deep-security.yml

Transform: AWS::Serverless-2016-10-31
Description: AWS CloudFormation template to create custom AWS Config rules that interact
  with the Trend Micro Deep Security Manager. You will be billed for the AWS resources
  used if you create a stack from this template.
Parameters:
  ConfigBucket:
    Description: Name of the S3 bucket for AWS Config to store history and files
    Type: String
    MinLength: 1
    MaxLength: 255
  ConfigPrefix:
    Description: Object prefix inside config bucket
    Type: String
    MinLength: 1
    MaxLength: 255
  DSUsernameKey:
    Description: Parameter Store key name for Deep Security Manager username
    Type: String
  DSPasswordKey:
    Description: Parameter Store key name for Deep Security Manager password
    Type: String
  DSHostname:
    Description: Deep Security Manager hostname
    Type: String
  DSPort:
    Description: Deep Security Manager port
    Type: Number
    Default: 443
  DSTenant:
    Description: Deep Security tenant name
    Type: String
    Default: ''
  DSIgnoreSslValidation:
    Description: Whether to ignore SSL validation on connection
    Type: String
    Default: false
  DSPolicy:
    Description: Deep Security policy to check against
    Type: String
  DSControl:
    Description: Deep Security protection name to check against
    Type: String
    AllowedValues: [ anti_malware, web_reputation, firewall, intrusion_prevention, integrity_monitoring, log_inspection ]
Metadata:
  AWS::ServerlessRepo::Application:
    Name: Deep-Security-Config-Rules
    Description: A set of AWS Config Rules to help ensure that your AWS deployments are leveraging the protection of Deep Security.
      These rules help centralize your compliance information in one place, AWS Config.
    Author: Trend Micro
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE
    ReadmeUrl: README.md
    Labels: ['trendmicro', 'deepsecurity', 'security', 'config']
    HomePageUrl: https://github.com/deep-security/aws-config
    SemanticVersion: 0.0.1
    SourceCodeUrl: https://github.com/deep-security/aws-config
Resources:
  dsDoesInstanceHavePolicyLambda:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: rules/ds-DoesInstanceHavePolicy
      Description: Custom AWS Config rule that checks with the Trend Micro Deep Security
        Manager to see if the named policy is in effect. See https://github.com/deep-security/aws-config
        for more details.
      Handler: dsDoesInstanceHavePolicy.aws_config_rule_handler
      Role: !GetAtt dsConfigRuleRole.Arn
      Runtime: python3.7
      Timeout: 60
  dsDoesInstanceHavePolicyLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt dsDoesInstanceHavePolicyLambda.Arn
      Action: lambda:InvokeFunction
      Principal: config.amazonaws.com
  dsIsInstanceClearLambda:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: rules/ds-IsInstanceClear
      Description: Custom AWS Config rule that checks with the Trend Micro Deep Security
        Manager to see if the instance is clear of any alerts, warnings, or errors.
        See https://github.com/deep-security/aws-config for more details.
      Handler: dsIsInstanceClear.aws_config_rule_handler
      Role: !GetAtt dsConfigRuleRole.Arn
      Runtime: python3.7
      Timeout: 60
  dsIsInstanceClearLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt dsIsInstanceClearLambda.Arn
      Action: lambda:InvokeFunction
      Principal: config.amazonaws.com
  dsIsInstanceProtectedByLambda:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: rules/ds-IsInstanceProtectedBy
      Description: Custom AWS Config rule that checks with the Trend Micro Deep Security
        Manager to see if the instance is protected using the specified security control.
        See https://github.com/deep-security/aws-config for more details.
      Handler: dsIsInstanceProtectedBy.aws_config_rule_handler
      Role: !GetAtt dsConfigRuleRole.Arn
      Runtime: python3.7
      Timeout: 60
  dsIsInstanceProtectedByLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt dsIsInstanceProtectedByLambda.Arn
      Action: lambda:InvokeFunction
      Principal: config.amazonaws.com
  dsIsInstanceProtectedByAntiMalwareLambda:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: rules/ds-IsInstanceProtectedByAntiMalware
      Description: Custom AWS Config rule that checks with the Trend Micro Deep Security
        Manager to see if the instance is protected using the anti-malware security
        control. See https://github.com/deep-security/aws-config for more details.
      Handler: dsIsInstanceProtectedByAntiMalware.aws_config_rule_handler
      Role: !GetAtt dsConfigRuleRole.Arn
      Runtime: python3.7
      Timeout: 60
  dsIsInstanceProtectedByAntiMalwareLambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !GetAtt dsIsInstanceProtectedByAntiMalwareLambda.Arn
      Action: lambda:InvokeFunction
      Principal: config.amazonaws.com
  dsConfigRuleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      Policies:
      - PolicyName: dsConfigRulePolicy
        PolicyDocument:
          Statement:
          - Action:
            - ssm:GetParameter
            Effect: Allow
            Resource:
            - !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
          - Action:
            - kms:Decrypt
            Effect: Allow
            Resource: '*'
          - Action:
            - s3:GetObject
            Effect: Allow
            Resource: !Sub arn:aws:s3:::${ConfigBucket}/${ConfigPrefix}/*
          - Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - logs:DescribeLogStreams
            Effect: Allow
            Resource: '*'
          - Action:
            - config:PutEvaluations
            Effect: Allow
            Resource: '*'
  dsDoesInstanceHavePolicyRule:
    Type: AWS::Config::ConfigRule
    Properties:
      Description: This rule checks with the Trend Micro Deep Security
        Manager to see if the named policy is in effect.
