Skip to content

Commit 7f654fc

Browse files
tawoyinfatawoyinfa
authored
Merge pull request #62 from lvthillo/feat-cloudtrail
Feature: Add parameter to choose between read-write events or only write events in CloudTrail Event Data Store
2 parents 547a03e + d934bb6 commit 7f654fc

File tree

10 files changed

+187
-45
lines changed

10 files changed

+187
-45
lines changed

‎amplify/backend/custom/cloudtrailLake/cloudtrailLake-cloudformation-template.json

Lines changed: 123 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,131 @@
11
{
2-
"AWSTemplateFormatVersion": "2010-09-09",
3-
"Parameters": {
4-
"env": {
5-
"Type": "String"
6-
}
2+
"AWSTemplateFormatVersion":"2010-09-09",
3+
"Parameters":{
4+
"env":{
5+
"Type":"String"
76
},
8-
"Conditions": {
9-
"IsOrganizationsSupported": {
10-
"Fn::Not": [
11-
{
12-
"Fn::Equals": [
13-
{
14-
"Ref": "AWS::Partition"
15-
},
16-
"aws-cn"
17-
]
18-
}
19-
]
7+
"CloudTrailAuditLogs":{
8+
"Type":"String",
9+
"AllowedValues":[
10+
"read_write",
11+
"read",
12+
"write",
13+
"none"
14+
]
15+
}
16+
},
17+
"Conditions":{
18+
"IsOrganizationsSupported":{
19+
"Fn::Not":[
20+
{
21+
"Fn::Equals":[
22+
{
23+
"Ref":"AWS::Partition"
24+
},
25+
"aws-cn"
26+
]
2027
}
28+
]
2129
},
22-
"Resources": {
23-
"myEventDataStore": {
24-
"Type": "AWS::CloudTrail::EventDataStore",
25-
"Properties": {
26-
"Name": { "Ref" : "AWS::StackName" },
27-
"MultiRegionEnabled": true,
28-
"RetentionPeriod": 365,
29-
"OrganizationEnabled": {
30-
"Fn::If": [
31-
"IsOrganizationsSupported",
32-
true,
33-
{
34-
"Ref": "AWS::NoValue"
35-
}
36-
]
37-
},
38-
"TerminationProtectionEnabled": false
39-
}
40-
}
30+
"IsReadAndWriteEnabled":{
31+
"Fn::Equals":[
32+
{
33+
"Ref":"CloudTrailAuditLogs"
34+
},
35+
"read_write"
36+
]
4137
},
42-
"Outputs": {
43-
"EventDataStoreOutput": {
44-
"Description": "The event data store ID",
45-
"Value": {
46-
"Ref":"myEventDataStore"
38+
"IsReadOnlyEnabled":{
39+
"Fn::Equals":[
40+
{
41+
"Ref":"CloudTrailAuditLogs"
42+
},
43+
"read"
44+
]
45+
},
46+
"IsAuditLogsDisabled":{
47+
"Fn::Equals":[
48+
{
49+
"Ref":"CloudTrailAuditLogs"
50+
},
51+
"none"
52+
]
53+
}
54+
},
55+
"Resources":{
56+
"myEventDataStore":{
57+
"Type":"AWS::CloudTrail::EventDataStore",
58+
"Properties":{
59+
"Name":{
60+
"Ref":"AWS::StackName"
61+
},
62+
"MultiRegionEnabled":true,
63+
"IngestionEnabled":{
64+
"Fn::If":[
65+
"IsAuditLogsDisabled",
66+
false,
67+
true
68+
]
69+
},
70+
"RetentionPeriod":7,
71+
"OrganizationEnabled":{
72+
"Fn::If":[
73+
"IsOrganizationsSupported",
74+
true,
75+
{
76+
"Ref":"AWS::NoValue"
4777
}
48-
}
78+
]
79+
},
80+
"TerminationProtectionEnabled":false,
81+
"AdvancedEventSelectors":[
82+
{
83+
"Fn::If":[
84+
"IsReadAndWriteEnabled",
85+
{
86+
"FieldSelectors":[
87+
{
88+
"Field":"eventCategory",
89+
"Equals":[
90+
"Management"
91+
]
92+
}
93+
]
94+
},
95+
{
96+
"FieldSelectors":[
97+
{
98+
"Field":"readOnly",
99+
"Equals":[
100+
{
101+
"Fn::If":[
102+
"IsReadOnlyEnabled",
103+
true,
104+
false
105+
]
106+
}
107+
]
108+
},
109+
{
110+
"Field":"eventCategory",
111+
"Equals":[
112+
"Management"
113+
]
114+
}
115+
]
116+
}
117+
]
118+
}
119+
]
120+
}
121+
}
122+
},
123+
"Outputs":{
124+
"EventDataStoreOutput":{
125+
"Description":"The event data store ID",
126+
"Value":{
127+
"Ref":"myEventDataStore"
128+
}
49129
}
130+
}
50131
}

