diff --git a/.gitignore b/.gitignore index c696e99..2e1221b 100644 --- a/.gitignore +++ b/.gitignore @@ -4,4 +4,6 @@ config/ .vscode #tf .terraform -.terraform.lock.hcl \ No newline at end of file +.terraform.lock.hcl +#pip +pip* \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index bd7de52..9edfb2e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,20 @@ # Change Log All notable changes to this project will be documented in this file. +### [1.1.5] + +Fixed vulnerability - exposed value in Python script. Added default tagging to all resources. Updated Provider. + +### Added + +- [AWS-Secrets-Manager-Functionality](https://github.com/RavenEsc/AWS_Security_Automation_Tool/blob/main/code/discordlambda/discordnote.py) + Takes advantage of the boto3 library to access the secret value held in AWS Secrets Manager + +- [AWS-Secrets-Manager-Access](https://github.com/RavenEsc/AWS_Security_Automation_Tool/blob/main/tf/DiscordLambdaFunction.tf) + Gives the Discord Notification Lambda script permission to access the specific secret needed via policy. + +
v1.1.5
+ ### [1.1.1] - 2024-7-26 Fixed Issue - Updated AWS Provider from 5.18.0 > 5.60.0 @@ -10,7 +24,7 @@ Fixed Issue - Updated AWS Provider from 5.18.0 > 5.60.0 Utilization of ECR to containerize a controlled environment -
v1.0.0
+
v1.1.0
### Added - [Docker-YAML-GitActions](https://github.com/RavenEsc/AWS_Security_Automation_Tool/blob/e204e13e41e8c6f4a474d13a1fbfee50a7f0849c/.github/workflows/docker.yml) diff --git a/README.md b/README.md index 94f9666..9ef1ad4 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # AWS_Security_Automation_Tool (Project SAT) -This tool will automate the workflow of security checks for EC2 instances and IAM entity policies. It will accomplish this task by utilizing the serverless infrastructure of Lambda and perform periodic checks backed by python and driven with Amazon EventBridge. +This tool will automate the workflow of security checks for EC2 instances and IAM entity policies. It will accomplish this task by utilizing the serverless infrastructure of Lambda and perform periodic checks backed by python and driven with Amazon EventBridge. Secrets Manager is also utilized for sensitive values in the Python scripts. After it has performed a check, if any test has failed it will log the event and notify the event to the admin account. @@ -8,4 +8,4 @@ It will also be able to handle an influx of issues by using the SNS and SQS Queu Updates to the code are logged in the [Change Log](https://github.com/RavenEsc/AWS_Security_Automation_Tool/blob/7a5221d1bafd2a4b6fc40a0dbf974fed54f4ba75/CHANGELOG.md) ! -
v1.0.0
\ No newline at end of file +
Official Image
\ No newline at end of file diff --git a/code/Dac/Diagrams.py b/code/Dac/Diagrams.py index 043d101..d939b31 100644 --- a/code/Dac/Diagrams.py +++ b/code/Dac/Diagrams.py @@ -6,6 +6,7 @@ from diagrams.aws.integration import Eventbridge from diagrams.onprem.compute import Server from diagrams.aws.compute import ElasticContainerService +from diagrams.aws.security import SecretsManager with Diagram("Security Automation Tool", show=False): @@ -14,7 +15,9 @@ SNS = SimpleNotificationServiceSnsTopic("SNS") SQSa = SimpleQueueServiceSqsQueue("SQS Queue: S3") SQSb = SimpleQueueServiceSqsQueue("SQS Queue: Dcord") + Secrets = SecretsManager('SecretsManager') SNS >> [SQSa, SQSb] + with Cluster("Trigger-Lambda"): eveb = Eventbridge("EventBLambTrigger") @@ -31,4 +34,6 @@ ECR = ElasticContainerService('LambdaContainerImage') SQSa >> functionS3 >> s3_bucket SQSb >> functionD >> Discord - ECR >> Discord \ No newline at end of file + ECR >> Discord + + Secrets >> functionD \ No newline at end of file diff --git a/code/discordlambda/discordnote.py b/code/discordlambda/discordnote.py index d097fc0..eacf20b 100644 --- a/code/discordlambda/discordnote.py +++ b/code/discordlambda/discordnote.py @@ -32,8 +32,8 @@ def lambda_handler(event, context): SecretId=secret_name ) - secret = get_secret_value_response['SecretString'] - webhook = DiscordWebhook(url=secret) + secret = json.loads(get_secret_value_response['SecretString']) + webhook = DiscordWebhook(url=secret["DiscordWebhook"]) # EC2 Public Instance if alert == 'EC2_Public_Instance': # EC2 values set as variables diff --git a/docs/v1.1.5.png b/docs/v1.1.5.png new file mode 100644 index 0000000..80e45ad Binary files /dev/null and b/docs/v1.1.5.png differ diff --git a/security_automation_tool.png b/security_automation_tool.png index a0554a9..80e45ad 100644 Binary files a/security_automation_tool.png and b/security_automation_tool.png differ