Skip to content

Commit 7dfab35

Browse files
harrim91harrim91
committed
CCM-8572: use guardduty event, update condition
1 parent 4f56073 commit 7dfab35

31 files changed

+872
-886
lines changed

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_quarantine_scan_result.tf‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
resource "aws_cloudwatch_event_rule" "quarantine_scan_result" {
2+
name = "${local.csi}-quarantine-tags-added"
3+
description = "Forwards quarantine 'GuardDuty Malware Protection Object Scan Result' events for enrichment"
4+
5+
event_pattern = jsonencode({
6+
source = ["aws.guardduty"]
7+
detail-type = ["GuardDuty Malware Protection Object Scan Result"]
8+
resources = [aws_guardduty_malware_protection_plan.quarantine.arn]
9+
detail = {
10+
s3ObjectDetails = {
11+
bucketName = [module.s3bucket_quarantine.id]
12+
objectKey = [{ prefix = "pdf-template/" }, { prefix = "test-data/" }]
13+
}
14+
}
15+
})
16+
}
17+
18+
resource "aws_cloudwatch_event_target" "quarantine_scan_to_enrichment" {
19+
rule = aws_cloudwatch_event_rule.quarantine_scan_result.name
20+
arn = module.sqs_quarantine_scan_enrichment.sqs_queue_arn
21+
role_arn = aws_iam_role.quarantine_scan_to_enrichment.arn
22+
}
23+
24+
resource "aws_iam_role" "quarantine_scan_to_enrichment" {
25+
name = "${local.csi}-quarantine-scan-to-enrichment"
26+
assume_role_policy = data.aws_iam_policy_document.events_assume_role.json
27+
}
28+
29+
resource "aws_iam_role_policy" "quarantine_scan_to_enrichment" {
30+
name = "${local.csi}-quarantine-scan-to-enrichment"
31+
role = aws_iam_role.quarantine_scan_to_enrichment.id
32+
policy = data.aws_iam_policy_document.quarantine_scan_to_enrichment.json
33+
}
34+
35+
data "aws_iam_policy_document" "quarantine_scan_to_enrichment" {
36+
version = "2012-10-17"
37+
38+
statement {
39+
sid = "AllowSQSSendMessage"
40+
effect = "Allow"
41+
actions = ["sqs:SendMessage"]
42+
resources = [module.sqs_quarantine_scan_enrichment.sqs_queue_arn]
43+
}
44+
45+
statement {
46+
sid = "AllowKMS"
47+
effect = "Allow"
48+
actions = [
49+
"kms:Decrypt",
50+
"kms:GenerateDataKey"
51+
]
52+
resources = [var.kms_key_arn]
53+
}
54+
}

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_quarantine_tags_added.tf‎

Lines changed: 0 additions & 58 deletions
This file was deleted.

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_virus_scan_failed.tf‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,14 @@ resource "aws_cloudwatch_event_rule" "virus_scan_failed" {
44

55
event_pattern = jsonencode({
66
source = ["templates.${var.environment}.${var.project}"]
7-
detail-type = ["object-tags-enriched"]
7+
detail-type = ["quarantine-scan-result-enriched"]
88
detail = {
9-
bucket = {
10-
name = [module.s3bucket_quarantine.id]
9+
s3ObjectDetails = {
10+
bucketName = [module.s3bucket_quarantine.id]
11+
objectKey = [{ prefix = "pdf-template/" }, { prefix = "test-data/" }]
1112
}
12-
object = {
13-
tags = {
14-
GuardDutyMalwareScanStatus = [{ anything-but = "NO_THREATS_FOUND" }]
15-
}
13+
scanResultDetails = {
14+
scanResultStatus = [{ anything-but = "NO_THREATS_FOUND" }]
1615
}
1716
}
1817
})

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_virus_scan_passed.tf‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,17 @@
11
resource "aws_cloudwatch_event_rule" "virus_scan_passed" {
22
name = "${local.csi}-virus-scan-passed"
3-
description = "Forwards enriched events to SQS from quarantine bucket where GuardDuty virus scan has passed with no threats"
3+
description = "Forwards enriched events from quarantine bucket where GuardDuty virus scan has passed with no threats"
44

55
event_pattern = jsonencode({
66
source = ["templates.${var.environment}.${var.project}"]
7-
detail-type = ["object-tags-enriched"]
7+
detail-type = ["quarantine-scan-result-enriched"]
88
detail = {
9-
bucket = {
10-
name = [module.s3bucket_quarantine.id]
9+
s3ObjectDetails = {
10+
bucketName = [module.s3bucket_quarantine.id]
11+
objectKey = [{ prefix = "pdf-template/" }, { prefix = "test-data/" }]
1112
}
12-
object = {
13-
tags = {
14-
GuardDutyMalwareScanStatus = ["NO_THREATS_FOUND"]
15-
}
13+
scanResultDetails = {
14+
scanResultStatus = ["NO_THREATS_FOUND"]
1615
}
1716
}
1817
})

‎infrastructure/terraform/modules/backend-api/guardduty_malware_protection_plan_quarantine.tf‎

