-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathtemplate.yaml
187 lines (187 loc) · 6.88 KB
/
template.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
AWSTemplateFormatVersion: 2010-09-09
Transform: AWS::Serverless-2016-10-31
Parameters:
FunctionShieldToken:
Description: To get a token please visit http://bit.ly/2AaBJ3x
Type: String
Default: UNDEFINED
Resources:
#############################################################
# Detect functions that are created through the console #
#############################################################
FunctionForLambdaFunctionCreatedInConsole:
Type: AWS::Serverless::Function
Properties:
FunctionName: config-rule-lambda-function-created-in-console
CodeUri: src/
Handler: lambda_function_created_in_console.handler
Runtime: nodejs8.10
MemorySize: 128
Timeout: 300
ReservedConcurrentExecutions: 1
Tracing: Active
Environment:
Variables:
FUNCTION_SHIELD_TOKEN: !Ref FunctionShieldToken
Policies:
- Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- config:PutEvaluations
- lambda:ListFunctions
- cloudtrail:LookupEvents
Resource: '*'
ConfigRuleForLambdaFunctionCreatedInConsole:
Type: AWS::Config::ConfigRule
Properties:
ConfigRuleName: lambda-function-created-in-console
Description: Lambda functions should be created by CI/CD process.
Source:
Owner: CUSTOM_LAMBDA
SourceIdentifier: !GetAtt FunctionForLambdaFunctionCreatedInConsole.Arn
SourceDetails:
- EventSource: aws.config
MessageType: ScheduledNotification
DependsOn:
- PermissionForLambdaFunctionCreatedInConsole
PermissionForLambdaFunctionCreatedInConsole:
Type: AWS::Lambda::Permission
Properties:
FunctionName: !GetAtt FunctionForLambdaFunctionCreatedInConsole.Arn
Action: lambda:InvokeFunction
Principal: config.amazonaws.com
#############################################################
# Detect functions that share iam role #
#############################################################
FunctionForLambdaFunctionSharedRole:
Type: AWS::Serverless::Function
Properties:
FunctionName: config-rule-lambda-function-shared-role
CodeUri: src/
Handler: lambda_function_shared_role.handler
Runtime: nodejs8.10
MemorySize: 128
Timeout: 300
ReservedConcurrentExecutions: 1
Tracing: Active
Environment:
Variables:
FUNCTION_SHIELD_TOKEN: !Ref FunctionShieldToken
Policies:
- Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- config:PutEvaluations
- lambda:ListFunctions
Resource: '*'
ConfigRuleForLambdaFunctionSharedRole:
Type: AWS::Config::ConfigRule
Properties:
ConfigRuleName: lambda-function-shared-role
Description: Each Lambda function should have its own IAM role
Source:
Owner: CUSTOM_LAMBDA
SourceIdentifier: !GetAtt FunctionForLambdaFunctionSharedRole.Arn
SourceDetails:
- EventSource: aws.config
MessageType: ScheduledNotification
DependsOn:
- PermissionForLambdaFunctionSharedRole
PermissionForLambdaFunctionSharedRole:
Type: AWS::Lambda::Permission
Properties:
FunctionName: !GetAtt FunctionForLambdaFunctionSharedRole.Arn
Action: lambda:InvokeFunction
Principal: config.amazonaws.com
#############################################################
# Detect functions with multiple triggers #
#############################################################
FunctionForLambdaFunctionWithMultipleTriggers:
Type: AWS::Serverless::Function
Properties:
FunctionName: config-rule-lambda-function-with-multiple-triggers
CodeUri: src/
Handler: lambda_function_with_multiple_triggers.handler
Runtime: nodejs8.10
MemorySize: 128
Timeout: 300
ReservedConcurrentExecutions: 1
Tracing: Active
Environment:
Variables:
FUNCTION_SHIELD_TOKEN: !Ref FunctionShieldToken
Policies:
- Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- config:PutEvaluations
- lambda:ListFunctions
- lambda:GetPolicy
Resource: '*'
ConfigRuleForLambdaFunctionWithMultipleTriggers:
Type: AWS::Config::ConfigRule
Properties:
ConfigRuleName: lambda-function-with-multiple-triggers
Description: Each Lambda function should be triggered by one event source
Source:
Owner: CUSTOM_LAMBDA
SourceIdentifier: !GetAtt FunctionForLambdaFunctionWithMultipleTriggers.Arn
SourceDetails:
- EventSource: aws.config
MessageType: ScheduledNotification
DependsOn:
- PermissionForLambdaFunctionWithMultipleTriggers
PermissionForLambdaFunctionWithMultipleTriggers:
Type: AWS::Lambda::Permission
Properties:
FunctionName: !GetAtt FunctionForLambdaFunctionWithMultipleTriggers.Arn
Action: lambda:InvokeFunction
Principal: config.amazonaws.com
#############################################################
# Detect functions with wildcard action permission #
#############################################################
FunctionForLambdaFunctionWithWildcardActionPermission:
Type: AWS::Serverless::Function
Properties:
FunctionName: config-rule-lambda-function-with-wildcard-action-permission
CodeUri: src/
Handler: lambda_function_with_wildcard_action_permission.handler
Runtime: nodejs8.10
MemorySize: 128
Timeout: 300
ReservedConcurrentExecutions: 1
Tracing: Active
Environment:
Variables:
FUNCTION_SHIELD_TOKEN: !Ref FunctionShieldToken
Policies:
- Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- config:PutEvaluations
- lambda:ListFunctions
- iam:GetAccountAuthorizationDetails
Resource: '*'
ConfigRuleForLambdaFunctionWithWildcardActionPermission:
Type: AWS::Config::ConfigRule
Properties:
ConfigRuleName: lambda-function-with-wildcard-action-permission
Description: Actions in Lambda permissions should not contain wildcards
Source:
Owner: CUSTOM_LAMBDA
SourceIdentifier: !GetAtt FunctionForLambdaFunctionWithWildcardActionPermission.Arn
SourceDetails:
- EventSource: aws.config
MessageType: ScheduledNotification
DependsOn:
- PermissionForLambdaFunctionWithWildcardActionPermission
PermissionForLambdaFunctionWithWildcardActionPermission:
Type: AWS::Lambda::Permission
Properties:
FunctionName: !GetAtt FunctionForLambdaFunctionWithWildcardActionPermission.Arn
Action: lambda:InvokeFunction
Principal: config.amazonaws.com