1
|
|
|
import abc |
2
|
|
|
import json, boto3 |
3
|
|
|
import botocore.exceptions |
4
|
|
|
|
5
|
|
|
import backoff |
6
|
|
|
|
7
|
|
|
from awslambdahelper.evaluation import AWSConfigEvaluation |
8
|
|
|
|
9
|
|
|
MAX_BACKOFF_TRIES = 100 |
10
|
|
|
|
11
|
|
|
class AWSConfigRule(object): |
12
|
|
|
""" |
13
|
|
|
Defines the business logic for processing either scheduled or config change AWS Config rules |
14
|
|
|
""" |
15
|
|
|
#: Specifies an AWS Config Rule which is triggered by a resource configuration |
16
|
|
|
CALL_TYPE_CONFIGURATION_CHANGE = 'ConfigurationItemChangeNotification' |
17
|
|
|
#: Specifies an AWS Config Rule which is triggered on a scheduled basis |
18
|
|
|
CALL_TYPE_SCHEDULED = 'ScheduledNotification' |
19
|
|
|
#: List of resources which this rule can evaluate. Only application for ConfigurationChange rules. |
20
|
|
|
APPLICABLE_RESOURCES = [] |
21
|
|
|
|
22
|
|
|
@classmethod |
23
|
|
|
def handler(cls, event, context): |
24
|
|
|
""" |
25
|
|
|
Allow a single entrypoint without extra boilerplate code. |
26
|
|
|
|
27
|
|
|
>>> from awslambdahelper import AWSConfigRule,InsufficientDataEvaluation |
28
|
|
|
>>> class MyAwesomeRule(AWSConfigRule): |
29
|
|
|
... APPLICABLE_RESOURCES = ["AWS::EC2::Instance"] |
30
|
|
|
... def find_violation_config_change(self, rule_parameters, config): |
31
|
|
|
... return [InsufficientDataEvaluation()] |
32
|
|
|
>>> |
33
|
|
|
>>> # The entrypoint for lambda would be set as "file_name.MyAwesomeRule.handler" |
34
|
|
|
|
35
|
|
|
:param event: See `Event Attributes |
36
|
|
|
<http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_example-events.html#w2ab1c13c33c27c15c15>`_ |
37
|
|
|
in the AWS Config Developer guide. |
38
|
|
|
:type event: dict |
39
|
|
|
:param context: See `Context Object <http://docs.aws.amazon.com/lambda/latest/dg/python-context-object.html#python-context-object-methods>`_ |
40
|
|
|
:type context: dict |
41
|
|
|
:return: |
42
|
|
|
""" |
43
|
|
|
rule = cls(cls.APPLICABLE_RESOURCES) |
44
|
|
|
rule.lambda_handler(event, context) |
45
|
|
|
|
46
|
|
|
def __init__(self, applicable_resources=None): |
47
|
|
|
""" |
48
|
|
|
If this rule is for handling ConfigurationChange events, then the "Applicable Resources" attribute must be set. |
49
|
|
|
If this is for handling Scheduled events, then no item is required. |
50
|
|
|
|
51
|
|
|
:param applicable_resources: A list of AWS resources which this rule evaluates. Only applicable for |
52
|
|
|
Configuration Change rules, and not Scheduled rules. See `Evaluating Additional Resource Types |
53
|
|
|
<http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs.html#creating-custom-rules-for-additional-resource-types>`_, |
54
|
|
|
and |
55
|
|
|
`Supported AWS Resource Types <http://docs.aws.amazon.com/config/latest/developerguide/resource-config-reference.html#supported-resources>`_. |
56
|
|
|
:type applicable_resources: Union[List,Tuple] |
57
|
|
|
""" |
58
|
|
|
if applicable_resources is None: |
59
|
|
|
self.applicable_resources = self.APPLICABLE_RESOURCES |
60
|
|
|
else: |
61
|
|
|
self.applicable_resources = applicable_resources |
62
|
|
|
self.call_type = None |
63
|
|
|
|
64
|
|
|
@property |
65
|
|
|
def is_config_change_call(self): |
66
|
|
|
return self.call_type == self.CALL_TYPE_CONFIGURATION_CHANGE |
67
|
|
|
|
68
|
|
|
@property |
69
|
|
|
def is_scheduled_call(self): |
70
|
|
|
return self.call_type == self.CALL_TYPE_SCHEDULED |
71
|
|
|
|
72
|
|
|
@staticmethod |
73
|
|
|
def put_evaluations(*args, **kwargs): |
74
|
|
|
