Skip to content

Commit f8fea35

Browse files
steph-torres-nhssteph-torres-nhs
authored
[PRMP-1358] Pen Test - Alarms without Action (#578)
1 parent 5bd4d9a commit f8fea35

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+262
-220
lines changed

‎infrastructure/alarms.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,15 @@ resource "aws_cloudwatch_metric_alarm" "api_gateway_alarm_5XX" {
3131
metric_name = "5XXError"
3232
period = 300
3333
statistic = "Sum"
34-
threshold = 5
34+
threshold = 0
3535
treat_missing_data = "notBreaching"
3636

3737
dimensions = {
3838
ApiName = aws_api_gateway_rest_api.ndr_doc_store_api.name
3939
Stage = var.environment
4040
}
4141

42-
alarm_description = "This alarm indicates that at least 5 5XX statuses have occurred on ${aws_api_gateway_rest_api.ndr_doc_store_api.name} within 5 minutes."
42+
alarm_description = "This alarm indicates that at least 1 5XX status has occurred on ${aws_api_gateway_rest_api.ndr_doc_store_api.name} within 5 minutes."
4343
alarm_actions = [aws_sns_topic.alarm_notifications_topic[0].arn]
4444

4545
tags = {

‎infrastructure/lambda-access-audit.tf‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,13 @@ module "access-audit-alarm" {
2323

2424

2525
module "access-audit-alarm-topic" {
26-
source = "./modules/sns"
27-
sns_encryption_key_id = module.sns_encryption_key.id
28-
topic_name = "access-audit-alarms-topic"
29-
topic_protocol = "lambda"
30-
topic_endpoint = module.access-audit-lambda.lambda_arn
31-
depends_on = [module.sns_encryption_key]
26+
source = "./modules/sns"
27+
sns_encryption_key_id = module.sns_encryption_key.id
28+
topic_name = "access-audit-alarms-topic"
29+
depends_on = [module.sns_encryption_key]
30+
topic_protocol = "email"
31+
is_topic_endpoint_list = true
32+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
3233
delivery_policy = jsonencode({
3334
"Version" : "2012-10-17",
3435
"Statement" : [

‎infrastructure/lambda-authoriser.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -44,11 +44,12 @@ module "authoriser-alarm" {
4444

4545

4646
module "authoriser-alarm-topic" {
47-
source = "./modules/sns"
48-
sns_encryption_key_id = module.sns_encryption_key.id
49-
topic_name = "authoriser-alarms-topic"
50-
topic_protocol = "lambda"
51-
topic_endpoint = module.authoriser-lambda.lambda_arn
47+
source = "./modules/sns"
48+
sns_encryption_key_id = module.sns_encryption_key.id
49+
topic_name = "authoriser-alarms-topic"
50+
topic_protocol = "email"
51+
is_topic_endpoint_list = true
52+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
5253
delivery_policy = jsonencode({
5354
"Version" : "2012-10-17",
5455
"Statement" : [

‎infrastructure/lambda-back-channel-logout.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,12 @@ module "back_channel_logout_alarm" {
5656

5757

5858
module "back_channel_logout_alarm_topic" {
59-
source = "./modules/sns"
60-
sns_encryption_key_id = module.sns_encryption_key.id
61-
topic_name = "back-channel-logout-alarms-topic"
62-
topic_protocol = "lambda"
63-
topic_endpoint = module.back_channel_logout_lambda.lambda_arn
59+
source = "./modules/sns"
60+
sns_encryption_key_id = module.sns_encryption_key.id
61+
topic_name = "back-channel-logout-alarms-topic"
62+
topic_protocol = "email"
63+
is_topic_endpoint_list = true
64+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
6465
delivery_policy = jsonencode({
6566
"Version" : "2012-10-17",
6667
"Statement" : [

‎infrastructure/lambda-bulk-upload-metadata-processor.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,12 @@ module "bulk-upload-metadata-processor-alarm" {
5555
}
5656

5757
module "bulk-upload-metadata-processor-alarm-topic" {
58-
source = "./modules/sns"
59-
sns_encryption_key_id = module.sns_encryption_key.id
60-
topic_name = "bulk-upload-metadata-processor-topic"
61-
topic_protocol = "lambda"
62-
topic_endpoint = module.bulk-upload-metadata-processor-lambda.lambda_arn
58+
source = "./modules/sns"
59+
sns_encryption_key_id = module.sns_encryption_key.id
60+
topic_name = "bulk-upload-metadata-processor-topic"
61+
topic_protocol = "email"
62+
is_topic_endpoint_list = true
63+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
6364
delivery_policy = jsonencode({
6465
"Version" : "2012-10-17",
6566
"Statement" : [