Lines changed: 154 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
resource "aws_guardduty_malware_protection_plan" "quarantine" {
2-
role = aws_iam_role.guardduty.arn
2+
role = aws_iam_role.guardduty_quarantine.arn
33

44
protected_resource {
55
s3_bucket {
66
bucket_name = module.s3bucket_quarantine.id
7-
object_prefixes = []
7+
object_prefixes = ["pdf-template/", "test-data/"]
88
}
99
}
1010

@@ -14,3 +14,155 @@ resource "aws_guardduty_malware_protection_plan" "quarantine" {
1414
}
1515
}
1616
}
17+
18+
resource "aws_iam_role" "guardduty_quarantine" {
19+
name = "${local.csi}-guardduty-quarantine"
20+
description = "IAM Role for GuardDuty to provide S3 malware protection"
21+
assume_role_policy = data.aws_iam_policy_document.guardduty_assumerole.json
22+
}
23+
24+
resource "aws_iam_role_policy_attachment" "guardduty_quarantine" {
25+
role = aws_iam_role.guardduty_quarantine.name
26+
policy_arn = aws_iam_policy.guardduty_quarantine.arn
27+
}
28+
29+
resource "aws_iam_policy" "guardduty_quarantine" {
30+
name = "${local.csi}-guardduty"
31+
description = "Permissions for GuardDuty to provide S3 malware protection"
32+
policy = data.aws_iam_policy_document.guardduty_quarantine.json
33+
}
34+
35+
data "aws_iam_policy_document" "guardduty_assumerole" {
36+
statement {
37+
sid = "GuardDutyAssumeRole"
38+
effect = "Allow"
39+
40+
actions = [
41+
"sts:AssumeRole",
42+
]
43+
44+
principals {
45+
type = "Service"
46+
47+
identifiers = [
48+
"malware-protection-plan.guardduty.amazonaws.com"
49+
]
50+
}
51+
}
52+
}
53+
54+
#tfsec:ignore:aws-iam-no-policy-wildcards
55+
data "aws_iam_policy_document" "guardduty_quarantine" {
56+
statement {
57+
sid = "AllowManagedRuleToSendS3EventsToGuardDuty"
58+
effect = "Allow"
59+
actions = [
60+
"events:PutRule",
61+
"events:DeleteRule",
62+
"events:PutTargets",
63+
"events:RemoveTargets"
64+
]
65+
resources = [
66+
"arn:aws:events:${var.region}:${var.aws_account_id}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*"
67+
]
68+
condition {
69+
test = "StringLike"
70+
variable = "events:ManagedBy"
71+
values = [
72+
"malware-protection-plan.guardduty.amazonaws.com"
73+
]
74+
}
75+
}
76+
77+
statement {
78+
sid = "AllowGuardDutyToMonitorEventBridgeManagedRule"
79+
effect = "Allow"
80+
actions = [
81+
"events:DescribeRule",
82+
"events:ListTargetsByRule"
83+
]
84+
resources = [
85+
"arn:aws:events:${var.region}:${var.aws_account_id}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*"
86+
]
87+
}
88+
89+
statement {
90+
sid = "AllowPostScanTag"
91+
effect = "Allow"
92+
actions = [
93+
"S3:PutObjectTagging",
94+
"S3:GetObjectTagging",
95+
"S3:PutObjectVersionTagging",
96+
"S3:GetObjectVersionTagging"
97+
]
98+
99+
resources = [
100+
"${module.s3bucket_quarantine.arn}/*"
101+
]
102+
}
103+
104+
statement {
105+
sid = "AllowEnableS3EventBridgeEvents"
106+
effect = "Allow"
107+
actions = [
108+
"s3:PutBucketNotification",
109+
"s3:GetBucketNotification"
110+
]
111+
resources = [
112+
module.s3bucket_quarantine.arn
113+
]
114+
}
115+
116+
statement {
117+
sid = "AllowPutValidationObject"
118+
effect = "Allow"
119+
actions = [
120+
"s3:PutObject"
121+
]
122+
resources = [
123+
"${module.s3bucket_quarantine.arn}/malware-protection-resource-validation-object"
124+
]
125+
}
126+
127+
statement {
128+
sid = "AllowCheckBucketOwnership"
129+
effect = "Allow"
130+
actions = [
131+
"s3:ListBucket"
132+
]
133+
resources = [
134+
module.s3bucket_quarantine.arn
135+
]
136+
}
137+
statement {
138+
sid = "AllowMalwareScan"
139+
effect = "Allow"
140+
actions = [
141+
"s3:GetObject",
142+
"s3:GetObjectVersion"
143+
]
144+
145+
resources = [
146+
"${module.s3bucket_quarantine.arn}/*"
147+
]
148+
}
149+
150+
statement {
151+
sid = "AllowKMSDecrypt"
152+
effect = "Allow"
153+
actions = [
154+
"kms:GenerateDataKey",
155+
"kms:Decrypt"
156+
]
157+
resources = [
158+
var.kms_key_arn
159+
]
160+
condition {
161+
test = "StringLike"
162+
variable = "kms:ViaService"
163+
values = [
164+
"s3.*.amazonaws.com"
165+
]
166+
}
167+
}
168+
}

0 commit comments

Comments
 (0)