{ "Description": "(SO0111M) Automated Security Response on AWS Member Account Stack, v4.0.2", "AWSTemplateFormatVersion": "2010-09-09", "Metadata": { "AWS::CloudFormation::Interface": { "ParameterGroups": [ { "Label": { "default": "LogGroup Configuration" }, "Parameters": [ "LogGroupName" ] }, { "Label": { "default": "Consolidated control finding Playbook" }, "Parameters": [ "LoadSCMemberStack" ] }, { "Label": { "default": "Security Standard Playbooks" }, "Parameters": [ "LoadAFSBPMemberStack", "LoadCIS120MemberStack", "LoadCIS140MemberStack", "LoadCIS300MemberStack", "LoadNIST80053MemberStack", "LoadPCI321MemberStack" ] }, { "Label": { "default": "Configuration" }, "Parameters": [ "CreateS3BucketForRedshiftAuditLogging", "SecHubAdminAccount", "Namespace" ] } ], "ParameterLabels": { "LogGroupName": { "default": "Provide the name of the LogGroup to be used to create Metric Filters and Alarms" } } } }, "Parameters": { "SecHubAdminAccount": { "Type": "String", "AllowedPattern": "^\\d{12}$", "Description": "Admin account number" }, "Namespace": { "Type": "String", "AllowedPattern": "(?!(^xn--|^sthree-|^sthree-configurator|^amzn-s3-demo-|.+-s3alias|.+--ol-s3|.+.mrap|.+--x-s3$))^[a-z0-9][a-z0-9-]{1,7}[a-z0-9]$", "ConstraintDescription": "The Namespace parameter must follow naming restrictions for S3 buckets and have a minimum length of 3 and a maximum length of 9. https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html", "Description": "Choose a unique namespace to be added as a suffix to remediation IAM role names. The same namespace should be used in the Member Roles and Member stacks. This string should be unique for each solution deployment, but does not need to be changed during stack updates.", "MaxLength": 9, "MinLength": 3 }, "EnableCloudTrailForASRActionLog": { "Type": "String", "Default": "no", "AllowedValues": [ "yes", "no" ], "Description": "Create a CloudTrail to monitor ASR actions in this account on the ASR CloudWatch Dashboard. " }, "CreateS3BucketForRedshiftAuditLogging": { "Type": "String", "Default": "no", "AllowedValues": [ "yes", "no" ], "Description": "Create S3 Bucket For Redshift Cluster Audit Logging." }, "LogGroupName": { "Type": "String", "Description": "Name of the log group to be used to create metric filters and cloudwatch alarms. You must use a Log Group that is the the logging destination of a multi-region CloudTrail. Mandatory to use certain CloudWatch controls (e.g. PCI.CW.1).", "MinLength": 1 }, "LoadAFSBPMemberStack": { "Type": "String", "Default": "no", "AllowedValues": [ "yes", "no" ], "Description": "Install the member components for automated remediation of AFSBP controls?" }, "LoadCIS120MemberStack": { "Type": "String", "Default": "no", "AllowedValues": [ "yes", "no" ], "Description": "Install the member components for automated remediation of CIS120 controls?" }, "LoadCIS140MemberStack": { "Type": "String", "Default": "no", "AllowedValues": [ "yes", "no" ], "Description": "Install the member components for automated remediation of CIS140 controls?" }, "LoadNIST80053MemberStack": { "Type": "String", "Default": "no", "AllowedValues": [ "yes", "no" ], "Description": "Install the member components for automated remediation of NIST80053 controls?" }, "LoadPCI321MemberStack": { "Type": "String", "Default": "no", "AllowedValues": [ "yes", "no" ], "Description": "Install the member components for automated remediation of PCI321 controls?" }, "LoadCIS300MemberStack": { "Type": "String", "Default": "no", "AllowedValues": [ "yes", "no" ], "Description": "Install the member components for automated remediation of CIS300 controls?" }, "LoadSCMemberStack": { "Type": "String", "Default": "yes", "AllowedValues": [ "yes", "no" ], "Description": "If the consolidated control findings feature is turned on in Security Hub, only enable the Security Control (SC) playbook. If the feature is not turned on, enable the playbooks for the security standards that are enabled in Security Hub. Enabling additional playbooks can result in reaching the quota for EventBridge Rules." } }, "Conditions": { "CloudTrailCondition": { "Fn::Equals": [ { "Ref": "EnableCloudTrailForASRActionLog" }, "yes" ] }, "EnableS3BucketForRedShift4": { "Fn::Equals": [ { "Ref": "CreateS3BucketForRedshiftAuditLogging" }, "yes" ] }, "loadAFSBPCond": { "Fn::Equals": [ { "Ref": "LoadAFSBPMemberStack" }, "yes" ] }, "loadAFSBP1Cond": { "Fn::Equals": [ { "Ref": "LoadAFSBPMemberStack" }, "yes" ] }, "loadCIS120Cond": { "Fn::Equals": [ { "Ref": "LoadCIS120MemberStack" }, "yes" ] }, "loadCIS140Cond": { "Fn::Equals": [ { "Ref": "LoadCIS140MemberStack" }, "yes" ] }, "loadNIST80053Cond": { "Fn::Equals": [ { "Ref": "LoadNIST80053MemberStack" }, "yes" ] }, "loadNIST800531Cond": { "Fn::Equals": [ { "Ref": "LoadNIST80053MemberStack" }, "yes" ] }, "loadPCI321Cond": { "Fn::Equals": [ { "Ref": "LoadPCI321MemberStack" }, "yes" ] }, "loadCIS300Cond": { "Fn::Equals": [ { "Ref": "LoadCIS300MemberStack" }, "yes" ] }, "loadSCCond": { "Fn::Equals": [ { "Ref": "LoadSCMemberStack" }, "yes" ] }, "loadSC1Cond": { "Fn::Equals": [ { "Ref": "LoadSCMemberStack" }, "yes" ] } }, "Resources": { "S3BucketForRedShiftAuditLogging652E7355": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "guard": { "SuppressedRules": [ "S3_BUCKET_LOGGING_ENABLED" ] } }, "Condition": "EnableS3BucketForRedShift4" }, "S3BucketForRedShiftAuditLoggingBucketPolicyAB8BAA40": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "S3BucketForRedShiftAuditLogging652E7355" }, "PolicyDocument": { "Statement": [ { "Action": [ "s3:GetBucketAcl", "s3:PutObject" ], "Effect": "Allow", "Principal": { "Service": "redshift.amazonaws.com" }, "Resource": [ { "Fn::GetAtt": [ "S3BucketForRedShiftAuditLogging652E7355", "Arn" ] }, { "Fn::Sub": [ "arn:${AWS::Partition}:s3:::${BucketName}/*", { "BucketName": { "Ref": "S3BucketForRedShiftAuditLogging652E7355" } } ] } ], "Sid": "Put bucket policy needed for audit logging" }, { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": "*", "Resource": [ { "Fn::GetAtt": [ "S3BucketForRedShiftAuditLogging652E7355", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "S3BucketForRedShiftAuditLogging652E7355", "Arn" ] }, "/*" ] ] } ], "Sid": "EnforceSSL" } ], "Version": "2012-10-17" } }, "DependsOn": [ "S3BucketForRedShiftAuditLogging652E7355" ], "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Condition": "EnableS3BucketForRedShift4" }, "SSMParameterForS3BucketNameForREDSHIFT441DD36B1": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Parameter to store the S3 bucket name for the remediation FSBP.REDSHIFT.4, the default value is bucket-name which has to be updated by the user before using the remediation.", "Name": "/Solutions/SO0111/afsbp/1.0.0/REDSHIFT.4/S3BucketNameForAuditLogging", "Tags": { "Solutions:SolutionID": "SO0111", "Solutions:SolutionName": "automated-security-response-on-aws", "Solutions:SolutionVersion": "v4.0.2" }, "Type": "String", "Value": { "Ref": "S3BucketForRedShiftAuditLogging652E7355" } }, "DependsOn": [ "S3BucketForRedShiftAuditLogging652E7355" ], "Condition": "EnableS3BucketForRedShift4" }, "SHARRRemediationKeyE744743D": { "Type": "AWS::KMS::Key", "Properties": { "EnableKeyRotation": true, "KeyPolicy": { "Statement": [ { "Action": [ "kms:GenerateDataKey", "kms:GenerateDataKeyPair", "kms:GenerateDataKeyPairWithoutPlaintext", "kms:GenerateDataKeyWithoutPlaintext", "kms:Decrypt", "kms:Encrypt", "kms:ReEncryptFrom", "kms:ReEncryptTo", "kms:DescribeKey", "kms:DescribeCustomKeyStores" ], "Effect": "Allow", "Principal": { "Service": [ "sns.amazonaws.com", "s3.amazonaws.com", { "Fn::Join": [ "", [ "logs.", { "Ref": "AWS::URLSuffix" } ] ] }, { "Fn::Join": [ "", [ "logs.", { "Ref": "AWS::Region" }, ".", { "Ref": "AWS::URLSuffix" } ] ] }, { "Fn::Join": [ "", [ "cloudtrail.", { "Ref": "AWS::URLSuffix" } ] ] }, "cloudwatch.amazonaws.com" ] }, "Resource": "*" }, { "Action": "kms:*", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": "*" } ], "Version": "2012-10-17" }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain" }, "SHARRRemediationKeyAlias5531874D": { "Type": "AWS::KMS::Alias", "Properties": { "AliasName": "alias/SO0111-SHARR-Remediation-Key", "TargetKeyId": { "Fn::GetAtt": [ "SHARRRemediationKeyE744743D", "Arn" ] } } }, "SHARRKeyAliasEBF509D8": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "KMS Customer Managed Key that will encrypt data for remediations", "Name": "/Solutions/SO0111/CMK_REMEDIATION_ARN", "Tags": { "Solutions:SolutionID": "SO0111", "Solutions:SolutionName": "automated-security-response-on-aws", "Solutions:SolutionVersion": "v4.0.2" }, "Type": "String", "Value": { "Fn::GetAtt": [ "SHARRRemediationKeyE744743D", "Arn" ] } } }, "SHARRMemberVersionEDAB5C42": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Version of the AWS Security Hub Automated Response and Remediation solution", "Name": "/Solutions/SO0111/member-version", "Tags": { "Solutions:SolutionID": "SO0111", "Solutions:SolutionName": "automated-security-response-on-aws", "Solutions:SolutionVersion": "v4.0.2" }, "Type": "String", "Value": "v4.0.2" } }, "SSMParameterLogGroupName47918519": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Parameter to store log group name", "Name": "/Solutions/SO0111/Metrics_LogGroupName", "Tags": { "Solutions:SolutionID": "SO0111", "Solutions:SolutionName": "automated-security-response-on-aws", "Solutions:SolutionVersion": "v4.0.2" }, "Type": "String", "Value": { "Ref": "LogGroupName" } } }, "SSMParameterForS34EncryptionKeyAlias73DD8A98": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "Parameter to store encryption key alias for the PCI.S3.4/FSBP.S3.4, replace the default value with the KMS Key Alias, other wise the remediation will enable the default AES256 encryption for the bucket.", "Name": "/Solutions/SO0111/afsbp/1.0.0/S3.4/KmsKeyAlias", "Tags": { "Solutions:SolutionID": "SO0111", "Solutions:SolutionName": "automated-security-response-on-aws", "Solutions:SolutionVersion": "v4.0.2" }, "Type": "String", "Value": "default-s3-encryption" } }, "RemediationConfigAccessLogs08FBABE2": { "Type": "AWS::S3::Bucket", "Properties": { "AccessControl": "LogDeliveryWrite", "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "LifecycleConfiguration": { "Rules": [ { "ExpirationInDays": 90, "Id": "ExpireAccessLogs", "Status": "Enabled" } ] }, "OwnershipControls": { "Rules": [ { "ObjectOwnership": "ObjectWriter" } ] }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "guard": { "SuppressedRules": [ "S3_BUCKET_LOGGING_ENABLED" ] } } }, "RemediationConfigAccessLogsPolicy24BAACEC": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "RemediationConfigAccessLogs08FBABE2" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "RemediationConfigAccessLogs08FBABE2", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "RemediationConfigAccessLogs08FBABE2", "Arn" ] }, "/*" ] ] } ] } ], "Version": "2012-10-17" } } }, "RemediationConfigurationBucketF5FA3D12": { "Type": "AWS::S3::Bucket", "Properties": { "BucketEncryption": { "ServerSideEncryptionConfiguration": [ { "ServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256" } } ] }, "BucketName": { "Fn::Join": [ "", [ "so0111-asr-remediation-", { "Ref": "AWS::Region" }, "-", { "Ref": "AWS::AccountId" } ] ] }, "LifecycleConfiguration": { "Rules": [ { "ExpirationInDays": 90, "Id": "GuardDutyBackupRetention", "Prefix": "guardduty-backups/", "Status": "Enabled" }, { "ExpirationInDays": 7, "Id": "InstallOverrideListExpiration", "Prefix": "install-overrides/", "Status": "Enabled" } ] }, "LoggingConfiguration": { "DestinationBucketName": { "Ref": "RemediationConfigAccessLogs08FBABE2" }, "LogFilePrefix": "remediation-config-access-logs/" }, "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "VersioningConfiguration": { "Status": "Enabled" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "RetainExceptOnCreate" }, "RemediationConfigurationBucketPolicyE889843F": { "Type": "AWS::S3::BucketPolicy", "Properties": { "Bucket": { "Ref": "RemediationConfigurationBucketF5FA3D12" }, "PolicyDocument": { "Statement": [ { "Action": "s3:*", "Condition": { "Bool": { "aws:SecureTransport": "false" } }, "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": [ { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] }, "/*" ] ] } ] }, { "Action": "s3:GetObject", "Condition": { "StringEquals": { "aws:PrincipalAccount": { "Ref": "AWS::AccountId" } } }, "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": [ { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] }, "/install-overrides/*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] }, "/baseline-overrides/*" ] ] } ], "Sid": "AllowEC2ReadForPatching" }, { "Action": "s3:ListBucket", "Condition": { "StringLike": { "s3:prefix": [ "install-overrides/*", "baseline-overrides/*" ] } }, "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Resource": { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] }, "Sid": "AllowListBucket" } ], "Version": "2012-10-17" } } }, "RemediationConfigurationBucketNotificationsHandlerPolicy465AD009": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "s3:PutBucketNotification", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] } } ], "Version": "2012-10-17" }, "PolicyName": "RemediationConfigurationBucketNotificationsHandlerPolicy465AD009", "Roles": [ { "Ref": "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC" } ] } }, "RemediationConfigurationBucketNotificationsE3D136AD": { "Type": "Custom::S3BucketNotifications", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "BucketNotificationsHandler050a0587b7544547bf325f094a3db8347ECC3691", "Arn" ] }, "BucketName": { "Ref": "RemediationConfigurationBucketF5FA3D12" }, "NotificationConfiguration": { "TopicConfigurations": [ { "Events": [ "s3:ObjectCreated:*" ], "Filter": { "Key": { "FilterRules": [ { "Name": "prefix", "Value": "guardduty-backups/" } ] } }, "TopicArn": { "Ref": "RemediationConfigMonitoringTopicC62EFF45" } }, { "Events": [ "s3:ObjectRemoved:*" ], "Filter": { "Key": { "FilterRules": [ { "Name": "prefix", "Value": "guardduty-backups/" } ] } }, "TopicArn": { "Ref": "RemediationConfigMonitoringTopicC62EFF45" } }, { "Events": [ "s3:ObjectCreated:*" ], "Filter": { "Key": { "FilterRules": [ { "Name": "prefix", "Value": "install-overrides/" } ] } }, "TopicArn": { "Ref": "RemediationConfigMonitoringTopicC62EFF45" } }, { "Events": [ "s3:ObjectRemoved:*" ], "Filter": { "Key": { "FilterRules": [ { "Name": "prefix", "Value": "install-overrides/" } ] } }, "TopicArn": { "Ref": "RemediationConfigMonitoringTopicC62EFF45" } }, { "Events": [ "s3:ObjectCreated:*" ], "Filter": { "Key": { "FilterRules": [ { "Name": "prefix", "Value": "baseline-overrides/" } ] } }, "TopicArn": { "Ref": "RemediationConfigMonitoringTopicC62EFF45" } }, { "Events": [ "s3:ObjectRemoved:*" ], "Filter": { "Key": { "FilterRules": [ { "Name": "prefix", "Value": "baseline-overrides/" } ] } }, "TopicArn": { "Ref": "RemediationConfigMonitoringTopicC62EFF45" } } ] }, "Managed": true, "SkipDestinationValidation": false }, "DependsOn": [ "RemediationConfigMonitoringTopicPolicyA3412541", "RemediationConfigMonitoringTopicC62EFF45", "RemediationConfigurationBucketNotificationsHandlerPolicy465AD009", "RemediationConfigurationBucketPolicyE889843F" ] }, "RemediationConfigMonitoringTopicC62EFF45": { "Type": "AWS::SNS::Topic", "Properties": { "DisplayName": "ASR Remediation Config Bucket Monitoring", "KmsMasterKeyId": { "Fn::GetAtt": [ "SHARRRemediationKeyE744743D", "Arn" ] }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ] } }, "RemediationConfigMonitoringTopicPolicyA3412541": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "PolicyDocument": { "Statement": [ { "Action": "sns:Publish", "Condition": { "ArnLike": { "aws:SourceArn": { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] } } }, "Effect": "Allow", "Principal": { "Service": "s3.amazonaws.com" }, "Resource": { "Ref": "RemediationConfigMonitoringTopicC62EFF45" }, "Sid": "0" } ], "Version": "2012-10-17" }, "Topics": [ { "Ref": "RemediationConfigMonitoringTopicC62EFF45" } ] } }, "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "ManagedPolicyArns": [ { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" ] ] } ], "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ] } }, "BucketNotificationsHandler050a0587b7544547bf325f094a3db8347ECC3691": { "Type": "AWS::Lambda::Function", "Properties": { "Description": "AWS CloudFormation handler for \"Custom::S3BucketNotifications\" resources (@aws-cdk/aws-s3)", "Code": { "ZipFile": "import boto3 # type: ignore\nimport json\nimport logging\nimport urllib.request\n\ns3 = boto3.client(\"s3\")\n\nEVENTBRIDGE_CONFIGURATION = 'EventBridgeConfiguration'\nCONFIGURATION_TYPES = [\"TopicConfigurations\", \"QueueConfigurations\", \"LambdaFunctionConfigurations\"]\n\ndef handler(event: dict, context):\n response_status = \"SUCCESS\"\n error_message = \"\"\n try:\n props = event[\"ResourceProperties\"]\n notification_configuration = props[\"NotificationConfiguration\"]\n managed = props.get('Managed', 'true').lower() == 'true'\n skipDestinationValidation = props.get('SkipDestinationValidation', 'false').lower() == 'true'\n stack_id = event['StackId']\n old = event.get(\"OldResourceProperties\", {}).get(\"NotificationConfiguration\", {})\n if managed:\n config = handle_managed(event[\"RequestType\"], notification_configuration)\n else:\n config = handle_unmanaged(props[\"BucketName\"], stack_id, event[\"RequestType\"], notification_configuration, old)\n s3.put_bucket_notification_configuration(Bucket=props[\"BucketName\"], NotificationConfiguration=config, SkipDestinationValidation=skipDestinationValidation)\n except Exception as e:\n logging.exception(\"Failed to put bucket notification configuration\")\n response_status = \"FAILED\"\n error_message = f\"Error: {str(e)}. \"\n finally:\n submit_response(event, context, response_status, error_message)\n\ndef handle_managed(request_type, notification_configuration):\n if request_type == 'Delete':\n return {}\n return notification_configuration\n\ndef handle_unmanaged(bucket, stack_id, request_type, notification_configuration, old):\n def get_id(n):\n n['Id'] = ''\n sorted_notifications = sort_filter_rules(n)\n strToHash=json.dumps(sorted_notifications, sort_keys=True).replace('\"Name\": \"prefix\"', '\"Name\": \"Prefix\"').replace('\"Name\": \"suffix\"', '\"Name\": \"Suffix\"')\n return f\"{stack_id}-{hash(strToHash)}\"\n def with_id(n):\n n['Id'] = get_id(n)\n return n\n\n external_notifications = {}\n existing_notifications = s3.get_bucket_notification_configuration(Bucket=bucket)\n for t in CONFIGURATION_TYPES:\n if request_type == 'Update':\n old_incoming_ids = [get_id(n) for n in old.get(t, [])]\n external_notifications[t] = [n for n in existing_notifications.get(t, []) if not get_id(n) in old_incoming_ids] \n elif request_type == 'Delete':\n external_notifications[t] = [n for n in existing_notifications.get(t, []) if not n['Id'].startswith(f\"{stack_id}-\")]\n elif request_type == 'Create':\n external_notifications[t] = [n for n in existing_notifications.get(t, [])]\n if EVENTBRIDGE_CONFIGURATION in existing_notifications:\n external_notifications[EVENTBRIDGE_CONFIGURATION] = existing_notifications[EVENTBRIDGE_CONFIGURATION]\n\n if request_type == 'Delete':\n return external_notifications\n\n notifications = {}\n for t in CONFIGURATION_TYPES:\n external = external_notifications.get(t, [])\n incoming = [with_id(n) for n in notification_configuration.get(t, [])]\n notifications[t] = external + incoming\n\n if EVENTBRIDGE_CONFIGURATION in notification_configuration:\n notifications[EVENTBRIDGE_CONFIGURATION] = notification_configuration[EVENTBRIDGE_CONFIGURATION]\n elif EVENTBRIDGE_CONFIGURATION in external_notifications:\n notifications[EVENTBRIDGE_CONFIGURATION] = external_notifications[EVENTBRIDGE_CONFIGURATION]\n\n return notifications\n\ndef submit_response(event: dict, context, response_status: str, error_message: str):\n response_body = json.dumps(\n {\n \"Status\": response_status,\n \"Reason\": f\"{error_message}See the details in CloudWatch Log Stream: {context.log_stream_name}\",\n \"PhysicalResourceId\": event.get(\"PhysicalResourceId\") or event[\"LogicalResourceId\"],\n \"StackId\": event[\"StackId\"],\n \"RequestId\": event[\"RequestId\"],\n \"LogicalResourceId\": event[\"LogicalResourceId\"],\n \"NoEcho\": False,\n }\n ).encode(\"utf-8\")\n headers = {\"content-type\": \"\", \"content-length\": str(len(response_body))}\n try:\n req = urllib.request.Request(url=event[\"ResponseURL\"], headers=headers, data=response_body, method=\"PUT\")\n with urllib.request.urlopen(req) as response:\n print(response.read().decode(\"utf-8\"))\n print(\"Status code: \" + response.reason)\n except Exception as e:\n print(\"send(..) failed executing request.urlopen(..): \" + str(e))\n\ndef sort_filter_rules(json_obj):\n if not isinstance(json_obj, dict):\n return json_obj\n for key, value in json_obj.items():\n if isinstance(value, dict):\n json_obj[key] = sort_filter_rules(value)\n elif isinstance(value, list):\n json_obj[key] = [sort_filter_rules(item) for item in value]\n if \"Filter\" in json_obj and \"Key\" in json_obj[\"Filter\"] and \"FilterRules\" in json_obj[\"Filter\"][\"Key\"]:\n filter_rules = json_obj[\"Filter\"][\"Key\"][\"FilterRules\"]\n sorted_filter_rules = sorted(filter_rules, key=lambda x: x[\"Name\"])\n json_obj[\"Filter\"][\"Key\"][\"FilterRules\"] = sorted_filter_rules\n return json_obj" }, "Handler": "index.handler", "Role": { "Fn::GetAtt": [ "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC", "Arn" ] }, "Runtime": "python3.13", "Timeout": 300, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ] }, "DependsOn": [ "BucketNotificationsHandler050a0587b7544547bf325f094a3db834RoleB6FB88EC" ], "Metadata": { "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "RemediationConfigBucketAccessPolicyF4D04687": { "Type": "AWS::IAM::ManagedPolicy", "Properties": { "Description": { "Fn::Join": [ "", [ "Read-only access to the ASR remediation configuration bucket (patch and baseline overrides) in ", { "Ref": "AWS::Region" }, ". Attached by the Inspector.InstanceVulnerability remediation to the target EC2 instance role." ] ] }, "ManagedPolicyName": { "Fn::Join": [ "", [ "ASR-RemediationConfigBucketAccess-", { "Ref": "AWS::Region" } ] ] }, "Path": "/", "PolicyDocument": { "Statement": [ { "Action": "s3:GetObject", "Effect": "Allow", "Resource": [ { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] }, "/install-overrides/*" ] ] }, { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] }, "/baseline-overrides/*" ] ] } ] }, { "Action": "s3:ListBucket", "Effect": "Allow", "Resource": { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] } } ], "Version": "2012-10-17" } }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "RetainExceptOnCreate", "Metadata": { "guard": { "SuppressedRules": [ "IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE", "CFN_NO_EXPLICIT_RESOURCE_NAMES" ] } } }, "RemediationConfigurationBucketNameParam450ACC24": { "Type": "AWS::SSM::Parameter", "Properties": { "Description": "S3 bucket name for ASR remediation configuration files (patch overrides, GuardDuty backups)", "Name": "/Solutions/SO0111/RemediationConfigurationBucket", "Tags": { "Solutions:SolutionID": "SO0111", "Solutions:SolutionName": "automated-security-response-on-aws", "Solutions:SolutionVersion": "v4.0.2" }, "Type": "String", "Value": { "Ref": "RemediationConfigurationBucketF5FA3D12" } } }, "BaselineConfigRoleEF7E1107": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": "s3:PutObject", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ { "Fn::GetAtt": [ "RemediationConfigurationBucketF5FA3D12", "Arn" ] }, "/baseline-overrides/*" ] ] } }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "BaselineConfigPolicy" } ], "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK", "IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE" ] } } }, "BaselineConfigFunctionLogGroup5BCE9DC0": { "Type": "AWS::Logs::LogGroup", "Properties": { "RetentionInDays": 3653, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "guard": { "SuppressedRules": [ "CLOUDWATCH_LOG_GROUP_ENCRYPTED" ] } } }, "BaselineConfigFunctionAA6B05B6": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "", [ "solutions-", { "Ref": "AWS::Region" } ] ] }, "S3Key": "automated-security-response-on-aws/v4.0.2/lambda/asr_lambdas-8e6b0d9b.zip" }, "Description": "Uploads Windows security baseline configuration to the Remediation Configuration bucket", "Environment": { "Variables": { "LOG_LEVEL": "INFO", "SOLUTION_TRADEMARKEDNAME": "automated-security-response-on-aws" } }, "Handler": "baseline-configuration/baselineConfigurationHandler.handler", "LoggingConfig": { "LogGroup": { "Ref": "BaselineConfigFunctionLogGroup5BCE9DC0" } }, "Role": { "Fn::GetAtt": [ "BaselineConfigRoleEF7E1107", "Arn" ] }, "Runtime": "nodejs22.x", "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "Timeout": 300 }, "DependsOn": [ "BaselineConfigRoleEF7E1107" ], "Metadata": { "guard": { "SuppressedRules": [ "LAMBDA_CONCURRENCY_CHECK", "LAMBDA_INSIDE_VPC" ] } } }, "BaselineConfigurationResource": { "Type": "Custom::BaselineConfiguration", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "BaselineConfigFunctionAA6B05B6", "Arn" ] }, "BucketName": { "Ref": "RemediationConfigurationBucketF5FA3D12" }, "DeploymentTimestamp": "2026-09-15T01:14:50.178Z" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "NestedStackFactoryGatePlaybookMemberStackAFSBP137036A57": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Metadata": { "PlaybookMemberStackAFSBPReady": { "Fn::If": [ "loadAFSBPCond", { "Ref": "PlaybookMemberStackAFSBP" }, "" ] } } }, "NestedStackFactoryGatePlaybookMemberStackCIS120E08EFB8B": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Metadata": { "PlaybookMemberStackAFSBPReady": { "Fn::If": [ "loadAFSBPCond", { "Ref": "PlaybookMemberStackAFSBP" }, "" ] }, "PlaybookMemberStackAFSBP1Ready": { "Fn::If": [ "loadAFSBP1Cond", { "Ref": "PlaybookMemberStackAFSBP1" }, "" ] } } }, "NestedStackFactoryGatePlaybookMemberStackCIS1402A4735A6": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Metadata": { "PlaybookMemberStackAFSBPReady": { "Fn::If": [ "loadAFSBPCond", { "Ref": "PlaybookMemberStackAFSBP" }, "" ] }, "PlaybookMemberStackAFSBP1Ready": { "Fn::If": [ "loadAFSBP1Cond", { "Ref": "PlaybookMemberStackAFSBP1" }, "" ] }, "PlaybookMemberStackCIS120Ready": { "Fn::If": [ "loadCIS120Cond", { "Ref": "PlaybookMemberStackCIS120" }, "" ] } } }, "NestedStackFactoryGatePlaybookMemberStackNIST80053C3D22DE7": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Metadata": { "PlaybookMemberStackAFSBPReady": { "Fn::If": [ "loadAFSBPCond", { "Ref": "PlaybookMemberStackAFSBP" }, "" ] }, "PlaybookMemberStackAFSBP1Ready": { "Fn::If": [ "loadAFSBP1Cond", { "Ref": "PlaybookMemberStackAFSBP1" }, "" ] }, "PlaybookMemberStackCIS120Ready": { "Fn::If": [ "loadCIS120Cond", { "Ref": "PlaybookMemberStackCIS120" }, "" ] }, "PlaybookMemberStackCIS140Ready": { "Fn::If": [ "loadCIS140Cond", { "Ref": "PlaybookMemberStackCIS140" }, "" ] } } }, "NestedStackFactoryGatePlaybookMemberStackNIST8005311D6A30FD": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Metadata": { "PlaybookMemberStackAFSBPReady": { "Fn::If": [ "loadAFSBPCond", { "Ref": "PlaybookMemberStackAFSBP" }, "" ] }, "PlaybookMemberStackAFSBP1Ready": { "Fn::If": [ "loadAFSBP1Cond", { "Ref": "PlaybookMemberStackAFSBP1" }, "" ] }, "PlaybookMemberStackCIS120Ready": { "Fn::If": [ "loadCIS120Cond", { "Ref": "PlaybookMemberStackCIS120" }, "" ] }, "PlaybookMemberStackCIS140Ready": { "Fn::If": [ "loadCIS140Cond", { "Ref": "PlaybookMemberStackCIS140" }, "" ] }, "PlaybookMemberStackNIST80053Ready": { "Fn::If": [ "loadNIST80053Cond", { "Ref": "PlaybookMemberStackNIST80053" }, "" ] } } }, "NestedStackFactoryGatePlaybookMemberStackPCI3214A12B906": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Metadata": { "PlaybookMemberStackAFSBPReady": { "Fn::If": [ "loadAFSBPCond", { "Ref": "PlaybookMemberStackAFSBP" }, "" ] }, "PlaybookMemberStackAFSBP1Ready": { "Fn::If": [ "loadAFSBP1Cond", { "Ref": "PlaybookMemberStackAFSBP1" }, "" ] }, "PlaybookMemberStackCIS120Ready": { "Fn::If": [ "loadCIS120Cond", { "Ref": "PlaybookMemberStackCIS120" }, "" ] }, "PlaybookMemberStackCIS140Ready": { "Fn::If": [ "loadCIS140Cond", { "Ref": "PlaybookMemberStackCIS140" }, "" ] }, "PlaybookMemberStackNIST80053Ready": { "Fn::If": [ "loadNIST80053Cond", { "Ref": "PlaybookMemberStackNIST80053" }, "" ] }, "PlaybookMemberStackNIST800531Ready": { "Fn::If": [ "loadNIST800531Cond", { "Ref": "PlaybookMemberStackNIST800531" }, "" ] } } }, "NestedStackFactoryGatePlaybookMemberStackCIS300FA804242": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Metadata": { "PlaybookMemberStackAFSBPReady": { "Fn::If": [ "loadAFSBPCond", { "Ref": "PlaybookMemberStackAFSBP" }, "" ] }, "PlaybookMemberStackAFSBP1Ready": { "Fn::If": [ "loadAFSBP1Cond", { "Ref": "PlaybookMemberStackAFSBP1" }, "" ] }, "PlaybookMemberStackCIS120Ready": { "Fn::If": [ "loadCIS120Cond", { "Ref": "PlaybookMemberStackCIS120" }, "" ] }, "PlaybookMemberStackCIS140Ready": { "Fn::If": [ "loadCIS140Cond", { "Ref": "PlaybookMemberStackCIS140" }, "" ] }, "PlaybookMemberStackNIST80053Ready": { "Fn::If": [ "loadNIST80053Cond", { "Ref": "PlaybookMemberStackNIST80053" }, "" ] }, "PlaybookMemberStackNIST800531Ready": { "Fn::If": [ "loadNIST800531Cond", { "Ref": "PlaybookMemberStackNIST800531" }, "" ] }, "PlaybookMemberStackPCI321Ready": { "Fn::If": [ "loadPCI321Cond", { "Ref": "PlaybookMemberStackPCI321" }, "" ] } } }, "NestedStackFactoryGatePlaybookMemberStackSC0515DB36": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Metadata": { "PlaybookMemberStackAFSBPReady": { "Fn::If": [ "loadAFSBPCond", { "Ref": "PlaybookMemberStackAFSBP" }, "" ] }, "PlaybookMemberStackAFSBP1Ready": { "Fn::If": [ "loadAFSBP1Cond", { "Ref": "PlaybookMemberStackAFSBP1" }, "" ] }, "PlaybookMemberStackCIS120Ready": { "Fn::If": [ "loadCIS120Cond", { "Ref": "PlaybookMemberStackCIS120" }, "" ] }, "PlaybookMemberStackCIS140Ready": { "Fn::If": [ "loadCIS140Cond", { "Ref": "PlaybookMemberStackCIS140" }, "" ] }, "PlaybookMemberStackNIST80053Ready": { "Fn::If": [ "loadNIST80053Cond", { "Ref": "PlaybookMemberStackNIST80053" }, "" ] }, "PlaybookMemberStackNIST800531Ready": { "Fn::If": [ "loadNIST800531Cond", { "Ref": "PlaybookMemberStackNIST800531" }, "" ] }, "PlaybookMemberStackPCI321Ready": { "Fn::If": [ "loadPCI321Cond", { "Ref": "PlaybookMemberStackPCI321" }, "" ] }, "PlaybookMemberStackCIS300Ready": { "Fn::If": [ "loadCIS300Cond", { "Ref": "PlaybookMemberStackCIS300" }, "" ] } } }, "NestedStackFactoryGatePlaybookMemberStackSC1042EDDD9": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Metadata": { "PlaybookMemberStackAFSBPReady": { "Fn::If": [ "loadAFSBPCond", { "Ref": "PlaybookMemberStackAFSBP" }, "" ] }, "PlaybookMemberStackAFSBP1Ready": { "Fn::If": [ "loadAFSBP1Cond", { "Ref": "PlaybookMemberStackAFSBP1" }, "" ] }, "PlaybookMemberStackCIS120Ready": { "Fn::If": [ "loadCIS120Cond", { "Ref": "PlaybookMemberStackCIS120" }, "" ] }, "PlaybookMemberStackCIS140Ready": { "Fn::If": [ "loadCIS140Cond", { "Ref": "PlaybookMemberStackCIS140" }, "" ] }, "PlaybookMemberStackNIST80053Ready": { "Fn::If": [ "loadNIST80053Cond", { "Ref": "PlaybookMemberStackNIST80053" }, "" ] }, "PlaybookMemberStackNIST800531Ready": { "Fn::If": [ "loadNIST800531Cond", { "Ref": "PlaybookMemberStackNIST800531" }, "" ] }, "PlaybookMemberStackPCI321Ready": { "Fn::If": [ "loadPCI321Cond", { "Ref": "PlaybookMemberStackPCI321" }, "" ] }, "PlaybookMemberStackCIS300Ready": { "Fn::If": [ "loadCIS300Cond", { "Ref": "PlaybookMemberStackCIS300" }, "" ] }, "PlaybookMemberStackSCReady": { "Fn::If": [ "loadSCCond", { "Ref": "PlaybookMemberStackSC" }, "" ] } } }, "NestedStackFactoryGateMemberCloudTrailStackD769B835": { "Type": "AWS::CloudFormation::WaitConditionHandle", "Metadata": { "PlaybookMemberStackAFSBPReady": { "Fn::If": [ "loadAFSBPCond", { "Ref": "PlaybookMemberStackAFSBP" }, "" ] }, "PlaybookMemberStackAFSBP1Ready": { "Fn::If": [ "loadAFSBP1Cond", { "Ref": "PlaybookMemberStackAFSBP1" }, "" ] }, "PlaybookMemberStackCIS120Ready": { "Fn::If": [ "loadCIS120Cond", { "Ref": "PlaybookMemberStackCIS120" }, "" ] }, "PlaybookMemberStackCIS140Ready": { "Fn::If": [ "loadCIS140Cond", { "Ref": "PlaybookMemberStackCIS140" }, "" ] }, "PlaybookMemberStackNIST80053Ready": { "Fn::If": [ "loadNIST80053Cond", { "Ref": "PlaybookMemberStackNIST80053" }, "" ] }, "PlaybookMemberStackNIST800531Ready": { "Fn::If": [ "loadNIST800531Cond", { "Ref": "PlaybookMemberStackNIST800531" }, "" ] }, "PlaybookMemberStackPCI321Ready": { "Fn::If": [ "loadPCI321Cond", { "Ref": "PlaybookMemberStackPCI321" }, "" ] }, "PlaybookMemberStackCIS300Ready": { "Fn::If": [ "loadCIS300Cond", { "Ref": "PlaybookMemberStackCIS300" }, "" ] }, "PlaybookMemberStackSCReady": { "Fn::If": [ "loadSCCond", { "Ref": "PlaybookMemberStackSC" }, "" ] }, "PlaybookMemberStackSC1Ready": { "Fn::If": [ "loadSC1Cond", { "Ref": "PlaybookMemberStackSC1" }, "" ] } } }, "WaitProviderRole83B0295F": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": "cloudwatch:PutMetricData", "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "LambdaPolicy" } ], "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK", "IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE" ] } } }, "WaitProviderFunctionLogGroup521DCE00": { "Type": "AWS::Logs::LogGroup", "Properties": { "RetentionInDays": 3653, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "guard": { "SuppressedRules": [ "CLOUDWATCH_LOG_GROUP_ENCRYPTED" ] } } }, "WaitProviderFunction3D90ED36": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "", [ "solutions-", { "Ref": "AWS::Region" } ] ] }, "S3Key": "automated-security-response-on-aws/v4.0.2/lambda/wait_provider-592e8b82.zip" }, "Environment": { "Variables": { "LOG_LEVEL": "INFO" } }, "Handler": "wait_provider.lambda_handler", "LoggingConfig": { "LogGroup": { "Ref": "WaitProviderFunctionLogGroup521DCE00" } }, "Role": { "Fn::GetAtt": [ "WaitProviderRole83B0295F", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "Timeout": 900 }, "DependsOn": [ "WaitProviderRole83B0295F" ], "Metadata": { "guard": { "SuppressedRules": [ "LAMBDA_CONCURRENCY_CHECK", "LAMBDA_INSIDE_VPC" ] } } }, "RunbookStackNoRoles": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/automated-security-response-remediation-runbooks.template" ] ] } }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" }, "PlaybookMemberStackAFSBP": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/playbooks/AFSBPMemberStack.template" ] ] } }, "DependsOn": [ "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "loadAFSBPCond" }, "PlaybookMemberStackAFSBP1": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/playbooks/AFSBPMemberStack1.template" ] ] } }, "DependsOn": [ "NestedStackFactoryGatePlaybookMemberStackAFSBP137036A57", "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "loadAFSBP1Cond" }, "PlaybookMemberStackCIS120": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/playbooks/CIS120MemberStack.template" ] ] } }, "DependsOn": [ "NestedStackFactoryGatePlaybookMemberStackCIS120E08EFB8B", "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "loadCIS120Cond" }, "PlaybookMemberStackCIS140": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/playbooks/CIS140MemberStack.template" ] ] } }, "DependsOn": [ "NestedStackFactoryGatePlaybookMemberStackCIS1402A4735A6", "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "loadCIS140Cond" }, "PlaybookMemberStackNIST80053": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/playbooks/NIST80053MemberStack.template" ] ] } }, "DependsOn": [ "NestedStackFactoryGatePlaybookMemberStackNIST80053C3D22DE7", "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "loadNIST80053Cond" }, "PlaybookMemberStackNIST800531": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/playbooks/NIST80053MemberStack1.template" ] ] } }, "DependsOn": [ "NestedStackFactoryGatePlaybookMemberStackNIST8005311D6A30FD", "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "loadNIST800531Cond" }, "PlaybookMemberStackPCI321": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/playbooks/PCI321MemberStack.template" ] ] } }, "DependsOn": [ "NestedStackFactoryGatePlaybookMemberStackPCI3214A12B906", "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "loadPCI321Cond" }, "PlaybookMemberStackCIS300": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/playbooks/CIS300MemberStack.template" ] ] } }, "DependsOn": [ "NestedStackFactoryGatePlaybookMemberStackCIS300FA804242", "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "loadCIS300Cond" }, "PlaybookMemberStackSC": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/playbooks/SCMemberStack.template" ] ] } }, "DependsOn": [ "NestedStackFactoryGatePlaybookMemberStackSC0515DB36", "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "loadSCCond" }, "PlaybookMemberStackSC1": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "WaitProviderServiceToken": { "Fn::GetAtt": [ "WaitProviderFunction3D90ED36", "Arn" ] }, "Namespace": { "Ref": "Namespace" } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/playbooks/SCMemberStack1.template" ] ] } }, "DependsOn": [ "NestedStackFactoryGatePlaybookMemberStackSC1042EDDD9", "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "loadSC1Cond" }, "MemberCloudTrailNestedStackMemberCloudTrailNestedStackResource2ED3A9F6": { "Type": "AWS::CloudFormation::Stack", "Properties": { "Parameters": { "CloudTrailLogGroupName": "/aws/lambda/SO0111-ASR-CloudTrailEvents", "Namespace": { "Ref": "Namespace" }, "LogWriterRoleArn": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":iam::", { "Ref": "SecHubAdminAccount" }, ":role/CrossAccountLogWriterRole" ] ] } }, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "TemplateURL": { "Fn::Join": [ "", [ "https://", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "S3Bucket" ] }, "-reference.s3.amazonaws.com/", { "Fn::FindInMap": [ "NestedStackFactorySourceCodeA11A36A7", "General", "KeyPrefix" ] }, "/automated-security-response-member-cloudtrail.template" ] ] } }, "DependsOn": [ "NestedStackFactoryGateMemberCloudTrailStackD769B835", "RunbookStackNoRoles" ], "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete", "Condition": "CloudTrailCondition" }, "ASRLambdaLayerDAD507E4": { "Type": "AWS::Lambda::LayerVersion", "Properties": { "CompatibleRuntimes": [ "python3.11" ], "Content": { "S3Bucket": { "Fn::Join": [ "", [ "solutions-", { "Ref": "AWS::Region" } ] ] }, "S3Key": "automated-security-response-on-aws/v4.0.2/lambda/layer-78b8b326.zip" }, "Description": "SO0111 ASR Common functions used by the solution", "LicenseInfo": "https://www.apache.org/licenses/LICENSE-2.0" } }, "MetricResourcesMetricResourcesRoleC49ABA6D": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Statement": [ { "Action": "sts:AssumeRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" } } ], "Version": "2012-10-17" }, "Policies": [ { "PolicyDocument": { "Statement": [ { "Action": "cloudwatch:PutMetricData", "Effect": "Allow", "Resource": "*" }, { "Action": [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:*:", { "Ref": "AWS::AccountId" }, ":log-group:*:log-stream:*" ] ] } }, { "Action": "logs:CreateLogGroup", "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":logs:*:", { "Ref": "AWS::AccountId" }, ":log-group:*" ] ] } }, { "Action": [ "ssm:GetParameter", "ssm:GetParameters", "ssm:PutParameter", "ssm:DeleteParameter" ], "Effect": "Allow", "Resource": { "Fn::Join": [ "", [ "arn:", { "Ref": "AWS::Partition" }, ":ssm:*:", { "Ref": "AWS::AccountId" }, ":parameter/Solutions/SO0111/*" ] ] } }, { "Action": "securityhub:DescribeSecurityHubV2", "Effect": "Allow", "Resource": "*" } ], "Version": "2012-10-17" }, "PolicyName": "LambdaPolicy" } ], "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ] }, "Metadata": { "guard": { "SuppressedRules": [ "IAM_NO_INLINE_POLICY_CHECK", "IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE" ] } } }, "MetricResourcesASRDeploymentCustomResourceLambdaLogGroup9FC7DFE7": { "Type": "AWS::Logs::LogGroup", "Properties": { "RetentionInDays": 3653, "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ] }, "UpdateReplacePolicy": "Retain", "DeletionPolicy": "Retain", "Metadata": { "guard": { "SuppressedRules": [ "CLOUDWATCH_LOG_GROUP_ENCRYPTED" ] } } }, "MetricResourcesASRDeploymentCustomResourceLambda02CE6550": { "Type": "AWS::Lambda::Function", "Properties": { "Code": { "S3Bucket": { "Fn::Join": [ "", [ "solutions-", { "Ref": "AWS::Region" } ] ] }, "S3Key": "automated-security-response-on-aws/v4.0.2/lambda/deployment_metrics_custom_resource-aabab36a.zip" }, "Description": "ASR - Handles deployment related custom actions", "Environment": { "Variables": { "LOG_LEVEL": "INFO", "AWS_PARTITION": { "Ref": "AWS::Partition" }, "SOLUTION_ID": "SO0111", "SOLUTION_VERSION": "v4.0.2", "POWERTOOLS_SERVICE_NAME": "deployment_metrics_custom_resource", "POWERTOOLS_LOG_LEVEL": "INFO", "POWERTOOLS_LOGGER_LOG_EVENT": "false", "POWERTOOLS_TRACER_CAPTURE_RESPONSE": "true", "POWERTOOLS_TRACER_CAPTURE_ERROR": "true", "AWS_ACCOUNT_ID": { "Ref": "AWS::AccountId" }, "STACK_ID": { "Ref": "AWS::StackId" } } }, "Handler": "deployment_metrics_custom_resource.lambda_handler", "Layers": [ { "Ref": "ASRLambdaLayerDAD507E4" } ], "LoggingConfig": { "LogGroup": { "Ref": "MetricResourcesASRDeploymentCustomResourceLambdaLogGroup9FC7DFE7" } }, "MemorySize": 256, "Role": { "Fn::GetAtt": [ "MetricResourcesMetricResourcesRoleC49ABA6D", "Arn" ] }, "Runtime": "python3.11", "Tags": [ { "Key": "Solutions:SolutionID", "Value": "SO0111" }, { "Key": "Solutions:SolutionName", "Value": "automated-security-response-on-aws" }, { "Key": "Solutions:SolutionVersion", "Value": "v4.0.2" } ], "Timeout": 5 }, "DependsOn": [ "MetricResourcesMetricResourcesRoleC49ABA6D" ], "Metadata": { "guard": { "SuppressedRules": [ "LAMBDA_INSIDE_VPC", "LAMBDA_CONCURRENCY_CHECK" ] } } }, "MetricResourcesASRDeploymentMetricsCustomResource0940D9B2": { "Type": "Custom::DeploymentMetrics", "Properties": { "ServiceToken": { "Fn::GetAtt": [ "MetricResourcesASRDeploymentCustomResourceLambda02CE6550", "Arn" ] }, "StackParameters": { "SecHubAdminAccount": { "Ref": "SecHubAdminAccount" }, "Namespace": { "Ref": "Namespace" }, "EnableCloudTrailForASRActionLog": { "Ref": "EnableCloudTrailForASRActionLog" }, "CreateS3BucketForRedshiftAuditLogging": { "Ref": "CreateS3BucketForRedshiftAuditLogging" }, "LogGroupName": { "Ref": "LogGroupName" }, "LoadAFSBPMemberStack": { "Ref": "LoadAFSBPMemberStack" }, "LoadCIS120MemberStack": { "Ref": "LoadCIS120MemberStack" }, "LoadCIS140MemberStack": { "Ref": "LoadCIS140MemberStack" }, "LoadNIST80053MemberStack": { "Ref": "LoadNIST80053MemberStack" }, "LoadPCI321MemberStack": { "Ref": "LoadPCI321MemberStack" }, "LoadCIS300MemberStack": { "Ref": "LoadCIS300MemberStack" }, "LoadSCMemberStack": { "Ref": "LoadSCMemberStack" } }, "Timestamp": "1789434890193" }, "UpdateReplacePolicy": "Delete", "DeletionPolicy": "Delete" } }, "Mappings": { "NestedStackFactorySourceCodeA11A36A7": { "General": { "S3Bucket": "solutions", "KeyPrefix": "automated-security-response-on-aws/v4.0.2" } }, "SourceCode": { "General": { "S3Bucket": "solutions", "KeyPrefix": "automated-security-response-on-aws/v4.0.2" } } } }