‎infrastructure/lambda-bulk-upload-metadata.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,12 @@ module "bulk-upload-metadata-alarm" {
3939
}
4040

4141
module "bulk-upload-metadata-alarm-topic" {
42-
source = "./modules/sns"
43-
sns_encryption_key_id = module.sns_encryption_key.id
44-
topic_name = "bulk-upload-metadata-topic"
45-
topic_protocol = "lambda"
46-
topic_endpoint = module.bulk-upload-metadata-lambda.lambda_arn
42+
source = "./modules/sns"
43+
sns_encryption_key_id = module.sns_encryption_key.id
44+
topic_name = "bulk-upload-metadata-topic"
45+
topic_protocol = "email"
46+
is_topic_endpoint_list = true
47+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
4748
delivery_policy = jsonencode({
4849
"Version" : "2012-10-17",
4950
"Statement" : [

‎infrastructure/lambda-bulk-upload-report.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,12 @@ module "bulk-upload-report-alarm" {
6060
}
6161

6262
module "bulk-upload-report-alarm-topic" {
63-
source = "./modules/sns"
64-
sns_encryption_key_id = module.sns_encryption_key.id
65-
topic_name = "bulk-upload-report-topic"
66-
topic_protocol = "lambda"
67-
topic_endpoint = module.bulk-upload-report-lambda.lambda_arn
63+
source = "./modules/sns"
64+
sns_encryption_key_id = module.sns_encryption_key.id
65+
topic_name = "bulk-upload-report-topic"
66+
topic_protocol = "email"
67+
is_topic_endpoint_list = true
68+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
6869
delivery_policy = jsonencode({
6970
"Version" : "2012-10-17",
7071
"Statement" : [

‎infrastructure/lambda-bulk-upload.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -96,11 +96,12 @@ module "bulk-upload-alarm" {
9696
}
9797

9898
module "bulk-upload-alarm-topic" {
99-
source = "./modules/sns"
100-
sns_encryption_key_id = module.sns_encryption_key.id
101-
topic_name = "bulk-upload-topic"
102-
topic_protocol = "lambda"
103-
topic_endpoint = module.bulk-upload-lambda.lambda_arn
99+
source = "./modules/sns"
100+
sns_encryption_key_id = module.sns_encryption_key.id
101+
topic_name = "bulk-upload-topic"
102+
topic_protocol = "email"
103+
is_topic_endpoint_list = true
104+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
104105
delivery_policy = jsonencode({
105106
"Version" : "2012-10-17",
106107
"Statement" : [

‎infrastructure/lambda-create-doc-ref.tf‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,13 @@ module "create_doc_alarm" {
1111

1212

1313
module "create_doc_alarm_topic" {
14-
source = "./modules/sns"
15-
sns_encryption_key_id = module.sns_encryption_key.id
16-
topic_name = "create_doc-alarms-topic"
17-
topic_protocol = "lambda"
18-
topic_endpoint = module.create-doc-ref-lambda.lambda_arn
19-
depends_on = [module.sns_encryption_key]
14+
source = "./modules/sns"
15+
sns_encryption_key_id = module.sns_encryption_key.id
16+
topic_name = "create_doc-alarms-topic"
17+
topic_protocol = "email"
18+
is_topic_endpoint_list = true
19+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
20+
depends_on = [module.sns_encryption_key]
2021
delivery_policy = jsonencode({
2122
"Version" : "2012-10-17",
2223
"Statement" : [

‎infrastructure/lambda-data-collection.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,12 @@ module "data-collection-alarm" {
1010
}
1111

1212
module "data-collection-alarm-topic" {
13-
source = "./modules/sns"
14-
sns_encryption_key_id = module.sns_encryption_key.id
15-
topic_name = "data-collection-topic"
16-
topic_protocol = "lambda"
17-
topic_endpoint = module.data-collection-lambda.lambda_arn
13+
source = "./modules/sns"
14+
sns_encryption_key_id = module.sns_encryption_key.id
15+
topic_name = "data-collection-topic"
16+
topic_protocol = "email"
17+
is_topic_endpoint_list = true
18+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
1819
delivery_policy = jsonencode({
1920
"Version" : "2012-10-17",
2021
"Statement" : [

0 commit comments

Comments
 (0)