The Trusted Advisor Exposed Keys CloudWatch Event Monitor demonstrates how to use AWS Step Functions to orchestrate a serverless AWS Lambda workflow in response to an Amazon CloudWatch Event generated by AWS Trusted Advisor.
- Generate Access Keys Using Cloudformation Template Download
- Create Cloudformation Template From Existing
- Cloudformation Template Syntax
- Generate Access Keys Using Cloud Formation Template Download
- Generate Access Keys Using Cloud Formation Template Pdf
The CloudBD S3 Remote template lets you create CloudBD disks directly from CloudFormation templates using a custom resource lambda. The full documentation for using CloudBD disks with CloudFormation is available at the CloudBD Documentation pages. Complete example templates for all supported Linux distros are provided in this git repository. AWS CloudFormation simplifies provisioning and management on AWS. You can create templates for the service or application architectures you want and have AWS CloudFormation use those templates for quick and reliable provisioning of the services or applications (called “stacks”). You can also easily update or replicate the stacks as needed. You could generate the key on instance A, push it to s3 and then pull it down to instance B. That would require you to create an instance profile for each instance (giving them correct access to s3) and, if they're being created by the same template, use something like cfn-signal to let Cloudformation know that instance A has pushed the key so it's available when instance B bootstraps. Nov 22, 2016 The template configuration is stored in S3 and using CloudFormer you can create a template of a stack of an application that is already running, allowing you to replicate it in the same AWS region or even across regions. CloudFormation Designer. Maintenance of the CloudFormation stacks can also be a challenge and updates of these can also be a.
Generate Access Keys Using Cloudformation Template Download
On detection of a Trusted Advisor Exposed Access Key CloudWatch Event this workflow deletes the exposed IAM Access Key, summarizes the recent API activity for the exposed key, and sends the summary message to an Amazon SNS Topic to notify the subscribers.
This repository contains sample code for all the AWS Lambda functions depicted in the diagram below as well as an AWS CloudFormation template for creating the functions and related resources.
Walkthrough of the Architecture
Create Cloudformation Template From Existing
- An IAM Access Key is inadvertently uploaded to one of the popular code repositories (ex: github) monitored by Trusted Advisor.
- Trusted Advisor detects the key, generating a Trusted Advisor Exposed Access Keys CloudWatch Event. AWS also temporarily restricts the API calls the key is able to make.
- A configured CloudWatch Events rule matches this event, triggering an execution of the
ExposedKey
Step Functions state machine, which has the following sub-steps:- Delete the exposed IAM Access Key Pair
- Summarize recent API activity for the user from CloudTrail
- Send security notification message containing summary to
SecurityNotificationTopic
SNS Topic.
Running the Example
Option 1: Launch the CloudFormation Template in US East - N. Virginia (us-east-1)
![Template Template](/uploads/1/2/6/0/126069853/886331105.png)
The backend infrastructure can be deployed in US East - N. Virginia (us-east-1) using the provided CloudFormation template.Click Launch Stack to launch the template in the US East - N. Virginia (us-east-1) region in your account:
(In the last page of the wizard, make sure to:
- Click the checkboxes to give AWS CloudFormation permission to 'create IAM resources' and 'create IAM resources with custom names'
- Follow the instructions to 'Create Change Set'
- Click 'Execute')
Option 2: Launch the CloudFormation Template Manually
If you would like to deploy the template manually, you need a S3 bucket in the target region, and then package the Lambda functions into that S3 bucket by using the
aws cloudformation package
utility.** Note that this template may only be launched into US East - N. Virginia (us-east-1) as that is the only region where Trusted Advisor CloudWatch Event rules are configurable. **
Set environment variables for later commands to use:
Then go to the
cloudformation
folder and use the aws cloudformation package
utilityLast, deploy the stack with the resulting yaml (
exposed_access_keys.output.yaml
) through the CloudFormation Console or command line:Cloudformation Template Syntax
Testing the Example
To test the example without exposing an IAM Access Key to a public repository you can simulate the workflow by executing the
ExposedKey
state machine with a set of test json for the event. To do this follow the steps detailed below.Ensure you have at least one E-mail address subscribed to the
SecurityNotificationTopic
created by the template to receive the notification.- Go to the Identity & Access Management console
- Go to
Users
- Click
Add User
and create a user with programmatic access- For the
User name
puttest-user
- For
Access type
selectProgrammatic access
- Do not set any permissions for the user
- Note the
Access key ID
from the Review page for later use in the test json
- For the
- Go to the Step Functions console
- Select the
ExposedKey
state machine - Click
New execution
to create the test execution of the state machine- Copy and paste the json below to the execution json field
- Replace
ACCESS_KEY_ID_HERE
with theAccess key ID
noted from the earlier creation oftest-user
- You do not need to enter an execution id as one will be randomly generated by default
You can follow the state machine's progress in the Step Functions console. The summary message for
test-user
will be sent to the e-mail address(es) subscribed to the SecurityNotificationTopic
SNS Topic.- Note that the summary for this user will likely be empty as it will not have logged any API calls to CloudTrail
Here is an example of what this message might look like for a user who has made recent API calls to IAM and Step Functions:
Cleaning Up the Stack Resources
To remove all resources created by this example, do the following:
- Delete the CloudFormation stack.
- Delete the CloudWatch log groups associated with each Lambda function created by the CloudFormation stack.
CloudFormation Template Resources
The following sections explain all of the resources created by the CloudFormation template provided with this example.
CloudWatch
- TrustedAdvisorExposedKeyRule - A CloudWatch Events Rule to detect Trusted Advisor Exposed Key events and send them to the Step Functions state machine target
Step Functions
- ExposedKeysStepFunction - A Step Functions state machine that orchestrates the access key deletion, API call summary, and notification of security
Lambda
- DeleteAccessKeyPair - Lambda function that deletes the exposed IAM Access Key Pair associated with username provided by event.
- LookupCloudTrailEvents - Lambda function that looks up and summarizes recent API activity for the exposed access key provided by the event.
- NotifySecurity - Lambda function that constructs and sends security notification message containing API activity summary to SNS Topic created by this CloudFormation template.
SNS
Generate Access Keys Using Cloud Formation Template Download
- NotificationTopic - SNS Topic that API activity security message is sent to.
IAM
Generate Access Keys Using Cloud Formation Template Pdf
- ExecuteStateMachineRole - IAM Role with policy that allows CloudWatch Events rule to invoke executions of Step Functions state machines
- StepFunctionExecutionRole IAM Role with policy that allows Step Functions state machines to invoke Lambda functions.
- LambdaDeleteAccessKeyPairRole - IAM Role with policy that allows Lambda function to invoke 'iam:DeleteAccessKey' API call and write log messages to CloudWatch Logs.
- LambdaLookupCloudTrailEventsRole - IAM Role with policy that allows Lambda function to invoke 'cloudtrail:LookupEvents' API call and write log messages to CloudWatch Logs.
- LambdaSnsPublishRole - IAM Role with policy that allows Lambda function to invoke 'sns:Publish' API call and write log messages to CloudWatch Logs.
License
This reference architecture sample is licensed under Apache 2.0.