Skip to content

Commit 8fd18d9

Browse files
cyphronixcyphronix
authored
Merge pull request #134 from justin-kontny/main
added NIST Security Standard
2 parents 6213e01 + fcf1358 commit 8fd18d9

File tree

7 files changed

+93
-5
lines changed

7 files changed

+93
-5
lines changed

‎CHANGELOG.md

+10-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6-
- [2022-01-19](#2022-01-19)
6+
- [2023-04-10](#2023-04-10)
7+
- [2023-01-19](#2023-01-19)
78
- [2022-12-02](#2022-12-02)
89
- [2022-09-15](#2022-09-15)
910
- [2022-07-29](#2022-07-29)
@@ -33,7 +34,14 @@
3334
All notable changes to this project will be documented in this file.
3435

3536
---
36-
## 2022-01-19
37+
## 2023-04-10
38+
39+
### Changed<!-- omit in toc -->
40+
41+
- Added NIST Security Standard to Security Hub solution [Security Hub Organization](aws_sra_examples/solutions/securityhub/securityhub_org)
42+
---
43+
44+
## 2023-01-19
3745

3846
### Changed<!-- omit in toc -->
3947

‎aws_sra_examples/solutions/securityhub/securityhub_org/customizations_for_aws_control_tower/manifest-v2.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ resources:
2727
parameter_value: ''
2828
- parameter_key: pEnablePCIStandard
2929
parameter_value: 'false'
30+
- parameter_key: pEnableNISTStandard
31+
parameter_value: 'false'
3032
- parameter_key: pEnableSecurityBestPracticesStandard
3133
parameter_value: 'true'
3234
- parameter_key: pLambdaLogGroupKmsKey

‎aws_sra_examples/solutions/securityhub/securityhub_org/lambda/src/app.py

+4
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,11 @@ def get_standards_dictionary(params: dict) -> dict:
6767
"SecurityBestPracticesVersion": params["SECURITY_BEST_PRACTICES_VERSION"],
6868
"CISVersion": params["CIS_VERSION"],
6969
"PCIVersion": params["PCI_VERSION"],
70+
"NISTVersion": params["NIST_VERSION"],
7071
"StandardsToEnable": {
7172
"cis": params["ENABLE_CIS_STANDARD"] == "true",
7273
"pci": params["ENABLE_PCI_STANDARD"] == "true",
74+
"nist": params["ENABLE_NIST_STANDARD"] == "true",
7375
"sbp": params["ENABLE_SECURITY_BEST_PRACTICES_STANDARD"] == "true",
7476
},
7577
}
@@ -296,6 +298,7 @@ def get_validated_parameters(event: Dict[str, Any]) -> dict:
296298
params.update(parameter_pattern_validator("DISABLE_SECURITY_HUB", os.environ.get("DISABLE_SECURITY_HUB"), pattern=true_false_pattern))
297299
params.update(parameter_pattern_validator("ENABLE_CIS_STANDARD", os.environ.get("ENABLE_CIS_STANDARD"), pattern=true_false_pattern))
298300
params.update(parameter_pattern_validator("ENABLE_PCI_STANDARD", os.environ.get("ENABLE_PCI_STANDARD"), pattern=true_false_pattern))
301+
params.update(parameter_pattern_validator("ENABLE_NIST_STANDARD", os.environ.get("ENABLE_NIST_STANDARD"), pattern=true_false_pattern))
299302
params.update(
300303
parameter_pattern_validator(
301304
"ENABLE_SECURITY_BEST_PRACTICES_STANDARD", os.environ.get("ENABLE_SECURITY_BEST_PRACTICES_STANDARD"), pattern=true_false_pattern
@@ -306,6 +309,7 @@ def get_validated_parameters(event: Dict[str, Any]) -> dict:
306309
)
307310
params.update(parameter_pattern_validator("MANAGEMENT_ACCOUNT_ID", os.environ.get("MANAGEMENT_ACCOUNT_ID"), pattern=r"^\d{12}$"))
308311
params.update(parameter_pattern_validator("PCI_VERSION", os.environ.get("PCI_VERSION"), pattern=version_pattern))
312+
params.update(parameter_pattern_validator("NIST_VERSION", os.environ.get("NIST_VERSION"), pattern=version_pattern))
309313
params.update(
310314
parameter_pattern_validator("REGION_LINKING_MODE", os.environ.get("REGION_LINKING_MODE"), pattern=r"^ALL_REGIONS|SPECIFIED_REGIONS$")
311315
)

