blea v0.0.26

Blea-Jic

Blea-Jic is an AWS CDK construct library that make up Organizations settings

Installation

yarn add blea

OrgEvent

Overview

This provides eventBridge rule from securityhub to SNS which is encrypted

Usage

import { OrgEvent } from 'blea';

const securityhubNotifyPattern = {
  source: ['aws.securityhub'],
  'detail-type': ['Security Hub Findings - Imported'],
  detail: {
    findings: {
      Compliance: {
        Status: ['FAILED', 'WARNING'],
      },
      Workflow: {
        Status: ['NEW'],
      },
    },
  },
};

const orgEvent = new OrgEvent(this, 'OrgEvent', {
    region: props?.env?.region || '',
    accountId: props?.env?.account || '',
    kmsAliasName: 'jicOrgTest',
    securityhubNotifyPattern: securityhubNotifyPattern,
});

OrgConfigRules

Overview

This provides OrganizationConfigRule to find child accounts Noncompliant

Prerequisites

Before using , you should set up for root or audit account enable config rule to organizations. for more detail , see below https://docs.aws.amazon.com/config/latest/developerguide/config-rule-multi-account-deployment.html

Usage

import { OrgConfigRules } from 'blea';
const orgConfigRules = new OrgConfigRules(this, 'OrgConfigRules', {
    region: props?.env?.region || '',
    configRulesAll: [
    { ruleIdentifier: 'DYNAMODB_TABLE_ENCRYPTED_KMS' },
    {
        ruleIdentifier: 'CW_LOGGROUP_RETENTION_PERIOD_CHECK',
        inputParameters: '{"MinRetentionTime":"1827"}',
    },
    ],
    configRulesOnlyUsEast1: [
    { ruleIdentifier: 'CLOUDFRONT_ASSOCIATED_WITH_WAF' },
    ],
    configExcludedAccounts: ['111111111111', '222222222222'],
});

OrgSlack

Overview

This provides aws chatbot for slack to notify findings .

Prerequisites

before deploying ,you have done configure new client. for more details , see below https://docs.aws.amazon.com/dtconsole/latest/userguide/notifications-chatbot.html

Usage

it supposes to be used with OrgEvent.

  const slackWorkspaceId = "xxxxx"
  const slackChannelId   = "xxxxx"

  const OrgSlack = new OrgSlack(this, 'OrgSlack', {
      snsTopic: [orgEven.topic],
      workspaceId: slackWorkspaceId,
      channelId: slackChannelId,
      slackChannelConfigurationName: slackChannelConfigurationName,
    });

OrgConfigSecurityhub

Overview

This provides lambda to import findings to securityhub from all children accounts config compliance .

you have sns topic named 'aws-controltower-AggregateSecurityNotifications' that created by aws controltower . All config compliance informations are sent to that one .

Prerequisites

Control tower is enabled in your organizations .

Usage

new OrgConfigSecurityhub(stack, 'OrgConfigSecurityhub', {
  auditAccountId: '123456789012',
  snsTopicArn:
    'arn:aws:sns:ap-northeast-1:123456789012:aws-controltower-AggregateSecurityNotifications',
  controlTowerHomeRegion: 'ap-northeast-1',
  configurationAggregatorName:
    'aws-controltower-GuardrailsComplianceAggregator',
});

OrgStackSet

Overview

This provides IAM role to switch from auidt account to child account. this is deployed by cloudfromation stack sets.

Usage

new OrgRoleStackSet(this, 'OrgRoleStackSet', {
  auditAccountID: "012345678912",
  roleName: 'swrole-from-blea',
  stackInstancesGroup: {
    regions: [controlTowerHomeRegion],
    deploymentTargets: {
      organizationalUnitIds: [
        'ou-xxxxxx',
        'ou-xxxxxx',
      ]
    },
  },
});

OrgAccountInitProc

Overview

This provides stepfunciton to disable specific item in securityhub standard cis and aws standard.

Prerequisites

This is supporsed to be deployed with OrgStackSet . so, before run this, you must deploy OrgStackSet

Usage

new OrgAccountInit(this, 'OrgAccountInit', {
  roleName: 'swrole-from-blea',
  disableArnsBasicAll: ['ACM.1','APIGateway.1'],
  disableArnsCISAll: ['1.1','1.10'],
  disableArnsBasicVA: ['CloudFront.1','CloudFront.2'],
  disableArnsCISNotCtHome: ['1.12', '1.13', '1.16', '1.2', '1.2'],
  controlTowerHomeRegion: controlTowerHomeRegion,
});

once you create , execute stepfunction with event like below.

{
  "accountId": "xxxxxxxxxxx",
  "region": "ap-northeast-1"
}

for contributor

first step

$ yarn

compile in the background

$ yarn watch

IMPORTANT!

DO NOT EDIT by package.json

to check specific source

once you build your source.

$ yarn build

then, execute synth, deploy etc...

$ cdk synth --app='./lib/integ.xxxx.default.js'
or
$ cdk deploy --app='./lib/integ.xxxx.default.js'