compliance-account-initial-setup.yaml

#
# Copyright 2017-2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License").
# You may not use this file except in compliance with the License.
# A copy of the License is located at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# or in the "license" file accompanying this file. This file is distributed
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied. See the License for the specific language governing
# permissions and limitations under the License.
#

AWSTemplateFormatVersion: '2010-09-09'
Description: Initialize the Compliance-as-Code Engine in the Compliance Account

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: Compliance-as-Code Engine Configuration
        Parameters:
         - MainRegion
         - OtherActiveRegions
      - Label:
          default: (Advanced User Only) Deployment options
        Parameters:
         - DefaultRuleSet
         - DefaultRuleSetOtherRegions
         - AccountListLocation
         - WhitelistLocation
         - CentralizedS3BucketConfig
         - CodebuildSourceS3BucketConfig
         - CodebuildDestinationS3BucketConfig
         - CodePipelineArtifactS3BucketConfig
         - CentralizedS3BucketComplianceEventName
         - DatalakeQueries
         - EngineComplianceRule

Parameters:
  CentralizedS3BucketConfig:
    ConstraintDescription: Enter DNS-compliant prefix
    Description: Bucket prefix where Config logs will be stored. The Bucket will be created with a dash and the account ID (12-digit) appended to the prefix you have entered.
    Default: centralized-config
    MaxLength: 63
    MinLength: 10
    Type: String
  MainRegion:
    Description: Region which is designated as main Region (e.g. us-west-2).
    Default: us-west-2
    AllowedValues: 
    - us-east-1
    - us-east-2
    - us-west-1
    - us-west-2
    - ap-south-1
    - ap-northeast-1
    - ap-northeast-2
    - ap-southeast-1
    - ap-southeast-2
    - ca-central-1
    - eu-central-1
    - eu-west-1
    - eu-west-2
    - eu-west-3
    - sa-east-1
    AllowedPattern: ^.{0,14}$
    ConstraintDescription: Select one AWS Region only.
    Type: String
  OtherActiveRegions:
    Description: List of Regions which needs Rules, which are not the main Region, separated by comma and no space (e.g. us-west-1,ap-southeast-1).
    Default: ""
    AllowedPattern: (^$|^(ap|ca|eu|sa|us)-(north|east|west|south|central)(east|west)*-\d(,(ap|ca|eu|sa|us)-(north|east|west|south|central)(east|west)*-\d)*$)
    Type: String
    ConstraintDescription: List regions separated by comma and without any space.
  EngineComplianceRule:
    Description: Rule name which review the state of this deployment
    Default: COMPLIANCE_RULESET_LATEST_INSTALLED
    Type: String
  CodebuildSourceS3BucketConfig:
    ConstraintDescription: Enter DNS-compliant prefix
    Description: Bucket prefix from where the source code will be picked up by CodeBuild. The Bucket will be created with a dash, the account ID (12-digit), another dash and the region name appended to the prefix you have entered.
    Default: compliance-engine-codebuild-source
    MaxLength: 63
    MinLength: 10
    Type: String
  CodebuildDestinationS3BucketConfig:
    ConstraintDescription: Enter DNS-compliant prefix
    Description: Bucket prefix from where CodeBuild will put the CloudFormation templates. The Bucket will be created with a dash, the account ID (12-digit), another dash and the region name appended to the prefix you have entered.
    Default: compliance-engine-codebuild-output
    MaxLength: 63
    MinLength: 10
    Type: String
  CodePipelineArtifactS3BucketConfig:
    ConstraintDescription: Enter DNS-compliant prefix
    Description: Bucket prefix from where CodePipeline will store its artifacts. The Bucket will be created with a dash, the account ID (12-digit), another dash and the region name appended to the prefix you have entered.
    Default: compliance-engine-pipeline-artifact
    MaxLength: 63
    MinLength: 10
    Type: String
  CentralizedS3BucketComplianceEventName:
    ConstraintDescription: Enter DNS-compliant prefix
    Description: Bucket prefix where Compliance Event will be stored. The Bucket will be created with a dash and the account ID (12-digit) appended to the prefix you have entered.
    Default: compliance-engine-events-centralized
    MaxLength: 63
    MinLength: 10
    Type: String
  DefaultRuleSet:
    Description: Default RuleSet name to deploy in AWS accounts.
    Default: baseline
    Type: String
  DefaultRuleSetOtherRegions:
    Description: Default RuleSet name to deploy in non-main regions in AWS accounts, if other regions are used.
    Default: otherregionsbaseline
    Type: String
  AccountListLocation:
    Description: Bucket name and key of the location of your account list (i.e. some-bucket/my_account_list.json) or let it empty in no account list.
    Default: ""
    Type: String
  WhitelistLocation:
    Description: Bucket name and key of the location of your whitelist (i.e. some-bucket/compliance_whitelist.json) or let it empty in no whitelist.
    Default: ""
    Type: String
  DatalakeQueries:
    Description: Create a set of Athena queries to analyze compliance events.
    Default: true
    AllowedValues:
      - true
      - false
    Type: String  

