Skip to content

Commit

Permalink
Merge pull request #171 from aliaksei-ivanou/security-patterns-update
Browse files Browse the repository at this point in the history 
Security patterns update
  • Loading branch information
@shapirov103
shapirov103 authored May 8, 2024
2 parents ea36595 + 2ac8f02 commit 21847d4
Show file tree
Hide file tree
Showing 5 changed files with 87 additions and 45 deletions.
5 changes: 4 additions & 1 deletion .gitignore
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,4 +22,7 @@ yarn.lock
# mkdocs artifact
site
# macOS extraneous file
.DS_STORE
.DS_STORE

# Python virtual env directory
*.venv*
Binary file removed docs/patterns/images/2023-guardduty-2-configure.jpg
View file
Binary file not shown.
3 changes: 0 additions & 3 deletions docs/patterns/kubeflow.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,3 @@ cdk destroy kubeflow-blueprint
## Disclaimer
This pattern relies on an open source NPM package eks-blueprints-cdk-kubeflow-ext. Please refer to the package npm site for more information.
https://www.npmjs.com/package/eks-blueprints-cdk-kubeflow-ext

If you have any questions about the npm package or find any defect, please post in the source repo at
https://github.com/season1946/eks-blueprints-cdk-kubeflow-extension
6 changes: 1 addition & 5 deletions docs/patterns/security/guardduty.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,11 +45,7 @@ make list

### Deploying the `GuardDutySetupStack` stack

The `GuardDutySetupStack` stack enables GuardDuty Detector for the account with all the features of your choice enabled. For the purposes of the Security seciton of this workshop only the GuardDuty EKS Protection features are required.

![Amazon GuardDuty console](../images/2023-guardduty-2-configure.jpg)

**Note:** You can only deploy this stack if you have not already enabled GuardDuty in the target account and region. If GuardDuty has been enabled already, do not attempt to deploy the stack as GuardDuty can only be enabled once per account and region. Instead, check that the [EKS Protection](https://docs.aws.amazon.com/guardduty/latest/ug/kubernetes-protection.html) features have been enabled either in the AWS GuardDuty console as shown in the image above, or using the AWS CLI, then proceed to **Deploying the blueprint workload** step.
The `GuardDutySetupStack` stack enables GuardDuty Detector for the account with all the features of your choice enabled.

To deploy the stack, run the following command:

Expand Down
118 changes: 82 additions & 36 deletions lib/security/guardduty-construct/guardduty-setup.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import * as sns from "aws-cdk-lib/aws-sns";
import * as subs from "aws-cdk-lib/aws-sns-subscriptions";
import * as events from "aws-cdk-lib/aws-events";
import * as eventTargets from "aws-cdk-lib/aws-events-targets";
import * as AWS from "aws-sdk";

const account = process.env.CDK_DEFAULT_ACCOUNT;
const region = process.env.CDK_DEFAULT_REGION;
Expand All @@ -21,49 +22,94 @@ export class GuardDutySetupStack extends Stack {
{ name: "EKS_AUDIT_LOGS", status: "ENABLED" },
{ name: "EBS_MALWARE_PROTECTION", status: "ENABLED" },
{ name: "RDS_LOGIN_EVENTS", status: "ENABLED" },
{
name: "EKS_RUNTIME_MONITORING",
{ name: "LAMBDA_NETWORK_LOGS", status: "ENABLED" },
{
name: "RUNTIME_MONITORING",
status: "ENABLED",
additionalConfiguration: [
{
name: "EKS_ADDON_MANAGEMENT",
status: "ENABLED",
},
{ name: "EKS_ADDON_MANAGEMENT", status: "ENABLED" },
{ name: "ECS_FARGATE_AGENT_MANAGEMENT", status: "ENABLED" },
{ name: "EC2_AGENT_MANAGEMENT", status: "ENABLED" },
],
},
];

// Create a GuardDuty detector
new aws_guardduty.CfnDetector(this, id + "GuardDutyDetector", {
enable: true,
features,
});
// check if GuardDuty is already enabled in the region
const guardDuty = new AWS.GuardDuty();
guardDuty.listDetectors({}, (err, data) => {
if (err) {
console.log(err, err.stack);
} else {
if (data.DetectorIds?.length === 0) {
// Create a GuardDuty detector
new aws_guardduty.CfnDetector(this, id + "GuardDutyDetector", {
enable: true,
features,
});

// Configure GuardDuty to email any security findings
const guardDutyTopic = new sns.Topic(
this,
id + "GuardDutyNotificationTopic"
);
guardDutyTopic.addSubscription(new subs.EmailSubscription(email));
const eventRule = new events.Rule(this, id + "GuardDutyEventRule", {
eventPattern: {
source: ["aws.guardduty"],
detailType: ["GuardDuty Finding"],
},
});

// Format the GuardDuty findings emails
eventRule.addTarget(
new eventTargets.SnsTopic(guardDutyTopic, {
message: events.RuleTargetInput.fromText(
`WARNING: AWS GuardDuty has discovered a ${events.EventField.fromPath(
"$.detail.type"
)} security issue for ${environmentName} (${events.EventField.fromPath(
"$.region"
)}). Please go to https://${events.EventField.fromPath(
"$.region"
)}.console.aws.amazon.com/guardduty/ to find out more details.`
),
})
);
return;
} else {
console.log("GuardDuty is enabled in this region.");
}

// Configure GuardDuty to email any security findings
const guardDutyTopic = new sns.Topic(
this,
id + "GuardDutyNotificationTopic"
);
guardDutyTopic.addSubscription(new subs.EmailSubscription(email));
const eventRule = new events.Rule(this, id + "GuardDutyEventRule", {
eventPattern: {
source: ["aws.guardduty"],
detailType: ["GuardDuty Finding"],
},
// Update the existing detector to use the EKS features
console.log("Updating the detector to make sure EKS features are enabled.");
const detectorId = data.DetectorIds[0];
console.log("Detector ID: " + detectorId);
const params: AWS.GuardDuty.UpdateDetectorRequest = {
DetectorId: detectorId,
Features: [
{
AdditionalConfiguration: [
{
Name: "EKS_ADDON_MANAGEMENT",
Status: "ENABLED",
},
],
Name: "RUNTIME_MONITORING",
Status: "ENABLED",
},
{
Name: "EKS_AUDIT_LOGS",
Status: "ENABLED",
},
]
};
guardDuty.updateDetector(params, (err, data) => {

Check warning on line 105 in lib/security/guardduty-construct/guardduty-setup.ts

View workflow job for this annotation

GitHub Actions / build (18) 

'data' is defined but never used. Allowed unused args must match /^_/u
if (err) {
console.log(err, err.stack);
} else {
console.log("Updated GuardDuty detector with EKS features.");
}
});
}
});
// Format the GuardDuty findings emails
eventRule.addTarget(
new eventTargets.SnsTopic(guardDutyTopic, {
message: events.RuleTargetInput.fromText(
`WARNING: AWS GuardDuty has discovered a ${events.EventField.fromPath(
"$.detail.type"
)} security issue for ${environmentName} (${events.EventField.fromPath(
"$.region"
)}). Please go to https://${events.EventField.fromPath(
"$.region"
)}.console.aws.amazon.com/guardduty/ to find out more details.`
),
})
);
}
}

0 comments on commit 21847d4

Please sign in to comment.