‎aws_sra_examples/solutions/securityhub/securityhub_org/lambda/src/securityhub.py

+21-3
Original file line numberDiff line numberDiff line change
@@ -258,6 +258,7 @@ def enable_account_securityhub(account_id: str, regions: list, configuration_rol
258258
standards_user_input["SecurityBestPracticesVersion"],
259259
standards_user_input["CISVersion"],
260260
standards_user_input["PCIVersion"],
261+
standards_user_input["NISTVersion"],
261262
)
262263
securityhub_client: SecurityHubClient = account_session.client("securityhub", region, config=BOTO3_CONFIG)
263264

@@ -333,13 +334,22 @@ def configure_member_account(account_id: str, configuration_role_name: str, regi
333334
standards_user_input["SecurityBestPracticesVersion"],
334335
standards_user_input["CISVersion"],
335336
standards_user_input["PCIVersion"],
337+
standards_user_input["NISTVersion"],
336338
)
337339
config_client: ConfigServiceClient = account_session.client("config", region, config=BOTO3_CONFIG)
338340
if is_config_enabled(config_client):
339341
process_standards(securityhub_client, standard_dict, standards_user_input["StandardsToEnable"])
340342

341343

342-
def get_standard_dictionary(account_id: str, region: str, aws_partition: str, sbp_version: str, cis_version: str, pci_version: str) -> dict:
344+
def get_standard_dictionary(
345+
account_id: str,
346+
region: str,
347+
aws_partition: str,
348+
sbp_version: str,
349+
cis_version: str,
350+
pci_version: str,
351+
nist_version: str,
352+
) -> dict:
343353
"""Get Standard ARNs.
344354
345355
Args:
@@ -349,6 +359,7 @@ def get_standard_dictionary(account_id: str, region: str, aws_partition: str, sb
349359
sbp_version: AWS Security Best Practices Standard Version
350360
cis_version: CIS Standard Version
351361
pci_version: PCI Standard Version
362+
nist_version: NIST Standard
352363
353364
Returns:
354365
Standard ARN Dictionary
@@ -370,6 +381,12 @@ def get_standard_dictionary(account_id: str, region: str, aws_partition: str, sb
370381
"standard_arn": f"arn:{aws_partition}:securityhub:{region}::standards/pci-dss/v/{pci_version}",
371382
"subscription_arn": f"arn:{aws_partition}:securityhub:{region}:{account_id}:subscription/pci-dss/v/{pci_version}",
372383
},
384+
"nist": {
385+
"name": "National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5",
386+
"enabled": False,
387+
"standard_arn": f"arn:{aws_partition}:securityhub:{region}::standards/nist-800-53/v/{nist_version}",
388+
"subscription_arn": f"arn:{aws_partition}:securityhub:{region}:{account_id}:subscription/nist-800-53/v/{nist_version}",
389+
},
373390
"sbp": {
374391
"name": "AWS Foundational Security Best Practices Standard",
375392
"enabled": False,
@@ -437,7 +454,8 @@ def get_current_enabled_standards(securityhub_client: SecurityHubClient, standar
437454
standard_dict["cis"]["enabled"] = True
438455
if standard_dict["pci"]["standard_arn"] == item["StandardsArn"]:
439456
standard_dict["pci"]["enabled"] = True
440-
457+
if standard_dict["nist"]["standard_arn"] == item["StandardsArn"]:
458+
standard_dict["nist"]["enabled"] = True
441459
return standard_dict
442460