Conditions:
    IsMainRegion: !Equals [ !Ref 'AWS::Region', !Ref MainRegion ]
    NotMainRegion: !Not [ !Condition IsMainRegion ]
    AccountListLocation: !Not [ !Equals [ "", !Ref AccountListLocation]]
    WhitelistLocation: !Not [ !Equals [ "", !Ref WhitelistLocation]]
    OtherActiveRegions: !Not [ !Equals [ "", !Ref OtherActiveRegions]]

Resources:

# Bucket for RDK
  RDKS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join [ "-", [ "config-rule-code-bucket", !Ref 'AWS::AccountId', !Ref 'AWS::Region']]
      Tags:
      - Key: Owner
        Value: Security

# Bucket for all the logs from Config
  CentralizedS3Bucket:
    Condition: IsMainRegion
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join [ "-", [ !Ref CentralizedS3BucketConfig, !Ref 'AWS::AccountId']]
      LifecycleConfiguration:
        Rules:
        - Status: Enabled
          Transitions:
          - StorageClass: STANDARD_IA
            TransitionInDays: 30
      Tags:
      - Key: Owner
        Value: Security
      VersioningConfiguration:
        Status: Enabled

  CentralizedS3BucketPolicy:
    Condition: IsMainRegion
    DependsOn: CentralizedS3Bucket
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Join [ "-", [ !Ref CentralizedS3BucketConfig, !Ref 'AWS::AccountId']]
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Action: s3:GetBucketAcl
          Effect: Allow
          Principal:
            Service: config.amazonaws.com
          Resource: !Join [ "", ["arn:aws:s3:::", !Ref CentralizedS3BucketConfig, "-", !Ref 'AWS::AccountId']]
          Sid: ConfigAllowGetBucketAcl
        - Action: s3:PutObject
          Condition:
            StringEquals:
              s3:x-amz-acl: bucket-owner-full-control
          Effect: Allow
          Principal:
            Service: config.amazonaws.com
          Resource: !Join [ "", ["arn:aws:s3:::", !Ref CentralizedS3BucketConfig, "-", !Ref 'AWS::AccountId', "/AWSLogs/*"]]
          Sid: ConfigAllowPutObject

# CodeBuild + Pipeline

  CodePipelineEngine:
    Condition: IsMainRegion
    Type: AWS::CodePipeline::Pipeline
    Properties:
      ArtifactStore:
        Location: !Join [ "-", [ !Ref CodePipelineArtifactS3BucketConfig, !Ref 'AWS::AccountId', !Ref 'AWS::Region']]
        Type: S3
      DisableInboundStageTransitions: []
      Name: Compliance-Engine-Pipeline
      RoleArn: !Join [ ":", ["arn:aws:iam:", !Ref 'AWS::AccountId', "role/ComplianceEngine-CodePipelineRole"]]
      Stages:
        - Name: S3Source
          Actions:
            - Name: TemplateSource
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: S3
                Version: '1'
              Configuration:
                S3Bucket: !Join [ "-", [ !Ref CodebuildSourceS3BucketConfig, !Ref 'AWS::AccountId', !Ref 'AWS::Region']]
                PollForSourceChanges: True
                S3ObjectKey: ruleset.zip
              OutputArtifacts:
                - Name: TemplateSource
              RunOrder: 1
        - Name: BuildRulesTemplate
          Actions:
            - Name: BuildTemplates
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: '1'
              InputArtifacts:
                - Name: TemplateSource
              OutputArtifacts:
                - Name: RuleTemplateSource
              RunOrder: 1
              Configuration:
                ProjectName: !Ref CodeBuildRulesTemplateProject
        - Name: DeployConfigRules
          Actions:
            - Name: DeployConfigRulesTemplates
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: '1'
              InputArtifacts:
                - Name: RuleTemplateSource
              RunOrder: 1
              Configuration:
                ProjectName: !Ref CodeBuildRuleDeployProject
    DependsOn: CodePipelineRole

