我目前正在使用 aws-cdk,我的任务是为 15 条左右我们想要观看和接收通知的规则创建配置规则。这是我的参考代码:
const vpcFlowLoggingBucket = new s3.Bucket(this,'vpcFlowLoggingBucket', {
accessControl:s3.BucketAccessControl.LOG_DELIVERY_WRITE
});
const generalConfigRole = new iam.Role(this, 'generalConfigRole',{
assumedBy: new iam.ServicePrincipal('config.amazonaws.com')
});
const cloudTrailEnabledRule = new ManagedRule(this, 'cloudTrailEnabledRule', {
identifier: 'CLOUD_TRAIL_ENABLED'
});
const iamPasswordPolicyRule = new ManagedRule(this, 'iamPasswordPolicyRule',{
identifier: 'IAM_PASSWORD_POLICY'
});
const userGroupMembershipRule = new ManagedRule(this, 'userGroupMembershipRule',{
identifier: 'IAM_USER_GROUP_MEMBERSHIP_CHECK'
});
const userPolicyRule = new ManagedRule(this,'userPolicyRule',{
identifier: 'IAM_USER_NO_POLICIES_CHECK'
});
const rootAccountMfaEnabledRule = new ManagedRule(this, 'rootAccountMfaEnabledRule',{
identifier: 'ROOT_ACCOUNT_MFA_ENABLED'
});
const accessKeysRotatedRule = new ManagedRule(this, 'accessKeysRotatedRule',{
identifier:'ACCESS_KEYS_ROTATED',
inputParameters: {
maxAccessKeyAge: 100, //rule triggers off of config change and keys must be rotated within 100 days
configurationChanges: true
}
//TODO reference your custom lambda for this
//Parameters need to be specified here for the amount of days to rotate
});
const cloudTrailEncryptionRule = new ManagedRule(this, 'cloudTrailEncryptionRule' ,{
identifier:'CLOUD_TRAIL_ENCRYPTION_ENABLED'
});
const defaultSecurityGroupEniRule = new ManagedRule(this, 'defaultSecurityGroupEniRule',{
identifier:'EC2_SECURITY_GROUP_ATTACHED_TO_ENI'
});
const ebsVolumeEncryption = new ManagedRule(this, 'ebsVolumeEncryption',{
identifier:'EC2_EBS_ENCRYPTION_BY_DEFAULT'
});
const rdsStorageEncryptionRule = new ManagedRule(this, 'rdsStorageEncryptionRule',{
identifier: 'RDS_STORAGE_ENCRYPTED'
//This may need the arn of the kms key used for encryption
});
const s3BucketLoggingEnabledRule = new ManagedRule(this, 's3BucketLoggingEnabledRule',{
identifier: 'S3_BUCKET_LOGGING_ENABLED'
//@aroesec may be able to use a custom rule here for this one and my lambda
// TODO add custom lambda to this for future purposes
});
const s3BucketServerSideEncryptionRule = new ManagedRule(this, 's3BucketServerSideEncryptionRule',{
identifier:'S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED'
//@aroesec may be able to use a custom rule here for my lambda
// TODO add custom lambda to this for future purposes
});
const vpcFlowLogsEnabledRule = new ManagedRule(this, 'vpcFlowLogsEnabledRule',{
identifier:'VPC_FLOW_LOGS_ENABLED',
inputParameters: {
trafficType:'ALL', //vpcs must track all traffic (ALLOW and DENY) with this rule
configurationChanges: true
}
});
const vpcDefaultSecurityGroupRule = new ManagedRule(this, 'vpcDefaultSecurityGroupRule',{
identifier:'VPC_DEFAULT_SECURITY_GROUP_CLOSED'
});
const mfaEnabledForConsoleAccessRule = new ManagedRule(this, 'mfaEnabledForConsoleAccessRule',{
identifier: 'MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS'
});
const rdsMultiAvailZoneRule = new ManagedRule(this, 'rdsMultiAvailZoneRule',{
identifier:'RDS_MULTI_AZ_SUPPORT'
});
}
}
我的问题是,当我尝试使用 configurationChanges 参数并将其设置为 True 时。我正在寻找该配置规则以在它注意到那里的更改时扫描该资源组。我想这样做而不使用“频率”参数的原因是我们的客户不希望扫描像 24 小时那样频繁。他们希望他们对每条规则进行大约 2 周的扫描。我的问题是,1. 我可以让配置规则的扫描频率低于 24 小时吗?例如,也许每周?2.我可以让一个lambda触发配置规则来扫描吗?例如,对 vpc 流日志进行 lambda 检查,如果它们不存在,则触发配置规则以返回“不合规”。或 3。我可以为每个配置规则将 configurationChange 设置为 true 并让 aws 从那里处理它吗?我问这个具体问题是因为我已经阅读了一些关于配置记录器的内容,但不确定如何使用它,或者是否有必要。谢谢大家!