443461

@@ -510,7 +528,7 @@ def process_standard(securityhub_client: SecurityHubClient, standards_to_enable:
510528
else:
511529
LOGGER.info(f"{standard_definition['name']} is already disabled")
512530
except securityhub_client.exceptions.InvalidInputException:
513-
LOGGER.error("Retry after the standard is no longer in pending state.")
531+
LOGGER.error("InvalidInputException while enabling or disabling standard")
514532
return True
515533

516534

‎aws_sra_examples/solutions/securityhub/securityhub_org/templates/sra-securityhub-org-configuration.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,11 @@ Metadata:
3838
- pRegionLinkingMode
3939
- pEnableCISStandard
4040
- pEnablePCIStandard
41+
- pEnableNISTStandard
4142
- pEnableSecurityBestPracticesStandard
4243
- pCISStandardVersion
4344
- pPCIStandardVersion
45+
- pNISTStandardVersion
4446
- pSecurityBestPracticesStandardVersion
4547

4648
- Label:
@@ -77,6 +79,8 @@ Metadata:
7779
default: Enable CIS Standard
7880
pEnablePCIStandard:
7981
default: Enable PCI Standard
82+
pEnableNISTStandard:
83+
default: Enable NIST Standard
8084
pEnableSecurityBestPracticesStandard:
8185
default: Enable AWS Foundational Security Best Practices Standard
8286
pEnabledRegions:
@@ -93,6 +97,8 @@ Metadata:
9397
default: Organization ID
9498
pPCIStandardVersion:
9599
default: PCI Standard Version
100+
pNISTStandardVersion:
101+
default: NIST Standard Version
96102
pRegionLinkingMode:
97103
default: Region Linking Mode
98104
pSecurityBestPracticesStandardVersion:
@@ -168,6 +174,11 @@ Parameters:
168174
Default: 'false'
169175
Description: Indicates whether to enable the Payment Card Industry Data Security Standard (PCI DSS).
170176
Type: String
177+
pEnableNISTStandard:
178+
AllowedValues: ['true', 'false']
179+
Default: 'false'
180+
Description: Indicates whether to enable the National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5.
181+
Type: String
171182
pEnableSecurityBestPracticesStandard:
172183
AllowedValues: ['true', 'false']
173184
Default: 'true'
@@ -184,6 +195,11 @@ Parameters:
184195
Default: 3.2.1
185196
Description: PCI Standard Version
186197
Type: String
198+
pNISTStandardVersion:
199+
AllowedValues: [5.0.0]
200+
Default: 5.0.0
201+
Description: NIST Standard Version
202+
Type: String
187203
pSecurityBestPracticesStandardVersion:
188204
AllowedValues: [1.0.0]
189205
Default: 1.0.0
@@ -488,10 +504,12 @@ Resources:
488504
ENABLED_REGIONS: !Ref pEnabledRegions
489505
ENABLE_CIS_STANDARD: !Ref pEnableCISStandard
490506
ENABLE_PCI_STANDARD: !Ref pEnablePCIStandard
507+
ENABLE_NIST_STANDARD: !Ref pEnableNISTStandard
491508
ENABLE_SECURITY_BEST_PRACTICES_STANDARD: !Ref pEnableSecurityBestPracticesStandard
492509
HOME_REGION: !Ref AWS::Region
493510
MANAGEMENT_ACCOUNT_ID: !Ref AWS::AccountId
494511
PCI_VERSION: !Ref pPCIStandardVersion
512+
NIST_VERSION: !Ref pNISTStandardVersion
495513
REGION_LINKING_MODE: !Ref pRegionLinkingMode
496514
SECURITY_BEST_PRACTICES_VERSION: !Ref pSecurityBestPracticesStandardVersion
497515
SNS_TOPIC_ARN: !Ref rSecurityHubOrgTopic
@@ -512,8 +530,10 @@ Resources:
512530
ENABLED_REGIONS: !Ref pEnabledRegions
513531
ENABLE_CIS_STANDARD: !Ref pEnableCISStandard
514532
ENABLE_PCI_STANDARD: !Ref pEnablePCIStandard
533+
ENABLE_NIST_STANDARD: !Ref pEnableNISTStandard
515534
ENABLE_SECURITY_BEST_PRACTICES_STANDARD: !Ref pEnableSecurityBestPracticesStandard
516535
PCI_VERSION: !Ref pPCIStandardVersion
536+
NIST_VERSION: !Ref pNISTStandardVersion
517537
REGION_LINKING_MODE: !Ref pRegionLinkingMode
518538
SECURITY_BEST_PRACTICES_VERSION: !Ref pSecurityBestPracticesStandardVersion
519539
SNS_TOPIC_ARN: !Ref rSecurityHubOrgTopic