‎amplify/backend/custom/cloudtrailLake/parameters.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"CloudTrailAuditLogs": "read_write"
3+
}

‎deployment/deploy.sh

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ export AWS_PROFILE=$TEAM_ACCOUNT_PROFILE
2121

2222
cd ..
2323

24-
aws codecommit create-repository --repository-name team-idc-app --repository-description "Temporary Elevated Access Management (TEAM) Application"
24+
aws codecommit create-repository --region $REGION --repository-name team-idc-app --repository-description "Temporary Elevated Access Management (TEAM) Application"
2525
git remote remove origin
2626
git remote add origin codecommit::$REGION://team-idc-app
2727
git push origin main
@@ -34,6 +34,7 @@ then
3434
--parameter-overrides \
3535
Source=$EMAIL_SOURCE \
3636
Login=$IDC_LOGIN_URL \
37+
CloudTrailAuditLogs=$CLOUDTRAIL_AUDIT_LOGS \
3738
teamAdminGroup="$TEAM_ADMIN_GROUP" \
3839
teamAuditGroup="$TEAM_AUDITOR_GROUP" \
3940
tags="$TAGS" \
@@ -45,6 +46,7 @@ else
4546
--parameter-overrides \
4647
Source=$EMAIL_SOURCE \
4748
Login=$IDC_LOGIN_URL \
49+
CloudTrailAuditLogs=$CLOUDTRAIL_AUDIT_LOGS \
4850
teamAdminGroup="$TEAM_ADMIN_GROUP" \
4951
teamAuditGroup="$TEAM_AUDITOR_GROUP" \
5052
tags="$TAGS" \

‎deployment/parameters-template.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,4 @@ TEAM_ACCOUNT_PROFILE=team_account_profile
2121
TEAM_ADMIN_GROUP="team_admin_group_name"
2222
TEAM_AUDITOR_GROUP="team_auditor_group_name"
2323
TAGS="project=iam-identity-center-team environment=prod"
24+
CLOUDTRAIL_AUDIT_LOGS=read_write

‎deployment/template.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,14 @@ Parameters:
77
Login:
88
Type: String
99
Description: IAM IDC Login URL
10+
CloudTrailAuditLogs:
11+
Type: "String"
12+
AllowedValues:
13+
- read_write
14+
- read
15+
- write
16+
- none
17+
Description: "Read and Write CloudTrail logs"
1018
teamAdminGroup:
1119
Type: String
1220
Description: TEAM application Admin group
@@ -18,6 +26,9 @@ Parameters:
1826
Description: TEAM application tags
1927
Default: ""
2028

