Skip to content

Commit aa58485

Browse files
IevIeievgeniia ieromenko
IevIe
and
ievgeniia ieromenko
authored
Adding GuardDuty RunTime Monitoring feature (#213)
* adding runtime monitoring feature * json error fix * adding ec2 agent management feature * flake8 fixes * more linting fixes * updated changelog * ami bakery linting fixes * ami bakery isort linting fixes --------- Co-authored-by: ievgeniia ieromenko <[email protected]>
1 parent 1a1d1c0 commit aa58485

File tree

12 files changed

+370
-251
lines changed

12 files changed

+370
-251
lines changed

‎CHANGELOG.md

+11
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
## Table of Contents<!-- omit in toc -->
44

55
- [Introduction](#introduction)
6+
- [2024-05-03](#2024-05-03)
7+
- [2024-04-15](#2024-04-15)
68
- [2024-02-12](#2024-02-12)
79
- [2024-02-09](#2024-02-09)
810
- [2024-01-29](#2024-01-29)
@@ -51,6 +53,15 @@
5153
All notable changes to this project will be documented in this file.
5254

5355
---
56+
## 2024-05-03
57+
58+
- Updated [GuardDuty Organization](aws_sra_examples/solutions/guardduty/guardduty_org) solution to add Runtime Monitoring protection.
59+
- Updated [GuardDuty Organization](aws_sra_examples/solutions/guardduty/guardduty_org) solution default setting to deploy in all enabled regions.
60+
61+
## 2024-04-15
62+
63+
- Updated [Common CFCT Setup](aws_sra_examples/solutions/common/common_cfct_setup) solution to download the latest CfCT template.
64+
5465
## 2024-02-12
5566

5667
- Added [AMI Bakery](aws_sra_examples/solutions/ami_bakery/ami_bakery_org) solution for AMI image management.

‎aws_sra_examples/easy_setup/customizations_for_aws_control_tower/manifest.yaml

+9-1
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,10 @@ resources:
143143
# GuardDuty Solution
144144
- parameter_key: pDisableGuardDuty
145145
parameter_value: 'No'
146+
- parameter_key: pGuardDutyCustomerGovernedRegionsOnly
147+
parameter_value: 'false'
148+
- parameter_key: pGuardDutyEnabledRegions
149+
parameter_value: ''
146150
- parameter_key: pAutoEnableS3Logs
147151
parameter_value: 'true'
148152
- parameter_key: pAutoEnableKubernetesAuditLogs
@@ -151,10 +155,14 @@ resources:
151155
parameter_value: 'true'
152156
- parameter_key: pEnableRdsLoginEvents
153157
parameter_value: 'true'
154-
- parameter_key: pEnableEksRuntimeMonitoring
158+
- parameter_key: pEnableRuntimeMonitoring
155159
parameter_value: 'true'
156160
- parameter_key: pEnableEksAddonManagement
157161
parameter_value: 'true'
162+
- parameter_key: pEnableEcsFargateAgentManagement
163+
parameter_value: 'true'
164+
- parameter_key: pEnableEc2AgentManagement
165+
parameter_value: 'true'
158166
- parameter_key: pEnableLambdaNetworkLogs
159167
parameter_value: 'true'
160168
- parameter_key: pGuardDutyFindingPublishingFrequency

