github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/aws/cloudwatch/require_vpc_change_alarm.go (about)

     1  package cloudwatch
     2  
     3  import (
     4  	"github.com/khulnasoft-lab/defsec/internal/rules"
     5  	"github.com/khulnasoft-lab/defsec/pkg/framework"
     6  	"github.com/khulnasoft-lab/defsec/pkg/providers"
     7  	"github.com/khulnasoft-lab/defsec/pkg/providers/aws/cloudwatch"
     8  	"github.com/khulnasoft-lab/defsec/pkg/scan"
     9  	"github.com/khulnasoft-lab/defsec/pkg/severity"
    10  	"github.com/khulnasoft-lab/defsec/pkg/state"
    11  	"github.com/khulnasoft-lab/defsec/pkg/types"
    12  )
    13  
    14  var requireVPCChangeAlarm = rules.Register(
    15  	scan.Rule{
    16  		AVDID:      "AVD-AWS-0160",
    17  		Provider:   providers.AWSProvider,
    18  		Service:    "cloudwatch",
    19  		ShortCode:  "require-vpc-changes-alarm",
    20  		Summary:    "Ensure a log metric filter and alarm exist for VPC changes",
    21  		Impact:     "Route tables control the flow of network traffic, changes could be made to maliciously allow egress of data or external ingress. Without alerting, this could go unnoticed.",
    22  		Resolution: "Create an alarm to alert on route table changes",
    23  		Frameworks: map[framework.Framework][]string{
    24  			framework.CIS_AWS_1_2: {
    25  				"3.14",
    26  			},
    27  			framework.CIS_AWS_1_4: {
    28  				"4.14",
    29  			},
    30  		},
    31  		Explanation: `You can do real-time monitoring of API calls by directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms.   
    32  You can have more than one VPC in an account, and you can create a peer connection between two VPCs, enabling network traffic to route between VPCs.
    33                                                                                
    34  CIS recommends that you create a metric filter and alarm for changes to VPCs. Monitoring these changes helps ensure that authentication and authorization controls remain intact.  `,
    35  		Links: []string{
    36  			"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
    37  		},
    38  		Terraform:      &scan.EngineMetadata{},
    39  		CloudFormation: &scan.EngineMetadata{},
    40  		Severity:       severity.Low,
    41  	},
    42  	func(s *state.State) (results scan.Results) {
    43  
    44  		multiRegionTrails := s.AWS.CloudTrail.MultiRegionTrails()
    45  		for _, trail := range multiRegionTrails {
    46  			logGroup := s.AWS.CloudWatch.GetLogGroupByArn(trail.CloudWatchLogsLogGroupArn.Value())
    47  			if logGroup == nil || trail.IsLogging.IsFalse() {
    48  				continue
    49  			}
    50  
    51  			var metricFilter cloudwatch.MetricFilter
    52  			var found bool
    53  			for _, filter := range logGroup.MetricFilters {
    54  				if filter.FilterPattern.Contains(`{($.eventName=CreateVpc) || 
    55  					($.eventName=DeleteVpc) || ($.eventName=ModifyVpcAttribute) || 
    56  					($.eventName=AcceptVpcPeeringConnection) || ($.eventName=CreateVpcPeeringConnection) || 
    57  					($.eventName=DeleteVpcPeeringConnection) || ($.eventName=RejectVpcPeeringConnection) || 
    58  					($.eventName=AttachClassicLinkVpc) || ($.eventName=DetachClassicLinkVpc) || 
    59  					($.eventName=DisableVpcClassicLink) || ($.eventName=EnableVpcClassicLink)}`, types.IgnoreWhitespace) {
    60  					metricFilter = filter
    61  					found = true
    62  					break
    63  				}
    64  			}
    65  
    66  			if !found {
    67  				results.Add("Cloudtrail has no vpc change log filter", trail)
    68  				continue
    69  			}
    70  
    71  			if metricAlarm := s.AWS.CloudWatch.GetAlarmByMetricName(metricFilter.FilterName.Value()); metricAlarm == nil {
    72  				results.Add("Cloudtrail has no vpc change alarm", trail)
    73  				continue
    74  			}
    75  
    76  			results.AddPassed(trail)
    77  		}
    78  
    79  		return
    80  	},
    81  )