  CodeBuildRulesTemplateProject:
    Condition: IsMainRegion
    Type: AWS::CodeBuild::Project
    Properties:
      ServiceRole: !Join [ ":", ["arn:aws:iam:", !Ref 'AWS::AccountId', "role/ComplianceEngine-CodeBuildRole"]]
      Artifacts:
        Type: CODEPIPELINE
      Name: Compliance-Rule-Template-Build
      Description: Build the Config Rules CloudFormation to be deployed
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/python:3.6.5
        EnvironmentVariables:
         - Name: OUTPUT_BUCKET
           Value: !Join [ "-", [ !Ref CodebuildDestinationS3BucketConfig, !Ref 'AWS::AccountId', !Ref 'AWS::Region']]
         - Name: OUTPUT_BUCKET_NO_REGION
           Value: !Join [ "-", [ !Ref CodebuildDestinationS3BucketConfig, !Ref 'AWS::AccountId']]
         - Name: DEFAULT_RULESET
           Value: !Ref DefaultRuleSet
         - Name: DEFAULT_RULESET_OTHER_REGIONS
           Value: !Ref DefaultRuleSetOtherRegions
         - Name: ACCOUNT_LIST
           Value: !If [ AccountListLocation, !Ref AccountListLocation, 'none']
         - Name: OTHER_ACTIVE_REGIONS
           Value: !If [ OtherActiveRegions, !Ref OtherActiveRegions, 'none']
         - Name: ENGINE_RULE_NAME
           Value: !Ref EngineComplianceRule
         - Name: DATALAKE_QUERIES_BOOL
           Value: !Ref DatalakeQueries
         - Name: FIREHOSE_KEY_LIST
           Value: none
         - Name: ATHENA_COLUMN_LIST
           Value: none
         - Name: CONFIG_CENTRAL_BUCKET
           Value: !Ref CentralizedS3BucketConfig
         - Name: COMPLIANCE_EVENT_CENTRAL_BUCKET
           Value: !Ref CentralizedS3BucketComplianceEventName
      Source:
        Type: CODEPIPELINE
        BuildSpec: rulesets-build/buildspec_buildtemplates.yaml
      TimeoutInMinutes: 60
    DependsOn:
     - CodebuildDestinationS3Bucket
     - CodeBuildRole

  CodeBuildRuleDeployProject:
    Condition: IsMainRegion
    Type: AWS::CodeBuild::Project
    Properties:
      ServiceRole: !Join [ ":", ["arn:aws:iam:", !Ref 'AWS::AccountId', "role/ComplianceEngine-CodeBuildRole"]]
      Artifacts:
        Type: CODEPIPELINE
      Name: Compliance-Rule-Template-Deploy
      Description: Deploy the Config Rules CloudFormation to be deployed
      Environment:
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/python:3.6.5
        EnvironmentVariables:
         - Name: OUTPUT_BUCKET_NO_REGION
           Value: !Join [ "-", [ !Ref CodebuildDestinationS3BucketConfig, !Ref 'AWS::AccountId']]
         - Name: OTHER_ACTIVE_REGIONS
           Value: !If [ OtherActiveRegions, !Ref OtherActiveRegions, 'none']
         - Name: ENGINE_RULE_NAME
           Value: !Ref EngineComplianceRule       
      Source:
        Type: CODEPIPELINE
        BuildSpec: buildspec_deploytemplates.yaml
      TimeoutInMinutes: 60
    DependsOn:
     - CodebuildDestinationS3Bucket
     - CodeBuildRole

  CodebuildSourceS3Bucket:
    Condition: IsMainRegion
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join [ "-", [ !Ref CodebuildSourceS3BucketConfig, !Ref 'AWS::AccountId', !Ref 'AWS::Region']]
      Tags:
      - Key: Owner
        Value: Security
      VersioningConfiguration:
        Status: Enabled

  CodebuildDestinationS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join [ "-", [ !Ref CodebuildDestinationS3BucketConfig, !Ref 'AWS::AccountId', !Ref 'AWS::Region']]
      Tags:
      - Key: Owner
        Value: Security
      VersioningConfiguration:
        Status: Enabled

  CodePipelineBucket:
    Condition: IsMainRegion
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join [ "-", [ !Ref CodePipelineArtifactS3BucketConfig, !Ref 'AWS::AccountId', !Ref 'AWS::Region']]
      Tags:
      - Key: Owner
        Value: Security
      VersioningConfiguration:
        Status: Enabled