29+
Conditions:
30+
IsEmptyCloudTrailAuditLogs: !Equals [!Ref CloudTrailAuditLogs, ""]
31+
2132
Resources:
2233
TriggerAmplifyBuild:
2334
Type: Custom::TriggerAmplifyBuild
@@ -113,6 +124,11 @@ Resources:
113124
Value: !Ref Source
114125
- Name: SSO_LOGIN
115126
Value: !Ref Login
127+
- Name: CLOUDTRAIL_AUDIT_LOGS
128+
Value: !If
129+
- IsEmptyCloudTrailAuditLogs
130+
- "read_write"
131+
- !Ref CloudTrailAuditLogs
116132
- Name: TEAM_ADMIN_GROUP
117133
Value: !Ref teamAdminGroup
118134
- Name: TEAM_AUDITOR_GROUP

‎deployment/update.sh

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ then
3131
--parameter-overrides \
3232
Source=$EMAIL_SOURCE \
3333
Login=$IDC_LOGIN_URL \
34+
CloudTrailAuditLogs=$CLOUDTRAIL_AUDIT_LOGS \
3435
teamAdminGroup="$TEAM_ADMIN_GROUP" \
3536
teamAuditGroup="$TEAM_AUDITOR_GROUP" \
3637
tags="$TAGS" \
@@ -42,6 +43,7 @@ else
4243
--parameter-overrides \
4344
Source=$EMAIL_SOURCE \
4445
Login=$IDC_LOGIN_URL \
46+
CloudTrailAuditLogs=$CLOUDTRAIL_AUDIT_LOGS \
4547
teamAdminGroup="$TEAM_ADMIN_GROUP" \
4648
teamAuditGroup="$TEAM_AUDITOR_GROUP" \
4749
tags="$TAGS" \

‎docs/docs/deployment/deployment_process.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ Create a new file named **parameters.sh** in the **deployment** directory. Copy
3636

3737
**Parameters**
3838

39+
Required:
3940
- **EMAIL_SOURCE** - Verified Email address for originating TEAM notifications
4041
- **IDC_LOGIN_URL** - AWS IAM Identity Center Login URL
4142
- **REGION** - AWS region where the application will be deployed.
@@ -46,7 +47,14 @@ Create a new file named **parameters.sh** in the **deployment** directory. Copy
4647
- **TEAM_ACCOUNT_PROFILE** - Named profile for TEAM Application deployment Account
4748
- **TEAM_ADMIN_GROUP** - Name of IAM Identity Center group for TEAM administrators
4849
- **TEAM_AUDITOR_GROUP** - Name of IAM Identity Center group for TEAM auditors
50+
51+
Optional:
4952
- **TAGS** - Tags that should be propagated to nested stacks and underlying resources
53+
- **CLOUDTRAIL_AUDIT_LOGS** - CloudTrail Event Data Store logging configuration. Options:
54+
- `read_write` - record read and write events
55+
- `read` - record only read events
56+
- `write` - record only write events
57+
- `none` - disable event logging
5058

