The very first thing you need to do while building your AWS infrastructure is to enable and configure all AWS account level security features such as: CloudTrail, CloudConfig, CloudWatch, IAM, etc..
To do this, you can use mine Amazon AWS Account level security checklist and how-to or any other source.
To avoid manual steps and to be align with SecuityAsCode concept, I use set of CloudFormation templates, simplified version of which I would like to share:
Global Security stack template structure:
security.global.json - parent template for all nested templates to link them together and control dependency between nested stacks.
cloudtrail.clobal.json - nested template for Global configuration of the CloudTrail:
- creates S3 bucket for the logs
- creates CloudTrail-related IAM roles and policies
- creates CloudLog LogGroup
- enables CloudTrail on default region including global events and multi-region feature
- creates SNS ans SQS configuration for easy integration with Splunk AWS app.
Predefined filters are:
- rds-change: RDS related changes
- iam-change; IAM changes
- srt-instance: Start, Reboot, Terminate instance
- large-instance: launching large instances
- massive-operations: massive operations- more 10 in 5 min
- massive-terminations: massive terminations- more 10 in 5 min
- detach-force-ebs: force detachment of the EBS volume from the instance
- change-critical-ebs: any changes related to the critical EBS volumes
- change-secgroup: any changes related to the security group
- create-delete-secgroup: creation and deletion of the security group
- secgroup-instance: attaching security group to the instance
- route-change: routing changes
- create-delete-vpc: creation and deletion of a VPC
- netacl-change: changes at Network ACL
- cloudtrail-change: changes in the CloudTrail configuration
- cloudformation-change: changes related to the CloudFormation
- root-access: any root access events
- unauthorised: failed and unauthorised operations
- igw-change: Internet Gateway related changes
- vpc-flow-logs: Delete or Create VPC flow logs
- critical-instance: any operation on the critical instances
- eip-change: Elastic IP changes
- net-access: Any access outside of predefined known IP ranges
4 preconfigured notification topics :
- InfosecEmailTopic,
- DevOpsEmailTopic
- InfosecSMSTopic
- DevOpsSMSTopic
awsconfig.global.json - nested template for Global AWS Config Service configuration.
- creates S3 bucket for the config dumps
- creates AWS Config-related IAM roles and policies
- creates AWS config delivery channel and schedule config dumps (hourly)
- creates and enables AWS config recorder
- creates SNS ans SQS configuration for easy integration with Splunk AWS app.
cloudwatchsubs.global.json - nested template for configuring AWS CloudWatch Subscription Filter to extract and analyse most severe CloudTrail events using custom Lambda function:
- creates Lambda function and all requred roles and permissions
- creates Subscription filter as a compilation of the filters from the FilterMap
Currently uses following filters and aggregate them to one due to the AWS CloudWatch Logs subscription limitation (only one filter supported):
- critical-instance
- iam-change
- srt-instance
- cloudtrail-change
- root-access
- net-access
- detach-force-ebs
- unauthorised
iam.global.json - nested template for IAM Global configuration:
- creates Infosec Team IAM Group and managed policy
- creates DevOps Team IAM Group and managed policy
- creates DBA Team IAM Group and managed policy
- creates Self Service Policy for users to manage API keys and MFA
- creates ProtectProdEnviroment to protect production environment from destructive actions
- creates EnforceMFAPolicy to enforce MFA for sensitive operations
- creates EnforceAccessFromOfficePolicy to restrict some operation to office source IPs
- creates DomainJoin role and all required policy to perform automated domain join
- creates SaltMasterPolicy and Role for Configuration Management Tool (in this case - Salt)
- creates SQLDataBaseInstancePolicy and Instance profile example policy
- creates SIEM system example policy
- creates VPC flow log role
- creates and manages SIEM user and API keys
- creates and manages SMTP user (for the AWS SES service ) and API keys
cloudwatchsubs_kinesis.global.json - PoC template (not linked as nested to the security.global.json) for configuring AWS CloudWatch Subscription Filter to send most severe CloudTrail events to AWS Kinesis stream using subscription filter similar to the cloudwatchsubs.global.json
Supported features:
Environments and regions: Stack supports unlimited amount of environments with 4 environments predefined (staging, dev, prod, and dr) and use 1 account and 1 region per environment concept to reduce blast radius (if account become compromised)
AWS services used by stack: CloudTrail, AWS Config, CloudWatch, CloudWatch Logs and Events, IAM, Lambda, Kinesis.
To deploy:
- Create bucket using following naming convention: com.ChangeMe.EnviromentName.cloudform, replacing ChangeMe and EnviromentName with your value to make it look like this: com.it-security.prod.cloudform
- Enable bucket versioning
- in the templates security.global.json and cloudwatchsubs.global.json replace "ChangeMe" with name used in the bucket creation.
- In the template cloudtrailalarms.global.json modify SNS endpoints for email notification infosec@ChangeMe.com and devops@ChangeMe.com; Add endpoints with mobile phone numbers for SMS notification to appropriate SNS topics if needed.
- Modify iam.global.json template to adrress you SQL DataBase bucket location (com-ChangeMe-", {"Ref": "Environment"} , "-sqldb/) and modify any permission if need according to your organisation structure, roles, responsibilities and services.
- Modify FilterMap in cloudtrailalarms.global.json and cloudwatchsubs.global.json templates make filters work for your infrastructure (Critical Instance IDs, Critical Volume IDs, you ofiice IP range, you NAT gateways, etc)
- Zip example Lambda function LogCritical_lambda_security_global.py like LogCritical_lambda_security_global.zip
- Upload this function into S3 bucket created at step 1 and copy object version (GUI- show version -object properties ) and insert into cloudwatchsubs.global.json template into "LogCriticalLambdaCodeVer" mapping at the appropriate environment (prod, staging ..)
- Modify "regions" Environments mapping in the iam.global.json, and cloudwatchsubs.global.json templates to specify correct AWS region you are using for the deployment.
- Upload all *.global.json templates into S3 bucket created at step 1.
- Create new CloudFormation stack using parent security template security.global.json and your bucket name (Example: ttps://s3.amazonaws.com/com.it-security.prod.cloudform/security.global.json ), call it "Security" and specify environment name you going to deploy.
- Done!