‎aws_sra_examples/easy_setup/templates/sra-easy-setup.yaml

+57-6
Original file line numberDiff line numberDiff line change
@@ -146,16 +146,21 @@ Metadata:
146146
default: GuardDuty Solution
147147
Parameters:
148148
- pDisableGuardDuty
149+
- pGuardDutyCustomerGovernedRegionsOnly
150+
- pGuardDutyEnabledRegions
149151
- pAutoEnableS3Logs
150152
- pAutoEnableKubernetesAuditLogs
151153
- pAutoEnableMalwareProtection
152154
- pEnableRdsLoginEvents
153-
- pEnableEksRuntimeMonitoring
155+
- pEnableRuntimeMonitoring
154156
- pEnableEksAddonManagement
157+
- pEnableEcsFargateAgentManagement
158+
- pEnableEc2AgentManagement
155159
- pEnableLambdaNetworkLogs
156160
- pGuardDutyFindingPublishingFrequency
157161
- pGuardDutyOrgDeliveryBucketPrefix
158162
- pGuardDutyOrgDeliveryKeyAlias
163+
159164
- Label:
160165
default: IAM Access Analyzer Solution
161166
Parameters:
@@ -316,10 +321,14 @@ Metadata:
316321
default: Auto Enable Malware Protection
317322
pEnableRdsLoginEvents:
318323
default: Auto enable RDS Login Events
319-
pEnableEksRuntimeMonitoring:
320-
default: Auto enable EKS Runtime Monitoring
324+
pEnableRuntimeMonitoring:
325+
default: Auto enable Runtime Monitoring
321326
pEnableEksAddonManagement:
322327
default: Auto enable EKS Add-on Management
328+
pEnableEcsFargateAgentManagement:
329+
default: Auto enable ECS Fargate Agent Management
330+
pEnableEc2AgentManagement:
331+
default: Auto enable EC2 Agent Management
323332
pEnableLambdaNetworkLogs:
324333
default: Auto enable Lambda Network Logs
325334
pBillingContactAction:
@@ -422,6 +431,10 @@ Metadata:
422431
default: (Optional) Exclude EC2 Default EBS Encryption Tags
423432
pExcludeS3BlockAccountPublicAccessTags:
424433
default: (Optional) Exclude S3 Block Account Public Access Tags
434+
pGuardDutyCustomerGovernedRegionsOnly:
435+
default: Enable GuardDuty in Customer Governed Regions Only
436+
pGuardDutyEnabledRegions:
437+
default: (Optional) Enabled Regions
425438
pFrequency:
426439
default: Frequency
427440
pGuarddutyEnabledForMoreThan48Hours:
@@ -753,16 +766,26 @@ Parameters:
753766
Default: 'true'
754767
Description: Auto enable RDS Login Events
755768
Type: String
756-
pEnableEksRuntimeMonitoring:
769+
pEnableRuntimeMonitoring:
757770
AllowedValues: ['true', 'false']
758771
Default: 'true'
759-
Description: Auto enable EKS Runtime Monitoring
772+
Description: Auto enable Runtime Monitoring
760773
Type: String
761774
pEnableEksAddonManagement:
762775
AllowedValues: ['true', 'false']
763776
Default: 'true'
764777
Description: Auto enable EKS Add-on Management
765778
Type: String
779+
pEnableEcsFargateAgentManagement:
780+
AllowedValues: ['true', 'false']
781+
Default: 'true'
782+
Description: Auto enable ECS Fargate Agent Management
783+
Type: String
784+
pEnableEc2AgentManagement:
785+
AllowedValues: ['true', 'false']
786+
Default: 'true'
787+
Description: Auto enable EC2 Agent Management
788+
Type: String
766789
pEnableLambdaNetworkLogs:
767790
AllowedValues: ['true', 'false']
768791
Default: 'true'
@@ -1058,6 +1081,21 @@ Parameters:
10581081
'(Optional) Resource Tags that denote an Account should be excluded from this solution in JSON format: [{"Key": "string", "Value": "string"},
10591082
... ]. For example, [{"Key": "exclude-s3-block-account-public-access", "Value": "true"}].'
10601083
Type: String
1084+
pGuardDutyCustomerGovernedRegionsOnly:
1085+
AllowedValues: ['true', 'false']
1086+
Default: 'false'
1087+
Description: Indicates whether to enable GuardDuty in the customer's Goverened Regions only. Example - Control Tower regions, or Common Prerequisites regions.
1088+
Type: String
1089+
pGuardDutyEnabledRegions:
1090+
AllowedPattern: '^$|^([a-z0-9-]{1,64})$|^(([a-z0-9-]{1,64},)*[a-z0-9-]{1,64})$'
1091+
ConstraintDescription:
1092+
Only lowercase letters, numbers, and hyphens ('-') allowed. (e.g. us-east-1) Additional AWS regions can be provided, separated by commas. (e.g.
1093+
us-east-1,ap-southeast-2)
1094+
Default: ''
1095+
Description:
1096+
(Optional) Enabled regions (AWS regions, separated by commas).
1097+
Type: String
1098+
10611099
pFrequency:
10621100
AllowedValues: [1hour, 3hours, 6hours, 12hours, 24hours]
10631101
Default: 1hour
@@ -1704,6 +1742,15 @@ Rules:
17041742
Assertions:
17051743
- AssertDescription: "'Resource Types' parameter is required if 'All Supported' parameter is set to 'false'."
17061744
Assert: !Not [!Equals [!Ref pResourceTypes, '']]
1745+
CheckGuardDutyRuntimeEnabled:
1746+
RuleCondition: !Equals [!Ref pEnableRuntimeMonitoring, 'false']
1747+
Assertions:
1748+
- Assert: !Not [!Equals [!Ref pEnableEksAddonManagement, 'true']]
1749+
AssertDescription: "'Enable EKS Addon Management' requires Guardduty Runtime Monitoring to be enabled"
1750+
- Assert: !Not [!Equals [!Ref pEnableEcsFargateAgentManagement, 'true']]
1751+
AssertDescription: "'Enable Ecs Fargate Agent Management' requires Guardduty Runtime Monitoring to be enabled"
1752+
- Assert: !Not [!Equals [!Ref pEnableEc2AgentManagement, 'true']]
1753+
AssertDescription: "'Enable Ec2 Agent Management' requires Guardduty Runtime Monitoring to be enabled"
17071754