  CodePipelineRole:
    Condition: IsMainRegion
    Type: AWS::IAM::Role
    Properties:
      RoleName: ComplianceEngine-CodePipelineRole
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [codepipeline.amazonaws.com]
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            AWS: !Ref 'AWS::AccountId'
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodePipelineAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Action:
                - 's3:*'
                - 'cloudformation:*'
                - 'codebuild:*'
                - 'iam:PassRole'
                - 'sns:Publish'
                - 'cloudwatch:*'
                - 'logs:*'
                - 'codecommit:*'
                - 'config:*'
                - 'lambda:*'
                - 'iam:Get*'
                - 'iam:List*'
                - 'codepipeline:StartPipelineExecution'
                Effect: Allow
                Resource: '*'

  CodeBuildRole:
    Condition: IsMainRegion
    Type: AWS::IAM::Role
    Properties:
      RoleName: ComplianceEngine-CodeBuildRole
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [codebuild.amazonaws.com]
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: CodeBuildAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Sid: STSaccess
              Action:
              - sts:AssumeRole
              - sts:GetCallerIdentity
              Effect: Allow
              Resource: "*"
            - Sid: RdkPermissions
              Action:
              - iam:Get*
              - iam:List*
              - lambda:AddPermission
              - lambda:CreateFunction
              - lambda:CreateEventSourceMapping
              - lambda:UpdateFunctionConfiguration
              - lambda:UpdateFunctionCode
              - lambda:PublishVersion
              - lambda:Get*
              - lambda:List*
              - config:Describe*
              - config:Put*
              - config:List*
              - config:StartConfigurationRecorder
              - config:Get*
              - config:StartConfigRulesEvaluation
              - cloudformation:*
              - logs:Describe*
              - logs:FilterLogEvents
              - logs:GetLogEvents
              - logs:CreateLogStream
              - logs:CreateLogGroup
              - logs:PutLogEvents
              - s3:List*
              - s3:CreateBucket
              - lambda:CreateFunction
              - lambda:CreateEventSourceMapping
              - lambda:UpdateFunctionConfiguration
              - lambda:Get*
              - lambda:List*
              Effect: Allow
              Resource: "*"
            - Sid: RdkPermissionsLambda
              Action:
              - lambda:AddPermission
              - lambda:UpdateFunctionCode
              - lambda:PublishVersion
              - lambda:DeleteFunction
              - lambda:RemovePermission
              Effect: Allow
              Resource: !Join [ ":", [ "arn:aws:lambda", !Ref "AWS::Region", !Ref "AWS::AccountId", "function:RDK-Rule-Function-*"]]
            - Sid: RdkPermissionsS3
              Action:
              - s3:PutObject
              - s3:GetObject
              Effect: Allow
              Resource:
              - "arn:aws:s3:::config-rule-code-bucket*"
              - !Join ["", [ "arn:aws:s3:::", !Join [ "-", [ !Ref CodebuildSourceS3BucketConfig, !Ref 'AWS::AccountId', !Ref 'AWS::Region']], "*"]]
              - !Join ["", [ "arn:aws:s3:::", !Join [ "-", [ !Ref CodebuildDestinationS3BucketConfig, !Ref 'AWS::AccountId']], "*"]]
              - !Join ["", [ "arn:aws:s3:::", !Join [ "-", [ !Ref CodePipelineArtifactS3BucketConfig, !Ref 'AWS::AccountId', !Ref 'AWS::Region']], "*"]]
            - Sid: RdkPermissionsPassRole
              Action:
              - iam:CreateRole
              - iam:PassRole
              - iam:*RolePolicy
              Effect: Allow
              Resource: arn:aws:iam::*:role/rdk/*
            - Sid: AthenaCreation
              Action:
              - athena:*NamedQuery
              Effect: Allow
              Resource: "*" 

  #Firehose
  
  FirehoseDeliveryStreamIAMRole:
    Condition: IsMainRegion
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: ComplianceEngine-FirehoseDeliveryStreamRole
      Path: /
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AWSLambdaRole'
      AssumeRolePolicyDocument:
       Statement:
         - Action: 'sts:AssumeRole'
           Effect: Allow
           Principal:
             Service: firehose.amazonaws.com
       Version: 2012-10-17
      Policies:
        - 
          PolicyName: 'Access-for-Firehose'
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Action: 
                  - 's3:AbortMultipartUpload'
                  - 's3:GetBucketLocation'
                  - 's3:GetObject'
                  - 's3:ListBucket'
                  - 's3:ListBucketMultipartUploads'
                  - 's3:PutObject'
                Effect: 'Allow'
                Resource:
                  - !GetAtt CentralizedS3BucketComplianceEvent.Arn
                  - !Join ['', [!GetAtt CentralizedS3BucketComplianceEvent.Arn, '/*']]