‎aws_sra_examples/solutions/securityhub/securityhub_org/templates/sra-securityhub-org-main-ssm.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ Metadata:
3434
- pEnableCISStandard
3535
- pCISStandardVersion
3636
- pEnablePCIStandard
37+
- pEnableNISTStandard
38+
- pNISTStandardVersion
3739
- pRegionLinkingMode
3840
- pControlTowerRegionsOnly
3941
- pEnabledRegions
@@ -68,6 +70,8 @@ Metadata:
6870
default: Enable CIS Standard
6971
pEnablePCIStandard:
7072
default: Enable PCI Standard
73+
pEnableNISTStandard:
74+
default: Enable NIST Standard
7175
pEnableSecurityBestPracticesStandard:
7276
default: Enable AWS Foundational Security Best Practices Standard
7377
pEnabledRegions:
@@ -78,6 +82,8 @@ Metadata:
7882
default: Lambda Log Group Retention
7983
pLambdaLogLevel:
8084
default: Lambda Log Level
85+
pNISTStandardVersion:
86+
default: NIST Standard Version
8187
pOrganizationId:
8288
default: Organization ID
8389
pRegionLinkingMode:
@@ -150,6 +156,11 @@ Parameters:
150156
Default: 'false'
151157
Description: Indicates whether to enable the Payment Card Industry Data Security Standard (PCI DSS).
152158
Type: String
159+
pEnableNISTStandard:
160+
AllowedValues: ['true', 'false']
161+
Default: 'false'
162+
Description: Indicates whether to enable the National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5.
163+
Type: String
153164
pEnableSecurityBestPracticesStandard:
154165
AllowedValues: ['true', 'false']
155166
Default: 'true'
@@ -173,6 +184,11 @@ Parameters:
173184
Default: INFO
174185
Description: Lambda Function Logging Level
175186
Type: String
187+
pNISTStandardVersion:
188+
AllowedValues: [5.0.0]
189+
Default: 5.0.0
190+
Description: NIST Standard Version
191+
Type: String
176192
pOrganizationId:
177193
AllowedPattern: '^([\w.-]{1,900})$|^(\/[\w.-]{1,900})*[\w.-]{1,900}$'
178194
ConstraintDescription:
@@ -295,11 +311,13 @@ Resources:
295311
pDisableSecurityHub: !Ref pDisableSecurityHub
296312
pEnableCISStandard: !Ref pEnableCISStandard
297313
pEnablePCIStandard: !Ref pEnablePCIStandard
314+
pEnableNISTStandard: !Ref pEnableNISTStandard
298315
pEnableSecurityBestPracticesStandard: !Ref pEnableSecurityBestPracticesStandard
299316
pEnabledRegions: !Ref pEnabledRegions
300317
pLambdaLogGroupKmsKey: !Ref pLambdaLogGroupKmsKey
301318
pLambdaLogGroupRetention: !Ref pLambdaLogGroupRetention
302319
pLambdaLogLevel: !Ref pLambdaLogLevel
320+
pNISTStandardVersion: !Ref pNISTStandardVersion
303321
pOrganizationId: !Ref pOrganizationId
304322
pRegionLinkingMode: !Ref pRegionLinkingMode
305323
pSRAAlarmEmail: !Ref pSRAAlarmEmail

