Skip to content

Latest commit

 

History

History
702 lines (375 loc) · 21.7 KB

API.md

File metadata and controls

702 lines (375 loc) · 21.7 KB

API Reference

Structs

AspectPropsBase

The base aspect properties available to any aspect.

JSII doesn't support an Omit when extending interfaces, so we create a base class to extend from. This base class meets the needed properties for all non-base aspects.

Initializer 

import { AspectPropsBase } from '@renovosolutions/cdk-aspects-library-security-group'

const aspectPropsBase: AspectPropsBase = { ... }
annotationTextOptional 
public readonly annotationText: string;
  • Type: string

The annotation text to use for the annotation.

annotationTypeOptional 
public readonly annotationType: AnnotationType;

The annotation type to use for the annotation.

AspectPropsExtended

The extended aspect properties available only to the base security aspects.

These additional properties shouldn't be changed in aspects that already have clearly defined goals. So, this extended properties interface is applied selectively to the base aspects.

Initializer 

import { AspectPropsExtended } from '@renovosolutions/cdk-aspects-library-security-group'

const aspectPropsExtended: AspectPropsExtended = { ... }
annotationTextOptional 
public readonly annotationText: string;
  • Type: string

The annotation text to use for the annotation.

annotationTypeOptional 
public readonly annotationType: AnnotationType;

The annotation type to use for the annotation.

anySourceOptional 
public readonly anySource: boolean;
  • Type: boolean
  • Default: false

Whether any source is valid.

This will ignore all other restrictions and only check the port.

portsOptional 
public readonly ports: number[];
  • Type: number[]
  • Default: undefined

The restricted port.

Defaults to restricting all ports and only checking sources.

restrictedCidrsOptional 
public readonly restrictedCidrs: string[];
  • Type: string[]
  • Default: ['0.0.0.0/0', '::/0']

The restricted CIDRs for the given port.

restrictedSGsOptional 
public readonly restrictedSGs: string[];
  • Type: string[]
  • Default: undefined

The restricted source security groups for the given port.

RuleCheckArgs

The arguments for the checkRules function.

Extends the IAspectPropsBase interface which includes additional properties that can be used as args.

Initializer 

import { RuleCheckArgs } from '@renovosolutions/cdk-aspects-library-security-group'

const ruleCheckArgs: RuleCheckArgs = { ... }
annotationTextOptional 
public readonly annotationText: string;
  • Type: string

The annotation text to use for the annotation.

annotationTypeOptional 
public readonly annotationType: AnnotationType;

The annotation type to use for the annotation.

anySourceOptional 
public readonly anySource: boolean;
  • Type: boolean
  • Default: false

Whether any source is valid.

This will ignore all other restrictions and only check the port.

portsOptional 
public readonly ports: number[];
  • Type: number[]
  • Default: undefined

The restricted port.

Defaults to restricting all ports and only checking sources.

restrictedCidrsOptional 
public readonly restrictedCidrs: string[];
  • Type: string[]
  • Default: ['0.0.0.0/0', '::/0']

The restricted CIDRs for the given port.

restrictedSGsOptional 
public readonly restrictedSGs: string[];
  • Type: string[]
  • Default: undefined

The restricted source security groups for the given port.

nodeRequired 
public readonly node: IConstruct;

The node to check.

Classes

AWSRestrictedCommonPortsAspect

Restricted common ports based on AWS Config rule https://docs.aws.amazon.com/config/latest/developerguide/restricted-common-ports.html.

Initializers 

import { AWSRestrictedCommonPortsAspect } from '@renovosolutions/cdk-aspects-library-security-group'

new AWSRestrictedCommonPortsAspect(props?: AspectPropsBase)
propsOptional

CISAwsFoundationBenchmark4Dot1Aspect

CIS AWS Foundations Benchmark 4.1.

CIS recommends that no security group allow unrestricted ingress access to port 22. Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.

This aspect uses the NoPublicIngressSSHAspect with an alternate annotation text.

Initializers 

import { CISAwsFoundationBenchmark4Dot1Aspect } from '@renovosolutions/cdk-aspects-library-security-group'

new CISAwsFoundationBenchmark4Dot1Aspect(props?: AspectPropsBase)
propsOptional

CISAwsFoundationBenchmark4Dot2Aspect

CIS AWS Foundations Benchmark 4.2.

CIS recommends that no security group allow unrestricted ingress access to port 3389. Removing unfettered connectivity to remote console services, such as RDP, reduces a server's exposure to risk.

This aspect uses the NoPublicIngressRDPAspect with an alternate annotation text.

Initializers 

import { CISAwsFoundationBenchmark4Dot2Aspect } from '@renovosolutions/cdk-aspects-library-security-group'

new CISAwsFoundationBenchmark4Dot2Aspect(props?: AspectPropsBase)
propsOptional

NoIngressCommonManagementPortsAspect

Aspect to restrict any access to common management ports.