  MainComplianceFirehoseDeliveryStream:
    Condition: IsMainRegion
    Type: "AWS::KinesisFirehose::DeliveryStream"
    Properties: 
      DeliveryStreamName: 'Firehose-Compliance-Engine'
      ExtendedS3DestinationConfiguration:
        BucketARN:  !Join ["", [ "arn:aws:s3:::", !Join [ "-", [ !Ref CentralizedS3BucketComplianceEventName, !Ref 'AWS::AccountId']]]]
        BufferingHints:
          IntervalInSeconds: 900
          SizeInMBs: 50
        CompressionFormat: GZIP
        Prefix: compliance-as-code-events/
        RoleARN: !Join [ ":", ["arn:aws:iam:", !Ref 'AWS::AccountId', "role/ComplianceEngine-FirehoseDeliveryStreamRole"]]
        ProcessingConfiguration:
          Enabled: true
          Processors: 
          - Parameters: 
            - ParameterName: LambdaArn
              ParameterValue: !GetAtt LambdaETL.Arn 
            Type: Lambda 
    DependsOn: FirehoseDeliveryStreamIAMRole
    
  CentralizedS3BucketComplianceEvent:
    Condition: IsMainRegion
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join [ "-", [ !Ref CentralizedS3BucketComplianceEventName, !Ref 'AWS::AccountId']]
      Tags:
      - Key: Owner
        Value: Security
      VersioningConfiguration:
        Status: Enabled

  LambdaRuleFirehosePolicy:
    Condition: IsMainRegion
    Type: 'AWS::IAM::Policy'
    Properties:
      Roles:  
      - ComplianceEngine-CodePipelineRole
      PolicyName: LambdaRuleFirehosePolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: 'firehose:PutRecord'
            Resource: !Join 
              - ':'
              - - 'arn:aws:firehose'
                - !Ref 'AWS::Region'
                - !Ref 'AWS::AccountId'
                - 'deliverystream/Firehose-Compliance-Engine' 
    DependsOn: FirehoseDeliveryStreamIAMRole

# ETL on the compliance event data

  LambdaETL:  
    Condition: IsMainRegion
    Type: "AWS::Lambda::Function"
    Properties:
      FunctionName: ComplianceEngine-ETL
      Handler: "etl_evaluations.lambda_handler"
      Role: !GetAtt LambdaRoleETL.Arn
      Environment:
        Variables:
           ComplianceWhitelist: !If [ WhitelistLocation, !Ref WhitelistLocation, 'none']
      Code: 
        ZipFile: |
          the code is given by the pipeline.
      
      Runtime: python3.6
      Timeout: 300
      
  LambdaETLInvokePermission:  
    Condition: IsMainRegion
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt LambdaETL.Arn
      Action: 'lambda:InvokeFunction'
      Principal: firehose.amazonaws.com
      SourceAccount: !Ref 'AWS::AccountId'
      SourceArn: !GetAtt MainComplianceFirehoseDeliveryStream.Arn
      
  LambdaRoleETL:
    Condition: IsMainRegion
    Type: AWS::IAM::Role
    Properties:
      RoleName: ComplianceEngine-LambdaETLRole
      AssumeRolePolicyDocument:
        Statement:
        - Action: ['sts:AssumeRole']
          Effect: Allow
          Principal:
            Service: [lambda.amazonaws.com]
        Version: '2012-10-17'
      Path: /
      Policies:
        - PolicyName: ETL-access
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Sid: ETLlog
              Action:
              - logs:CreateLogStream
              - logs:CreateLogGroup
              - logs:PutLogEvents
              - s3:List*
              - codepipeline:StartPipelineExecution
              Effect: Allow
              Resource: "*"      
            - Sid: ETLcodebuildUpdate
              Action:
              - codebuild:UpdateProject
              - codebuild:BatchGetProjects
              Effect: Allow
              Resource: !GetAtt CodeBuildRulesTemplateProject.Arn           
            - Sid: ETLPermissionsS3
              Action:
              - s3:PutObject
              - s3:GetObject
              Effect: Allow
              Resource:
              - !Join ["", [ "arn:aws:s3:::", !Join [ "-", [ !Ref CodebuildSourceS3BucketConfig, !Ref 'AWS::AccountId', !Ref 'AWS::Region']], "*"]]
              - !Join ["", [ "arn:aws:s3:::", !Join [ "-", [ !Ref CodebuildDestinationS3BucketConfig, !Ref 'AWS::AccountId', !Ref 'AWS::Region']], "*"]]