Imported guardduty_slack from 0.11

Author: saiya

guardduty_slack/README.md

@@ -0,0 +1,17 @@
+# guardduty_slack
+
+This module setups:
+
+- AWS GuardDuty
+- S3 bucket to store "trusted IP address" list
+  - GuardDuty won't raise alert for trusted IPs.
+- Slack notification (AWS lambda)
+
+## Prerequisite
+
+1. Create slack channel to notify
+2. Issue slack webhook URL to post notification
+
+## Variables
+
+See [variables.tf](variables.tf) for parameters.

guardduty_slack/aws_region.tf

@@ -0,0 +1 @@
+data "aws_region" "current" {}

guardduty_slack/aws_s3_bucket.tf

@@ -0,0 +1,5 @@
+resource "aws_s3_bucket" "main" {
+  bucket_prefix = "${var.s3_bucket_name}-"
+
+  acl = "private"
+}

guardduty_slack/aws_s3_bucket_object.tf

@@ -0,0 +1,14 @@
+locals {
+  ipset_location = "https://s3-${data.aws_region.current.name}.amazonaws.com/${aws_s3_bucket_object.trusted_ipset.bucket}/${aws_s3_bucket_object.trusted_ipset.key}"
+  trusted_ipset_content = "${join("\n", var.trusted_ip_cidr_blocks)}"
+}
+
+resource "aws_s3_bucket_object" "trusted_ipset" {
+  acl = "public-read"
+
+  bucket = "${aws_s3_bucket.main.id}"
+  key = "ipset-${sha1(local.trusted_ipset_content)}"
+
+  etag = "${md5(local.trusted_ipset_content)}"
+  content = "${local.trusted_ipset_content}"
+}

guardduty_slack/lambda_sns_to_slack.tf

@@ -0,0 +1,6 @@
+module "lambda_sns_to_slack" {
+  source = "./lambda_sns_to_slack"
+  
+  basename = "guardduty-sns-to-slack-${var.envname}"
+  guardduty_slack_webhook_url = "${var.guardduty_slack_webhook_url}"
+}

guardduty_slack/lambda_sns_to_slack/aws_iam_role.tf

@@ -0,0 +1,49 @@
+resource "aws_iam_role" "lambda_role" {
+  name = "${var.basename}"
+
+  assume_role_policy = "${data.aws_iam_policy_document.lambda_edge_assume_role.json}"
+}
+
+data "aws_iam_policy_document" "lambda_edge_assume_role" {
+  statement {
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["lambda.amazonaws.com", "edgelambda.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "viewer_request_lambda_execution" {
+  role       = "${aws_iam_role.lambda_role.name}"
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+}
+
+resource "aws_iam_role_policy_attachment" "viewer_request_cloudwatch_logs" {
+  role       = "${aws_iam_role.lambda_role.name}"
+  policy_arn = "${aws_iam_policy.lambda_cloudwatch_logs.arn}"
+}
+
+resource "aws_iam_policy" "lambda_cloudwatch_logs" {
+  name        = "${var.basename}-logs"
+  path        = "/"
+  description = "IAM policy for logging from a lambda"
+
+  policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents"
+      ],
+      "Resource": "arn:aws:logs:*:*:*",
+      "Effect": "Allow"
+    }
+  ]
+}
+EOF
+}

guardduty_slack/lambda_sns_to_slack/aws_lambda_function.tf

@@ -0,0 +1,34 @@
+output "lambda_arn" {
+  value = "${aws_lambda_function.lambda.arn}"
+}
+
+resource "aws_lambda_function" "lambda" {
+  publish       = true
+  function_name = "${var.basename}"
+
+  filename         = "${substr(data.archive_file.lambda.output_path, length(path.cwd) + 1, -1)}"
+  handler          = "index.lambda_hander"
+  source_code_hash = "${data.archive_file.lambda.output_base64sha256}"
+
+  role = "${aws_iam_role.lambda_role.arn}"
+
+  runtime     = "python3.6"
+  memory_size = 128
+  timeout     = 30
+
+  environment {
+    variables = {
+      slack = "${var.guardduty_slack_webhook_url}"
+    }
+  }
+
+  lifecycle {
+    ignore_changes = ["last_modified"]
+  }
+}
+
+data "archive_file" "lambda" {
+  type        = "zip"
+  source_dir  = "${path.module}/src"
+  output_path = "${path.module}/temp/${var.basename}-dist.zip"
+}

guardduty_slack/lambda_sns_to_slack/src/index.py

@@ -0,0 +1,39 @@
+#!/usr/bin/python
+
+from botocore.vendored import requests # https://stackoverflow.com/a/48495770
+import json
+import os
+import logging
+
+webhook_url = os.environ['slack']
+logger = logging.getLogger()
+logger.setLevel(logging.INFO)
+ 
+def lambda_hander(event, context):
+    logger.info(json.dumps(event))
+
+    for record in event['Records']:
+        process_event(json.loads(record['Sns']['Message']))
+
+def process_event(event):
+    event_detail = {}
+    if 'detail' in event:
+        event_detail = event['detail']
+    event_service = {}
+    if 'service' in event_detail:
+        event_service = event_detail['service']
+    
+    message = "{title}\n{description}\nnseverity: {severity}\neventFirstSeen: {eventFirstSeen}\nregion: {region}".format(
+        title = event_detail.get('title'),
+        description = event_detail.get('description'),
+        severity = event_detail.get('severity'),
+        eventFirstSeen = event_service.get('eventFirstSeen'),
+        region = event.get('region')
+    )
+    if event['detail']['severity'] > 3.9:
+        requests.post(webhook_url, data = json.dumps({
+            'text': message,
+            'username': 'GuardDuty',
+            'icon_emoji': ':rotating_light:',
+            'link_names': 1,
+        }))

guardduty_slack/lambda_sns_to_slack/temp/.gitignore

@@ -0,0 +1 @@
+*.zip

guardduty_slack/lambda_sns_to_slack/variables.tf

@@ -0,0 +1,3 @@
+variable "basename" {}
+
+variable "guardduty_slack_webhook_url" {}