return boto3.client("config").put_evaluations( |
75
|
|
|
*args, **kwargs |
76
|
|
|
) |
77
|
|
|
|
78
|
|
|
def lambda_handler(self, event, context): |
79
|
|
|
""" |
80
|
|
|
.. deprecated:: 1.1.4 |
81
|
|
|
Use :py:meth:`~awslambdahelper.AWSConfigRule.handler` |
82
|
|
|
""" |
83
|
|
|
invoking_event = json.loads(event["invokingEvent"]) |
84
|
|
|
if 'ruleParameters' in event: |
85
|
|
|
rule_parameters = json.loads(event["ruleParameters"]) |
86
|
|
|
else: |
87
|
|
|
rule_parameters = {} |
88
|
|
|
|
89
|
|
|
self.call_type = invoking_event['messageType'] |
90
|
|
|
|
91
|
|
|
result_token = "No token found." |
92
|
|
|
if "resultToken" in event: |
93
|
|
|
result_token = event["resultToken"] |
94
|
|
|
|
95
|
|
|
evaluations = [] |
96
|
|
|
|
97
|
|
|
if self.is_config_change_call: |
98
|
|
|
|
99
|
|
|
configuration_item = invoking_event["configurationItem"] |
100
|
|
|
evaluation_responses = self.evaluate_compliance( |
101
|
|
|
config=configuration_item, |
102
|
|
|
rule_parameters=rule_parameters, |
103
|
|
|
event=event |
104
|
|
|
) |
105
|
|
|
|
106
|
|
|
for evaluation_response in evaluation_responses: |
107
|
|
|
evaluation = evaluation_response.set( |
108
|
|
|
ResourceType=configuration_item["resourceType"], |
109
|
|
|
ResourceId=configuration_item["resourceId"], |
110
|
|
|
OrderingTimestamp=configuration_item["configurationItemCaptureTime"] |
111
|
|
|
).to_dict() |
112
|
|
|
evaluations.append(evaluation) |
113
|
|
|
else: |
114
|
|
|
evaluation_responses = self.evaluate_compliance( |
115
|
|
|
rule_parameters=rule_parameters, |
116
|
|
|
event=event |
117
|
|
|
) |
118
|
|
|
|
119
|
|
|
for evaluation_response in evaluation_responses: |
120
|
|
|
evaluations.append(evaluation_response.set( |
121
|
|
|
OrderingTimestamp=invoking_event["notificationCreationTime"] |
122
|
|
|
).to_dict()) |
123
|
|
|
|
124
|
|
|
chunk_size = 100 |
125
|
|
|
for evaluation_chunk in range(0, len(evaluations), chunk_size): |
126
|
|
|
self.put_evaluations( |
127
|
|
|
Evaluations=evaluations[evaluation_chunk:evaluation_chunk + chunk_size], |
128
|
|
|
ResultToken=result_token |
129
|
|
|
) |
130
|
|
|
|
131
|
|
|
def evaluate_compliance(self, rule_parameters, event, config=None): |
132
|
|
|
""" |
133
|
|
|
A facade to delegate the event to either the :py:meth:`~awslambdahelper.AWSConfigRule.find_violation_config_change`, or |
134
|
|
|
:py:meth:`~awslambdahelper.AWSConfigRule.find_violation_scheduled`. |
135
|
|
|
|
136
|
|
|
:param rule_parameters: A list of key/pairs which are to be provided to the rule. |
137
|
|
|
:type: dict |
138
|
|
|
:param event: |
139
|
|
|
:param config: |
140
|
|
|
:return: |
141
|
|
|
""" |
142
|
|
|
if self.is_config_change_call: |
143
|
|
|
if config["resourceType"] not in self.applicable_resources: |
144
|
|
|
return [NotApplicableEvaluation( |
145
|
|
|
ResourceType=config["resourceType"], |
146
|
|
|
)] |
147
|
|
|
|
148
|
|
|
violations = self.find_violation_config_change( |
149
|
|
|
rule_parameters=rule_parameters, |
150
|
|
|
config=config |
151
|
|
|
) |
152
|
|
|
else: |
153
|
|
|
violations = self.find_violation_scheduled( |
154
|
|
|
rule_parameters=rule_parameters, |
155
|
|
|
accountid=event['accountId'] |
156
|
|
|
) |
157
|
|
|
|
158
|
|
|
return violations |
159
|
|
|
|
160
|
|
|
@backoff.on_exception(backoff.expo, |
161
|
|
|
botocore.exceptions.ClientError, |
162
|
|
|
max_tries=MAX_BACKOFF_TRIES, |
163
|
|
|
jitter=backoff.full_jitter) |
164
|
|
|
def _aws_call(self, callable): |
165
|
|
|
""" |
166
|
|
|
Wrapper to ease testing. |
167
|
|
|
