May 22, 2017 The lono generate command generates the CloudFormation templates to the output folder using the config/lono.rb and templates/. files. To deploy the CloudWatch Events collector from the CloudFormation template: Log into the AWS Console with an AWS account that has AWS administrator privileges. Click the region in which you want to deploy the CloudFormation template. Click Services, and then CloudFormation. Click Create Stack. AWS CloudFormation simplifies provisioning and management on AWS. You can create templates for the service or application architectures you want and have AWS CloudFormation use those templates for quick and reliable provisioning of the services or applications (called “stacks”). You can also easily update or replicate the stacks as needed.
- Create Cloudformation Template From Existing
- Generate Access Keys Using Cloudformation Template Pdf
- Generate Access Keys Using Cloud Formation Template Free
The Trusted Advisor Exposed Keys CloudWatch Event Monitor demonstrates how to use AWS Step Functions to orchestrate a serverless AWS Lambda workflow in response to an Amazon CloudWatch Event generated by AWS Trusted Advisor.
On detection of a Trusted Advisor Exposed Access Key CloudWatch Event this workflow deletes the exposed IAM Access Key, summarizes the recent API activity for the exposed key, and sends the summary message to an Amazon SNS Topic to notify the subscribers.
This repository contains sample code for all the AWS Lambda functions depicted in the diagram below as well as an AWS CloudFormation template for creating the functions and related resources.
Walkthrough of the Architecture
- An IAM Access Key is inadvertently uploaded to one of the popular code repositories (ex: github) monitored by Trusted Advisor.
- Trusted Advisor detects the key, generating a Trusted Advisor Exposed Access Keys CloudWatch Event. AWS also temporarily restricts the API calls the key is able to make.
- A configured CloudWatch Events rule matches this event, triggering an execution of the
ExposedKey
Step Functions state machine, which has the following sub-steps:- Delete the exposed IAM Access Key Pair
- Summarize recent API activity for the user from CloudTrail
- Send security notification message containing summary to
SecurityNotificationTopic
SNS Topic.
Running the Example
Option 1: Launch the CloudFormation Template in US East - N. Virginia (us-east-1)
The backend infrastructure can be deployed in US East - N. Virginia (us-east-1) using the provided CloudFormation template.Click Launch Stack to launch the template in the US East - N. Virginia (us-east-1) region in your account:
(In the last page of the wizard, make sure to:
- Click the checkboxes to give AWS CloudFormation permission to 'create IAM resources' and 'create IAM resources with custom names'
- Follow the instructions to 'Create Change Set'
- Click 'Execute')
Option 2: Launch the CloudFormation Template Manually
If you would like to deploy the template manually, you need a S3 bucket in the target region, and then package the Lambda functions into that S3 bucket by using the
aws cloudformation package
utility.** Note that this template may only be launched into US East - N. Virginia (us-east-1) as that is the only region where Trusted Advisor CloudWatch Event rules are configurable. **
Set environment variables for later commands to use:
Then go to the
cloudformation
folder and use the aws cloudformation package
utilityLast, deploy the stack with the resulting yaml (
exposed_access_keys.output.yaml
) through the CloudFormation Console or command line:Testing the Example
To test the example without exposing an IAM Access Key to a public repository you can simulate the workflow by executing the
ExposedKey
state machine with a set of test json for the event. To do this follow the steps detailed below.Ensure you have at least one E-mail address subscribed to the
SecurityNotificationTopic
created by the template to receive the notification.- Go to the Identity & Access Management console
- Go to
Users
- Click
Add User
and create a user with programmatic access- For the
User name
puttest-user
- For
Access type
selectProgrammatic access
- Do not set any permissions for the user
- Note the
Access key ID
from the Review page for later use in the test json
- For the
- Go to the Step Functions console
- Select the
ExposedKey
state machine - Click
New execution
to create the test execution of the state machine- Copy and paste the json below to the execution json field
- Replace
ACCESS_KEY_ID_HERE
with theAccess key ID
noted from the earlier creation oftest-user
- You do not need to enter an execution id as one will be randomly generated by default
![Template Template](/uploads/1/3/3/8/133890468/639398876.png)
You can follow the state machine's progress in the Step Functions console. The summary message for
test-user
will be sent to the e-mail address(es) subscribed to the SecurityNotificationTopic
SNS Topic.- Note that the summary for this user will likely be empty as it will not have logged any API calls to CloudTrail
Here is an example of what this message might look like for a user who has made recent API calls to IAM and Step Functions:
Cleaning Up the Stack Resources
To remove all resources created by this example, do the following:
Create Cloudformation Template From Existing
- Delete the CloudFormation stack.
- Delete the CloudWatch log groups associated with each Lambda function created by the CloudFormation stack.
CloudFormation Template Resources
The following sections explain all of the resources created by the CloudFormation template provided with this example.
CloudWatch
- TrustedAdvisorExposedKeyRule - A CloudWatch Events Rule to detect Trusted Advisor Exposed Key events and send them to the Step Functions state machine target
Step Functions
- ExposedKeysStepFunction - A Step Functions state machine that orchestrates the access key deletion, API call summary, and notification of security
Lambda
Generate Access Keys Using Cloudformation Template Pdf
- DeleteAccessKeyPair - Lambda function that deletes the exposed IAM Access Key Pair associated with username provided by event.
- LookupCloudTrailEvents - Lambda function that looks up and summarizes recent API activity for the exposed access key provided by the event.
- NotifySecurity - Lambda function that constructs and sends security notification message containing API activity summary to SNS Topic created by this CloudFormation template.
SNS
- NotificationTopic - SNS Topic that API activity security message is sent to.
IAM
Generate Access Keys Using Cloud Formation Template Free
- ExecuteStateMachineRole - IAM Role with policy that allows CloudWatch Events rule to invoke executions of Step Functions state machines
- StepFunctionExecutionRole IAM Role with policy that allows Step Functions state machines to invoke Lambda functions.
- LambdaDeleteAccessKeyPairRole - IAM Role with policy that allows Lambda function to invoke 'iam:DeleteAccessKey' API call and write log messages to CloudWatch Logs.
- LambdaLookupCloudTrailEventsRole - IAM Role with policy that allows Lambda function to invoke 'cloudtrail:LookupEvents' API call and write log messages to CloudWatch Logs.
- LambdaSnsPublishRole - IAM Role with policy that allows Lambda function to invoke 'sns:Publish' API call and write log messages to CloudWatch Logs.
License
This reference architecture sample is licensed under Apache 2.0.