5159
For example:
5260

@@ -60,6 +68,7 @@ TEAM_ACCOUNT_PROFILE=TeamAccountProfileName
6068
TEAM_ADMIN_GROUP=team_admin_group_name
6169
TEAM_AUDITOR_GROUP=team_auditor_group_name
6270
TAGS="tag1=value1 tag2=value2"
71+
CLOUDTRAIL_AUDIT_LOGS=read_write
6372
```
6473

6574
---

‎docs/docs/overview/cost.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,9 @@ The TEAM solution consists of numerous AWS serverless services. As cost is accru
1818
- [Amazon Cognito](https://aws.amazon.com/es/cognito/pricing)
1919
- [AWS CloudTrail Lake](https://aws.amazon.com/cloudtrail/pricing/)
2020
- [AWS IAM Identity Center](https://aws.amazon.com/iam/identity-center/) (free)
21+
22+
## Managing CloudTrail Lake cost
23+
24+
TEAM uses [AWS CloudTrail Lake](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html) for querying, auditing and logging API activities and actions performed by a user during the period of elevated access. For CloudTrail Lake, you pay for ingestion and storage together, where the billing is based on the amount of uncompressed data ingested during the month. When you run queries in Lake, you pay based upon the amount of data scanned.
25+
26+
TEAM CloudTrail lake event datastore records all [management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html) and no [data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) by default. Depending on your organization's auditing and compliance requirement, you can chose to either log all events or specific events (read-only, write, read-write, management, data events). Recording only specific events can help to reduce the overall cost of running the TEAM solution. For more information about managing CloudTrail lake costs, see [Managing CloudTrail Lake costs](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html).

‎docs/docs/overview/security.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,10 @@ In the case of TEAM, you can enforce the required TLS versions and cipher suites
4747

4848
Furthermore, the TEAM solution does not enable WAF on the AppSync api endpoint by default. You can use AWS WAF to protect your AppSync API from common web exploits, such as SQL injection and cross-site scripting (XSS) attacks. Be aware that this could affect API availability and performance, compromise security, or consume excessive resources. For example, you can use rate-based rules to specify the number of web requests that are allowed by each client IP in a trailing, continuously updated, 5-minute period. [ For further details, see Using AWS WAF to protect your APIs.](https://docs.aws.amazon.com/appsync/latest/devguide/WAF-Integration.html)
4949

50+
## Audit logs
51+
TEAM uses [AWS CloudTrail Lake](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html) for querying, auditing and logging API activities and actions performed by a user during the period of elevated access.
52+
TEAM CloudTrail lake event datastore records all [management events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html) and no [data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html) by default. Depending on your organization's auditing and compliance requirement, consider updating the TEAM CloudTrail lake event data store configuration to either log all events or specific events (read-only, write, read-write, management, data events).
53+
5054
## Amplify S3 bucket access logging
5155
AWS Amplify creates an s3 bucket for storing artifacts for deploying the TEAM application.
5256
> It is recommended to enable **Server access logging** for the bucket. However, each organization has its own directives on how this must be achieved. E.g. some organizations mandate that the server access logs be sent to a bucket in a central log archive account which entails additional cross-account permissions. Please refer to [Enabling Amazon S3 server access logging](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html) for an explanation on how this can be achieved.

‎parameters.js

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
const fs = require("fs");
77
const path = require("path");
88

9-
const { AWS_APP_ID, AWS_BRANCH, EMAIL_SOURCE, SSO_LOGIN, TEAM_ADMIN_GROUP, TEAM_AUDITOR_GROUP, TAGS } = process.env;
9+
const { AWS_APP_ID, AWS_BRANCH, EMAIL_SOURCE, SSO_LOGIN, TEAM_ADMIN_GROUP, TEAM_AUDITOR_GROUP, TAGS, CLOUDTRAIL_AUDIT_LOGS } = process.env;
1010

1111
async function update_auth_parameters() {
1212
console.log(`updating amplify config for branch "${AWS_BRANCH}"...`);
@@ -105,10 +105,28 @@ async function update_tag_parameters() {
105105
fs.writeFileSync(tagsParametersJsonPath, JSON.stringify(tagsArray, null, 2));
106106
}
107107

108+
async function update_cloudtrail_parameters() {
109+
console.log(`updating amplify/backend/custom/cloudtrailLake/parameters.json"...`);
110+
111+
const cloudtrailParametersJsonPath = path.resolve(
112+
`./amplify/backend/custom/cloudtrailLake/parameters.json`
113+
);
114+
115+
const cloudtrailParametersJson = require(cloudtrailParametersJsonPath);
116+
117+
cloudtrailParametersJson.CloudTrailAuditLogs = CLOUDTRAIL_AUDIT_LOGS;
118+
119+
fs.writeFileSync(
120+
cloudtrailParametersJsonPath,
121+
JSON.stringify(cloudtrailParametersJson, null, 4)
122+
);
123+
}
124+
108125

109126

110127
update_custom_parameters();
111128
update_auth_parameters();
112129
update_react_parameters();
113130
update_groups_parameters();
114-
update_tag_parameters();
131+
update_tag_parameters();
132+
update_cloudtrail_parameters();

0 commit comments

Comments
 (0)