Decorators make mocking functions that just little bit harder. For this reason, pass |
168
|
|
|
a callable into this method which can handle our AWS calls. |
169
|
|
|
|
170
|
|
|
:param callable: |
171
|
|
|
:return: |
172
|
|
|
""" |
173
|
|
|
return callable() |
174
|
|
|
|
175
|
|
|
def find_violation_config_change(self, rule_parameters, config): |
176
|
|
|
""" |
177
|
|
|
Place holder function for configuration change rules. Needs to be overriden by super class. |
178
|
|
|
|
179
|
|
|
:raises: NotImplementedError |
180
|
|
|
:param rule_parameters: |
181
|
|
|
:param config: |
182
|
|
|
:return: None |
183
|
|
|
""" |
184
|
|
|
raise NotImplementedError(type(self).__name__ + ":find_violation_config_change() is not implemented.") |
185
|
|
|
|
186
|
|
|
def find_violation_scheduled(self, rule_parameters, accountid): |
187
|
|
|
""" |
188
|
|
|
Place holder function for configuration change rules. Needs to be overriden by super class. |
189
|
|
|
|
190
|
|
|
:param rule_parameters: |
191
|
|
|
:param accountid: |
192
|
|
|
:return: None |
193
|
|
|
""" |
194
|
|
|
raise NotImplementedError(type(self).__name__ + ":find_violation_scheduled() is not implemented.") |
195
|
|
|
|
196
|
|
|
|
197
|
|
|
class CompliantEvaluation(AWSConfigEvaluation): |
198
|
|
|
""" |
199
|
|
|
A rule is compliant if all of the resources that the rule evaluates comply with it, |
200
|
|
|
""" |
201
|
|
|
|
202
|
|
|
def __init__(self, Annotation="This resource is compliant with the rule.", ResourceType=None, |
203
|
|
|
ResourceId=None, |
204
|
|
|
OrderingTimestamp=None): |
205
|
|
|
""" |
206
|
|
|
:param Annotation: An explanation to attach to the evaluation result. Shown in the AWS Config Console. |
207
|
|
|
:type Annotation: str |
208
|
|
|
:param ResourceType: A list of AWS resources which this rule evaluates. See `Evaluating Additional Resource Types |
209
|
|
|
<http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs.html#creating-custom-rules-for-additional-resource-types>`_, |
210
|
|
|
and |
211
|
|
|
`Supported AWS Resource Types <http://docs.aws.amazon.com/config/latest/developerguide/resource-config-reference.html#supported-resources>`_. |
212
|
|
|
:type ResourceType: str |
213
|
|
|
:param ResourceId: The id (eg, id-000000) or the ARN (eg, arn:aws:iam:01234567890:eu-west-1:..) for the resource |
214
|
|
|
:param OrderingTimestamp: The time of the event in AWS Config that triggered the evaluation. |
215
|
|
|
""" |
216
|
|
|
super(CompliantEvaluation, self).__init__( |
217
|
|
|
AWSConfigEvaluation.TYPE_COMPLIANT, |
218
|
|
|
Annotation, |
219
|
|
|
ResourceType=ResourceType, |
220
|
|
|
ResourceId=ResourceId, |
221
|
|
|
OrderingTimestamp=OrderingTimestamp, |
222
|
|
|
) |
223
|
|
|
|
224
|
|
|
|
225
|
|
|
class NonCompliantEvaluation(AWSConfigEvaluation): |
226
|
|
|
""" |
227
|
|
|
A rule is noncompliant if any of these resources do not comply. |
228
|
|
|
""" |
229
|
|
|
|
230
|
|
|
def __init__(self, Annotation, ResourceType=None, ResourceId=None, |
231
|
|
|
OrderingTimestamp=None): |
232
|
|
|
""" |
233
|
|
|
:param Annotation: An explanation to attach to the evaluation result. Shown in the AWS Config Console. |
234
|
|
|
:type Annotation: str |
235
|
|
|
:param ResourceType: A list of AWS resources which this rule evaluates. See `Evaluating Additional Resource Types |
236
|
|
|
<http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs.html#creating-custom-rules-for-additional-resource-types>`_, |
237
|
|
|
and |
238
|
|
|
`Supported AWS Resource Types <http://docs.aws.amazon.com/config/latest/developerguide/resource-config-reference.html#supported-resources>`_. |