17081755
Conditions:
17091756
cUsingKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
@@ -2401,8 +2448,12 @@ Resources:
24012448
pAutoEnableKubernetesAuditLogs: !Ref pAutoEnableKubernetesAuditLogs
24022449
pAutoEnableMalwareProtection: !Ref pAutoEnableMalwareProtection
24032450
pEnableRdsLoginEvents: !Ref pEnableRdsLoginEvents
2404-
pEnableEksRuntimeMonitoring: !Ref pEnableEksRuntimeMonitoring
2451+
pControlTowerRegionsOnly: !Ref pGuardDutyCustomerGovernedRegionsOnly
2452+
pEnabledRegions: !Ref pGuardDutyEnabledRegions
2453+
pEnableRuntimeMonitoring: !Ref pEnableRuntimeMonitoring
24052454
pEnableEksAddonManagement: !Ref pEnableEksAddonManagement
2455+
pEnableEcsFargateAgentManagement: !Ref pEnableEcsFargateAgentManagement
2456+
pEnableEc2AgentManagement: !Ref pEnableEc2AgentManagement
24062457
pEnableLambdaNetworkLogs: !Ref pEnableLambdaNetworkLogs
24072458
pCreateLambdaLogGroup: !If [cCreateLambdaLogGroup, true, false]
24082459
pDisableGuardDuty: !If [cDisableGuardDuty, true, false]

‎aws_sra_examples/modules/guardduty-org-module/templates/sra-guardduty-org-module-main.yaml

+56-6
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,15 @@ Metadata:
5353
default: GuardDuty
5454
Parameters:
5555
- pDisableGuardDuty
56+
- pControlTowerRegionsOnly
57+
- pEnabledRegions
5658
- pAutoEnableS3Logs
5759
- pAutoEnableKubernetesAuditLogs
5860
- pAutoEnableMalwareProtection
5961
- pEnableRdsLoginEvents
60-
- pEnableEksRuntimeMonitoring
62+
- pEnableRuntimeMonitoring
63+
- pEnableEcsFargateAgentManagement
64+
- pEnableEc2AgentManagement
6165
- pEnableEksAddonManagement
6266
- pEnableLambdaNetworkLogs
6367
- pGuardDutyFindingPublishingFrequency
@@ -119,10 +123,14 @@ Metadata:
119123
default: pAutoEnableMalwareProtection
120124
pEnableRdsLoginEvents:
121125
default: pEnableRdsLoginEvents
122-
pEnableEksRuntimeMonitoring:
123-
default: pEnableEksRuntimeMonitoring
126+
pEnableRuntimeMonitoring:
127+
default: pEnableRuntimeMonitoring
124128
pEnableEksAddonManagement:
125129
default: pEnableEksAddonManagement
130+
pEnableEcsFargateAgentManagement:
131+
default: Auto enable ECS Fargate Agent Management
132+
pEnableEc2AgentManagement:
133+
default: Auto enable EC2 Agent Management
126134
pEnableLambdaNetworkLogs:
127135
default: pEnableLambdaNetworkLogs
128136
pGuardDutyFindingPublishingFrequency:
@@ -133,6 +141,10 @@ Metadata:
133141
default: pGuardDutyOrgDeliveryKeyAlias
134142
pCreateAWSControlTowerExecutionRole:
135143
default: Create AWS Control Tower Execution Role
144+
pControlTowerRegionsOnly:
145+
default: Control Tower Regions Only
146+
pEnabledRegions:
147+
default: (Optional) Enabled Regions
136148

137149
Parameters:
138150
pSRAHelperBucketNamePrefix:
@@ -257,6 +269,19 @@ Parameters:
257269
Default: "1"
258270
Description: Random parameter
259271
Type: String
272+
pControlTowerRegionsOnly:
273+
Type: String
274+
Description: Only enable in the Control Tower governed regions (set to true for environments without AWS Control Tower)
275+
Default: 'false'
276+
AllowedValues: ['true', 'false']
277+
pEnabledRegions:
278+
AllowedPattern: '^$|^([a-z0-9-]{1,64})$|^(([a-z0-9-]{1,64},)*[a-z0-9-]{1,64})$'
279+
ConstraintDescription:
280+
Only lowercase letters, numbers, and hyphens ('-') allowed. (e.g. us-east-1) Additional AWS regions can be provided, separated by commas. (e.g.
281+
us-east-1,ap-southeast-2)
282+
Default: ''
283+
Description: (Optional) Enabled regions (AWS regions, separated by commas). Leave blank to enable all regions.
284+
Type: String
260285