22 - SSH 3389 - RDP 5985 - WinRM 5986 - WinRM HTTPS

Initializers 

import { NoIngressCommonManagementPortsAspect } from '@renovosolutions/cdk-aspects-library-security-group'

new NoIngressCommonManagementPortsAspect(props?: AspectPropsBase)
propsOptional

NoIngressCommonRelationalDBPortsAspect

Aspect to restrict any access to common relational DB ports.

3306 - MySQL 5432 - PostgreSQL 1521 - Oracle 1433 - SQL Server

Initializers 

import { NoIngressCommonRelationalDBPortsAspect } from '@renovosolutions/cdk-aspects-library-security-group'

new NoIngressCommonRelationalDBPortsAspect(props?: AspectPropsBase)
propsOptional

NoIngressCommonWebPortsAspect

Aspect to restrict any access to common web ports.

80 - HTTP 443 - HTTPS 8080 - HTTP 8443 - HTTPS

Initializers 

import { NoIngressCommonWebPortsAspect } from '@renovosolutions/cdk-aspects-library-security-group'

new NoIngressCommonWebPortsAspect(props?: AspectPropsBase)
propsOptional

NoPublicIngressAspect

The same as the base NoPublicIngressAspectBase but with a more descriptive annotation.

Blocks the ANY port from the public internet.

Initializers 

import { NoPublicIngressAspect } from '@renovosolutions/cdk-aspects-library-security-group'

new NoPublicIngressAspect(props?: AspectPropsBase)
propsOptional

NoPublicIngressAspectBase

The base aspect to determine if a security group allows inbound traffic from the public internet to any port.

This inherits everything from the base SecurityGroupAspectBase class and sets a default set of CIDRS that match allowing all IPs on AWS.

Initializers 

import { NoPublicIngressAspectBase } from '@renovosolutions/cdk-aspects-library-security-group'

new NoPublicIngressAspectBase(props?: AspectPropsBase)
propsOptional

NoPublicIngressCommonManagementPortsAspect

Aspect to restrict public access to common management ports.

22 - SSH 3389 - RDP 5985 - WinRM 5986 - WinRM HTTPS

Initializers 

import { NoPublicIngressCommonManagementPortsAspect } from '@renovosolutions/cdk-aspects-library-security-group'

new NoPublicIngressCommonManagementPortsAspect(props?: AspectPropsBase)
propsOptional

NoPublicIngressCommonRelationalDBPortsAspect

Aspect to restrict public access to common relational DB ports.

3306 - MySQL 5432 - PostgreSQL 1521 - Oracle 1433 - SQL Server

Initializers 

import { NoPublicIngressCommonRelationalDBPortsAspect } from '@renovosolutions/cdk-aspects-library-security-group'

new NoPublicIngressCommonRelationalDBPortsAspect(props?: AspectPropsBase)
propsOptional

NoPublicIngressCommonWebPortsAspect

Aspect to restrict public access to common web ports.

80 - HTTP 443 - HTTPS 8080 - HTTP 8443 - HTTPS

Initializers 

import { NoPublicIngressCommonWebPortsAspect } from '@renovosolutions/cdk-aspects-library-security-group'

new NoPublicIngressCommonWebPortsAspect(props?: AspectPropsBase)
propsOptional

NoPublicIngressRDPAspect

Aspect to determine if a security group allows inbound traffic from the public internet to the RDP port.

Initializers 

import { NoPublicIngressRDPAspect } from '@renovosolutions/cdk-aspects-library-security-group'

new NoPublicIngressRDPAspect(props?: AspectPropsBase)
propsOptional

NoPublicIngressSSHAspect

Aspect to determine if a security group allows inbound traffic from the public internet to the SSH port.

Initializers 

import { NoPublicIngressSSHAspect } from '@renovosolutions/cdk-aspects-library-security-group'

new NoPublicIngressSSHAspect(props?: AspectPropsBase)
propsOptional

SecurityGroupAspectBase

The base class for all security group aspects in the library.

By default this will not restrict anything.

Initializers 

import { SecurityGroupAspectBase } from '@renovosolutions/cdk-aspects-library-security-group'

new SecurityGroupAspectBase(props?: AspectPropsExtended)
propsOptional

Methods

visit 
public visit(node: IConstruct)
nodeRequired

Properties

annotationTextRequired 
public readonly annotationText: string;
  • Type: string
annotationTypeRequired 
public readonly annotationType: AnnotationType;
anySourceRequired 
public readonly anySource: boolean;
  • Type: boolean
portsOptional 
public readonly ports: number[];
  • Type: number[]
restrictedCidrsOptional 
public readonly restrictedCidrs: string[];
  • Type: string[]
restrictedSGsOptional 
public readonly restrictedSGs: string[];
  • Type: string[]

Enums

AnnotationType

The supported annotation types.

Only error will stop deployment of restricted resources.

WARNING

ERROR

INFO