239
|
|
|
:type ResourceType: str |
240
|
|
|
:param ResourceId: The id (eg, id-000000) or the ARN (eg, arn:aws:iam:01234567890:eu-west-1:..) for the resource |
241
|
|
|
:param OrderingTimestamp: The time of the event in AWS Config that triggered the evaluation. |
242
|
|
|
""" |
243
|
|
|
super(NonCompliantEvaluation, self).__init__( |
244
|
|
|
AWSConfigEvaluation.TYPE_NON_COMPLIANT, |
245
|
|
|
Annotation, |
246
|
|
|
ResourceType=ResourceType, |
247
|
|
|
ResourceId=ResourceId, |
248
|
|
|
OrderingTimestamp=OrderingTimestamp |
249
|
|
|
) |
250
|
|
|
|
251
|
|
|
|
252
|
|
|
class NotApplicableEvaluation(AWSConfigEvaluation): |
253
|
|
|
""" |
254
|
|
|
This resource is not applicable for this rule. |
255
|
|
|
""" |
256
|
|
|
|
257
|
|
|
def __init__(self, ResourceType, ResourceId=None, |
258
|
|
|
OrderingTimestamp=None): |
259
|
|
|
""" |
260
|
|
|
:param ResourceType: A list of AWS resources which this rule evaluates. See `Evaluating Additional Resource Types |
261
|
|
|
<http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs.html#creating-custom-rules-for-additional-resource-types>`_, |
262
|
|
|
and |
263
|
|
|
`Supported AWS Resource Types <http://docs.aws.amazon.com/config/latest/developerguide/resource-config-reference.html#supported-resources>`_. |
264
|
|
|
:type ResourceType: str |
265
|
|
|
:param ResourceId: The id (eg, id-000000) or the ARN (eg, arn:aws:iam:01234567890:eu-west-1:..) for the resource |
266
|
|
|
:param OrderingTimestamp: The time of the event in AWS Config that triggered the evaluation. |
267
|
|
|
""" |
268
|
|
|
super(NotApplicableEvaluation, self).__init__( |
269
|
|
|
AWSConfigEvaluation.TYPE_NOT_APPLICABLE, |
270
|
|
|
"The rule doesn't apply to resources of type " + ResourceType + ".", |
271
|
|
|
ResourceType=ResourceType, |
272
|
|
|
ResourceId=ResourceId, |
273
|
|
|
OrderingTimestamp=OrderingTimestamp |
274
|
|
|
) |
275
|
|
|
|
276
|
|
|
|
277
|
|
|
class InsufficientDataEvaluation(AWSConfigEvaluation): |
278
|
|
|
""" |
279
|
|
|
AWS Config returns the INSUFFICIENT_DATA value when no evaluation results are available for the AWS resource or |
280
|
|
|
Config rule. |
281
|
|
|
""" |
282
|
|
|
|
283
|
|
|
def __init__(self, Annotation, ResourceType=None, ResourceId=None, |
284
|
|
|
OrderingTimestamp=None): |
285
|
|
|
""" |
286
|
|
|
:param Annotation: An explanation to attach to the evaluation result. Shown in the AWS Config Console. |
287
|
|
|
:type Annotation: str |
288
|
|
|
:param ResourceType: A list of AWS resources which this rule evaluates. See `Evaluating Additional Resource Types |
289
|
|
|
<http://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_develop-rules_nodejs.html#creating-custom-rules-for-additional-resource-types>`_, |
290
|
|
|
and |
291
|
|
|
`Supported AWS Resource Types <http://docs.aws.amazon.com/config/latest/developerguide/resource-config-reference.html#supported-resources>`_. |
292
|
|
|
:type ResourceType: str |
293
|
|
|
:param ResourceId: The id (eg, id-000000) or the ARN (eg, arn:aws:iam:01234567890:eu-west-1:..) for the resource |
294
|
|
|
:type ResourceId: str |
295
|
|
|
:param OrderingTimestamp: The time of the event in AWS Config that triggered the evaluation. |
296
|
|
|
""" |
297
|
|
|
super(InsufficientDataEvaluation, self).__init__( |
298
|
|
|
AWSConfigEvaluation.TYPE_INSUFFICIENT_DATA, |
299
|
|
|
Annotation, |
300
|
|
|
ResourceType=ResourceType, |
301
|
|
|
ResourceId=ResourceId, |
302
|
|
|
OrderingTimestamp=OrderingTimestamp |
303
|
|
|
) |
304
|
|
|
|