      Scope:
        ComplianceResourceTypes:
          - AWS::EC2::Instance
      Source:
        Owner: CUSTOM_LAMBDA
        SourceIdentifier: !GetAtt dsDoesInstanceHavePolicyLambda.Arn
        SourceDetails:
          - EventSource: aws.config
            MessageType: ConfigurationItemChangeNotification
          - EventSource: aws.config
            MessageType: OversizedConfigurationItemChangeNotification
      InputParameters:
        dsUsernameKey: !Ref DSUsernameKey
        dsPasswordKey: !Ref DSPasswordKey
        dsHostname: !Ref DSHostname
        dsPort: !Ref DSPort
        dsTenant: !Ref DSTenant
        dsIgnoreSslValidation: !Ref DSIgnoreSslValidation
        dsPolicy: !Ref DSPolicy
    DependsOn:
      - dsDoesInstanceHavePolicyLambdaPermission
  dsIsInstanceClearRule:
    Type: AWS::Config::ConfigRule
    Properties:
      Description: This rule checks with the Trend Micro Deep Security Manager to see
        if the instance is clear of any alerts, warnings, or errors.
      Scope:
        ComplianceResourceTypes:
          - AWS::EC2::Instance
      Source:
        Owner: CUSTOM_LAMBDA
        SourceIdentifier: !GetAtt dsIsInstanceClearLambda.Arn
        SourceDetails:
          - EventSource: aws.config
            MessageType: ConfigurationItemChangeNotification
          - EventSource: aws.config
            MessageType: OversizedConfigurationItemChangeNotification
      InputParameters:
        dsUsernameKey: !Ref DSUsernameKey
        dsPasswordKey: !Ref DSPasswordKey
        dsHostname: !Ref DSHostname
        dsPort: !Ref DSPort
        dsTenant: !Ref DSTenant
        dsIgnoreSslValidation: !Ref DSIgnoreSslValidation
    DependsOn:
      - dsIsInstanceClearLambdaPermission
  dsIsInstanceProtectedByRule:
    Type: AWS::Config::ConfigRule
    Properties:
      Description: This rule checks with the Trend Micro Deep Security
        Manager to see if the instance is protected using the specified security control.
      Scope:
        ComplianceResourceTypes:
          - AWS::EC2::Instance
      Source:
        Owner: CUSTOM_LAMBDA
        SourceIdentifier: !GetAtt dsIsInstanceProtectedByLambda.Arn
        SourceDetails:
          - EventSource: aws.config
            MessageType: ConfigurationItemChangeNotification
          - EventSource: aws.config
            MessageType: OversizedConfigurationItemChangeNotification
      InputParameters:
        dsUsernameKey: !Ref DSUsernameKey
        dsPasswordKey: !Ref DSPasswordKey
        dsHostname: !Ref DSHostname
        dsPort: !Ref DSPort
        dsTenant: !Ref DSTenant
        dsIgnoreSslValidation: !Ref DSIgnoreSslValidation
        dsControl: !Ref DSControl
    DependsOn:
      - dsIsInstanceProtectedByLambdaPermission
  dsIsInstanceProtectedByAntiMalwareRule:
    Type: AWS::Config::ConfigRule
    Properties:
      Description: This rule checks with the Trend Micro Deep Security
        Manager to see if the instance is protected using the anti-malware security
        control.
      Scope:
        ComplianceResourceTypes:
          - AWS::EC2::Instance
      Source:
        Owner: CUSTOM_LAMBDA
        SourceIdentifier: !GetAtt dsIsInstanceProtectedByAntiMalwareLambda.Arn
        SourceDetails:
          - EventSource: aws.config
            MessageType: ConfigurationItemChangeNotification
          - EventSource: aws.config
            MessageType: OversizedConfigurationItemChangeNotification
      InputParameters:
        dsUsernameKey: !Ref DSUsernameKey
        dsPasswordKey: !Ref DSPasswordKey
        dsHostname: !Ref DSHostname
        dsPort: !Ref DSPort
        dsTenant: !Ref DSTenant
        dsIgnoreSslValidation: !Ref DSIgnoreSslValidation
    DependsOn:
      - dsIsInstanceProtectedByAntiMalwareLambdaPermission
Outputs:
  dsDoesInstanceHavePolicyLambda:
    Description: ARN for the dsDoesInstanceHavePolicy lambda
    Value: !GetAtt dsDoesInstanceHavePolicyLambda.Arn
  dsIsInstanceClearLambda:
    Description: ARN for the dsIsInstanceClearLambda lambda
    Value: !GetAtt dsIsInstanceClearLambda.Arn
  dsIsInstanceProtectedByLambda:
    Description: ARN for the dsIsInstanceProtectedByLambda lambda
    Value: !GetAtt dsIsInstanceProtectedByLambda.Arn
  dsIsInstanceProtectedByAntiMalwareLambda:
    Description: ARN for the dsIsInstanceProtectedByAntiMalwareLambda lambda
    Value: !GetAtt dsIsInstanceProtectedByAntiMalwareLambda.Arn