectors": [
+                    {
+                        "Field": "eventCategory",
+                        "Equals": [
+                            "Management"
+                        ]
+                    }
+                ]
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/...ws-067-unauthorized_api_calls_alarm_exists/placebo-green/cloudtrail.GetTrailStatus_1.json b/...ws-067-unauthorized_api_calls_alarm_exists/placebo-green/cloudtrail.GetTrailStatus_1.json
@@ -0,0 +1,43 @@
+{
+    "status_code": 200,
+    "data": {
+        "IsLogging": true,
+        "LatestDeliveryTime": {
+            "__class__": "datetime",
+            "year": 2023,
+            "month": 10,
+            "day": 15,
+            "hour": 22,
+            "minute": 37,
+            "second": 38,
+            "microsecond": 982000
+        },
+        "StartLoggingTime": {
+            "__class__": "datetime",
+            "year": 2023,
+            "month": 10,
+            "day": 15,
+            "hour": 13,
+            "minute": 16,
+            "second": 49,
+            "microsecond": 492000
+        },
+        "LatestCloudWatchLogsDeliveryTime": {
+            "__class__": "datetime",
+            "year": 2023,
+            "month": 10,
+            "day": 15,
+            "hour": 22,
+            "minute": 38,
+            "second": 0,
+            "microsecond": 211000
+        },
+        "LatestDeliveryAttemptTime": "2023-10-15T19:37:38Z",
+        "LatestNotificationAttemptTime": "",
+        "LatestNotificationAttemptSucceeded": "",
+        "LatestDeliveryAttemptSucceeded": "2023-10-15T19:37:38Z",
+        "TimeLoggingStarted": "2023-10-15T10:16:49Z",
+        "TimeLoggingStopped": "",
+        "ResponseMetadata": {}
+    }
+}
diff --git a/...c-aws-067-unauthorized_api_calls_alarm_exists/placebo-green/iam.ListAccountAliases_1.json b/...c-aws-067-unauthorized_api_calls_alarm_exists/placebo-green/iam.ListAccountAliases_1.json
@@ -0,0 +1,10 @@
+{
+    "status_code": 200,
+    "data": {
+        "AccountAliases": [
+            "test"
+        ],
+        "IsTruncated": false,
+        "ResponseMetadata": {}
+    }
+}
diff --git a/...s-067-unauthorized_api_calls_alarm_exists/placebo-green/logs.DescribeMetricFilters_1.json b/...s-067-unauthorized_api_calls_alarm_exists/placebo-green/logs.DescribeMetricFilters_1.json
@@ -0,0 +1,22 @@
+{
+    "status_code": 200,
+    "data": {
+        "metricFilters": [
+            {
+                "filterName": "067_Unauthorized_API_Calls_green",
+                "filterPattern": "{(($.errorCode=\"*UnauthorizedOperation\") || ($.errorCode=\"AccessDenied*\")) && (($.sourceIPAddress!=\"delivery.logs.amazonaws.com\") && ($.eventName!=\"HeadBucket\"))}",
+                "metricTransformations": [
+                    {
+                        "metricName": "067_Unauthorized_API_Calls_green",
+                        "metricNamespace": "API_Calls",
+                        "metricValue": "1",
+                        "unit": "None"
+                    }
+                ],
+                "creationTime": 1697365001970,
+                "logGroupName": "067_log_group_green"
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/...authorized_api_calls_alarm_exists/placebo-green/monitoring.DescribeAlarmsForMetric_1.json b/...authorized_api_calls_alarm_exists/placebo-green/monitoring.DescribeAlarmsForMetric_1.json
@@ -0,0 +1,60 @@
+{
+    "status_code": 200,
+    "data": {
+        "MetricAlarms": [
+            {
+                "AlarmName": "067_Unauthorized_API_Calls_green",
+                "AlarmArn": "arn:aws:cloudwatch:us-east-1:644160558196:alarm:067_Unauthorized_API_Calls_green",
+                "AlarmConfigurationUpdatedTimestamp": {
+                    "__class__": "datetime",
+                    "year": 2023,
+                    "month": 10,
+                    "day": 15,
+                    "hour": 10,
+                    "minute": 16,
+                    "second": 43,
+                    "microsecond": 353000
+                },
+                "ActionsEnabled": true,
+                "OKActions": [],
+                "AlarmActions": [
+                    "arn:aws:sns:us-east-1:644160558196:067-sns-green"
+                ],
+                "InsufficientDataActions": [],
+                "StateValue": "INSUFFICIENT_DATA",
+                "StateReason": "Insufficient Data: 1 datapoint was unknown.",
+                "StateReasonData": "{\"version\":\"1.0\",\"queryDate\":\"2023-10-15T19:34:23.797+0000\",\"statistic\":\"Sum\",\"period\":300,\"recentDatapoints\":[],\"threshold\":1.0,\"evaluatedDatapoints\":[{\"timestamp\":\"2023-10-15T19:29:00.000+0000\"}]}",