‎aws_sra_examples/solutions/securityhub/securityhub_org/templates/sra-securityhub-org-main.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,11 @@ Metadata:
3333
- pEnableCISStandard
3434
- pCISStandardVersion
3535
- pEnablePCIStandard
36+
- pEnableNISTStandard
3637
- pRegionLinkingMode
3738
- pControlTowerRegionsOnly
3839
- pEnabledRegions
40+
- pNISTStandardVersion
3941

4042
- Label:
4143
default: General Lambda Function Properties
@@ -67,6 +69,8 @@ Metadata:
6769
default: Enable CIS Standard
6870
pEnablePCIStandard:
6971
default: Enable PCI Standard
72+
pEnableNISTStandard:
73+
default: Enable NIST Standard
7074
pEnableSecurityBestPracticesStandard:
7175
default: Enable AWS Foundational Security Best Practices Standard
7276
pEnabledRegions:
@@ -77,6 +81,8 @@ Metadata:
7781
default: Lambda Log Group Retention
7882
pLambdaLogLevel:
7983
default: Lambda Log Level
84+
pNISTStandardVersion:
85+
default: NIST Standard Version
8086
pOrganizationId:
8187
default: Organization ID
8288
pRegionLinkingMode:
@@ -146,6 +152,11 @@ Parameters:
146152
Default: 'false'
147153
Description: Indicates whether to enable the Payment Card Industry Data Security Standard (PCI DSS).
148154
Type: String
155+
pEnableNISTStandard:
156+
AllowedValues: ['true', 'false']
157+
Default: 'false'
158+
Description: Indicates whether to enable the National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5.
159+
Type: String
149160
pEnableSecurityBestPracticesStandard:
150161
AllowedValues: ['true', 'false']
151162
Default: 'true'
@@ -169,6 +180,11 @@ Parameters:
169180
Default: INFO
170181
Description: Lambda Function Logging Level
171182
Type: String
183+
pNISTStandardVersion:
184+
AllowedValues: [5.0.0]
185+
Default: 5.0.0
186+
Description: NIST Standard Version
187+
Type: String
172188
pOrganizationId:
173189
AllowedPattern: '^([\w.-]{1,900})$|^(\/[\w.-]{1,900})*[\w.-]{1,900}$'
174190
ConstraintDescription:
@@ -281,11 +297,13 @@ Resources:
281297
pDisableSecurityHub: !Ref pDisableSecurityHub
282298
pEnableCISStandard: !Ref pEnableCISStandard
283299
pEnablePCIStandard: !Ref pEnablePCIStandard
300+
pEnableNISTStandard: !Ref pEnableNISTStandard
284301
pEnableSecurityBestPracticesStandard: !Ref pEnableSecurityBestPracticesStandard
285302
pEnabledRegions: !Ref pEnabledRegions
286303
pLambdaLogGroupKmsKey: !Ref pLambdaLogGroupKmsKey
287304
pLambdaLogGroupRetention: !Ref pLambdaLogGroupRetention
288305
pLambdaLogLevel: !Ref pLambdaLogLevel
306+
pNISTStandardVersion: !Ref pNISTStandardVersion
289307
pOrganizationId: !Ref pOrganizationId
290308
pRegionLinkingMode: !Ref pRegionLinkingMode
291309
pSRAAlarmEmail: !Ref pSRAAlarmEmail

0 commit comments

Comments
 (0)