261286

262287
pCreateLambdaLogGroup:
@@ -292,16 +317,26 @@ Parameters:
292317
Default: 'true'
293318
Description: Auto enable RDS Login Events
294319
Type: String
295-
pEnableEksRuntimeMonitoring:
320+
pEnableRuntimeMonitoring:
296321
AllowedValues: ['true', 'false']
297322
Default: 'true'
298-
Description: Auto enable EKS Runtime Monitoring
323+
Description: Auto enable Runtime Monitoring
299324
Type: String
300325
pEnableEksAddonManagement:
301326
AllowedValues: ['true', 'false']
302327
Default: 'true'
303328
Description: Auto enable EKS Add-on Management
304329
Type: String
330+
pEnableEcsFargateAgentManagement:
331+
AllowedValues: ['true', 'false']
332+
Default: 'true'
333+
Description: Auto enable ECS Fargate Agent Management
334+
Type: String
335+
pEnableEc2AgentManagement:
336+
AllowedValues: ['true', 'false']
337+
Default: 'true'
338+
Description: Auto enable EC2 Agent Management
339+
Type: String
305340
pEnableLambdaNetworkLogs:
306341
AllowedValues: ['true', 'false']
307342
Default: 'true'
@@ -331,6 +366,17 @@ Parameters:
331366
Description: (Optional) Email address for receiving SRA alarms
332367
Type: String
333368

369+
Rules:
370+
CheckGuardDutyRuntimeEnabled:
371+
RuleCondition: !Equals [!Ref pEnableRuntimeMonitoring, 'false']
372+
Assertions:
373+
- Assert: !Not [!Equals [!Ref pEnableEksAddonManagement, 'true']]
374+
AssertDescription: "'Enable EKS Addon Management' requires Guardduty Runtime Monitoring to be enabled"
375+
- Assert: !Not [!Equals [!Ref pEnableEcsFargateAgentManagement, 'true']]
376+
AssertDescription: "'Enable Ecs Fargate Agent Management' requires Guardduty Runtime Monitoring to be enabled"
377+
- Assert: !Not [!Equals [!Ref pEnableEc2AgentManagement, 'true']]
378+
AssertDescription: "'Enable Ec2 Agent Management' requires Guardduty Runtime Monitoring to be enabled"
379+
334380
Conditions:
335381
cUsingKmsKey: !Not [!Equals [!Ref pLambdaLogGroupKmsKey, '']]
336382
cUseGraviton: !Or
@@ -1125,8 +1171,10 @@ Resources:
11251171
pAutoEnableKubernetesAuditLogs: !Ref pAutoEnableKubernetesAuditLogs
11261172
pAutoEnableMalwareProtection: !Ref pAutoEnableMalwareProtection
11271173
pEnableRdsLoginEvents: !Ref pEnableRdsLoginEvents
1128-
pEnableEksRuntimeMonitoring: !Ref pEnableEksRuntimeMonitoring
1174+
pEnableRuntimeMonitoring: !Ref pEnableRuntimeMonitoring
11291175
pEnableEksAddonManagement: !Ref pEnableEksAddonManagement
1176+
pEnableEcsFargateAgentManagement: !Ref pEnableEcsFargateAgentManagement
1177+
pEnableEc2AgentManagement: !Ref pEnableEc2AgentManagement
11301178
pEnableLambdaNetworkLogs: !Ref pEnableLambdaNetworkLogs
11311179
pCreateLambdaLogGroup: !Ref pCreateLambdaLogGroup
11321180
pDisableGuardDuty: !Ref pDisableGuardDuty
@@ -1145,6 +1193,8 @@ Resources:
11451193
pSecurityAccountId: !Ref pSecurityAccountId
11461194
pLogArchiveAccountId: !Ref pLogArchiveAccountId
11471195
pCreateAWSControlTowerExecutionRole: !Ref pCreateAWSControlTowerExecutionRole
1196+
pControlTowerRegionsOnly: !Ref pControlTowerRegionsOnly
1197+
pEnabledRegions: !Ref pEnabledRegions
11481198

11491199
Outputs:
11501200
oPublishingDestinationBucketName:

0 commit comments

Comments
 (0)