+                "StateUpdatedTimestamp": {
+                    "__class__": "datetime",
+                    "year": 2023,
+                    "month": 10,
+                    "day": 15,
+                    "hour": 19,
+                    "minute": 34,
+                    "second": 23,
+                    "microsecond": 799000
+                },
+                "MetricName": "067_Unauthorized_API_Calls_green",
+                "Namespace": "API_Calls",
+                "Statistic": "Sum",
+                "Dimensions": [],
+                "Period": 300,
+                "EvaluationPeriods": 1,
+                "Threshold": 1.0,
+                "ComparisonOperator": "GreaterThanOrEqualToThreshold",
+                "TreatMissingData": "missing",
+                "StateTransitionedTimestamp": {
+                    "__class__": "datetime",
+                    "year": 2023,
+                    "month": 10,
+                    "day": 15,
+                    "hour": 19,
+                    "minute": 34,
+                    "second": 23,
+                    "microsecond": 799000
+                }
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/...c-aws-067-unauthorized_api_calls_alarm_exists/placebo-green/sns.GetTopicAttributes_1.json b/...c-aws-067-unauthorized_api_calls_alarm_exists/placebo-green/sns.GetTopicAttributes_1.json
@@ -0,0 +1,21 @@
+{
+    "status_code": 200,
+    "data": {
+        "Attributes": {
+            "Policy": "{\"Version\":\"2008-10-17\",\"Id\":\"__default_policy_ID\",\"Statement\":[{\"Sid\":\"__default_statement_ID\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"*\"},\"Action\":[\"SNS:GetTopicAttributes\",\"SNS:SetTopicAttributes\",\"SNS:AddPermission\",\"SNS:RemovePermission\",\"SNS:DeleteTopic\",\"SNS:Subscribe\",\"SNS:ListSubscriptionsByTopic\",\"SNS:Publish\"],\"Resource\":\"arn:aws:sns:us-east-1:644160558196:067-sns-green\",\"Condition\":{\"StringEquals\":{\"AWS:SourceOwner\":\"644160558196\"}}}]}",
+            "LambdaSuccessFeedbackSampleRate": "0",
+            "Owner": "644160558196",
+            "SubscriptionsPending": "0",
+            "TopicArn": "arn:aws:sns:us-east-1:644160558196:067-sns-green",
+            "EffectiveDeliveryPolicy": "{\"http\":{\"defaultHealthyRetryPolicy\":{\"minDelayTarget\":20,\"maxDelayTarget\":20,\"numRetries\":3,\"numMaxDelayRetries\":0,\"numNoDelayRetries\":0,\"numMinDelayRetries\":0,\"backoffFunction\":\"linear\"},\"disableSubscriptionOverrides\":false,\"defaultRequestPolicy\":{\"headerContentType\":\"text/plain; charset=UTF-8\"}}}",
+            "FirehoseSuccessFeedbackSampleRate": "0",
+            "SubscriptionsConfirmed": "2",
+            "SQSSuccessFeedbackSampleRate": "0",
+            "HTTPSuccessFeedbackSampleRate": "0",
+            "ApplicationSuccessFeedbackSampleRate": "0",
+            "DisplayName": "",
+            "SubscriptionsDeleted": "0"
+        },
+        "ResponseMetadata": {}
+    }
+}
diff --git a/...-aws-067-unauthorized_api_calls_alarm_exists/placebo-red/cloudtrail.DescribeTrails_1.json b/...-aws-067-unauthorized_api_calls_alarm_exists/placebo-red/cloudtrail.DescribeTrails_1.json
@@ -0,0 +1,22 @@
+{
+    "status_code": 200,
+    "data": {
+        "trailList": [
+            {
+                "Name": "c7n-067-cloudtrail-red1",
+                "S3BucketName": "067-bucket-552812-red1",
+                "IncludeGlobalServiceEvents": true,
+                "IsMultiRegionTrail": false,
+                "HomeRegion": "us-east-1",
+                "TrailARN": "arn:aws:cloudtrail:us-east-1:644160558196:trail/c7n-067-cloudtrail-red1",
+                "LogFileValidationEnabled": false,
+                "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:644160558196:log-group:067_log_group_red1:*",
+                "CloudWatchLogsRoleArn": "arn:aws:iam::644160558196:role/067_role_red1",
+                "HasCustomEventSelectors": false,
+                "HasInsightSelectors": false,
+                "IsOrganizationTrail": false
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/...s-067-unauthorized_api_calls_alarm_exists/placebo-red/cloudtrail.GetEventSelectors_1.json b/...s-067-unauthorized_api_calls_alarm_exists/placebo-red/cloudtrail.GetEventSelectors_1.json
@@ -0,0 +1,15 @@
+{
+    "status_code": 200,
+    "data": {
+        "TrailARN": "arn:aws:cloudtrail:us-east-1:644160558196:trail/c7n-067-cloudtrail-red1",
+        "EventSelectors": [
+            {
+                "ReadWriteType": "All",
+                "IncludeManagementEvents": true,
+                "DataResources": [],
+                "ExcludeManagementEventSources": []
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}