cfn-guardian 0.1.0 → 0.3.3

data/lib/cfnguardian/drift.rb

@@ -0,0 +1,79 @@
+require 'aws-sdk-cloudformation'
+
+module CfnGuardian
+  class Drift
+    
+    def initialize(stack)
+      @stack = stack
+      @client = Aws::CloudFormation::Client.new()
+    end
+    
+    def find_nested_stacks
+      stacks = []
+      resp = @client.describe_stack_resources({
+        stack_name: @stack
+      })
+      resp.stack_resources.each do |r|
+        if r.resource_type == 'AWS::CloudFormation::Stack'
+          stacks << r.physical_resource_id
+        end
+      end
+      return stacks
+    end
+    
+    def detect_drift(stack)
+      resp = @client.detect_stack_drift({
+        stack_name: stack
+      })
+      wait_for_dirft_detection(resp.stack_drift_detection_id)
+    end
+    
+    def wait_for_dirft_detection(id,count=0)
+      resp = @client.describe_stack_drift_detection_status({
+        stack_drift_detection_id: id
+      })
+      if resp.detection_status == 'DETECTION_IN_PROGRESS' && count < 10
+        sleep(2)
+        count += 1
+        wait_for_dirft_detection(id,count)
+      end
+    end
+    
+    def get_drift(stack)
+      rows = []
+      resp = @client.describe_stack_resource_drifts({
+        stack_name: stack,
+        stack_resource_drift_status_filters: ["MODIFIED", "DELETED"]
+      })
+      
+      if resp.stack_resource_drifts.any?
+        resp.stack_resource_drifts.each do |drift|
+          next if drift.resource_type != 'AWS::CloudWatch::Alarm'
+          
+          if drift.stack_resource_drift_status == 'MODIFIED'
+            drift.property_differences.each do |diff|
+              rows << [
+                drift.physical_resource_id,
+                diff.property_path,
+                diff.expected_value,
+                diff.actual_value,
+                diff.difference_type
+              ]
+            end
+          elsif drift.stack_resource_drift_status == 'DELETED'
+            rows << [
+              drift.physical_resource_id.red,
+              "",
+              "",
+              "",
+              drift.stack_resource_drift_status.red
+            ]
+          end
+        end
+      end
+      
+      return rows
+    end
+    
+  end
+end

data/lib/cfnguardian/log.rb

@@ -13,7 +13,6 @@ module Logging
     
     def logger
       @logger ||= Logger.new($stdout)
-      @logger.level = Logger::DEBUG
       @logger.formatter = proc do |severity, datetime, progname, msg|
         "\e[#{colors[severity.to_sym]}m#{severity}: #{msg}\e[0m\n"
       end

data/lib/cfnguardian/models/alarm.rb

@@ -1,11 +1,14 @@
 require 'cfnguardian/string'
+require 'digest/md5'
 
 module CfnGuardian
   module Models
     class Alarm
       
-      attr_reader :type
-      attr_accessor :class,
+      attr_reader :type,
+        :resource_hash
+        
+      attr_accessor :group,
         :name,
         :metric_name,
         :namespace,
@@ -17,21 +20,23 @@ module CfnGuardian
         :statistic,
         :actions_enabled,
         :enabled,
-        :resource,
+        :resource_id,
+        :resource_name,
         :alarm_action,
         :treat_missing_data,
         :datapoints_to_alarm,
         :extended_statistic,
         :evaluate_low_sample_count_percentile,
-        :unit
+        :unit,
+        :maintenance_groups
       
       def initialize(resource)
         @type = 'Alarm'
-        @class = nil
+        @group = nil
         @name = ''
         @metric_name = nil
         @namespace = nil
-        @dimensions = {}
+        @dimensions = nil
         @threshold = 0
         @period = 60
         @evaluation_periods = 1
@@ -43,28 +48,25 @@ module CfnGuardian
         @evaluate_low_sample_count_percentile = nil
         @unit = nil
         @enabled = true
-        @resource_name = Digest::MD5.hexdigest resource['Id']
-        @resource = resource['Id']
+        @resource_hash = Digest::MD5.hexdigest resource['Id']
+        @resource_id = resource['Id']
+        @resource_name = resource.fetch('Name', nil)
         @alarm_action = 'Critical'
         @treat_missing_data = nil
+        @maintenance_groups = []
       end
       
       def metric_name=(metric_name)
         raise ArgumentError.new("metric_name '#{metric_name}' must be of type String, provided type '#{metric_name.class}'") unless metric_name.is_a?(String)
         @metric_name=metric_name
-      end
-      
-      def to_h
-        Hash[instance_variables.map { |name| [name[1..-1].to_sym, instance_variable_get(name)] } ]
-      end
-      
+      end      
     end
     
     
     class ApiGatewayAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'ApiGateway'
+        @group = 'ApiGateway'
         @namespace = 'AWS/ApiGateway'
         @dimensions = { ApiName: resource['Id'] }
       end
@@ -73,7 +75,7 @@ module CfnGuardian
     class ApplicationTargetGroupAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'ApplicationTargetGroup'
+        @group = 'ApplicationTargetGroup'
         @namespace = 'AWS/ApplicationELB'
         @dimensions = { 
           TargetGroup: resource['Id'],
@@ -85,7 +87,7 @@ module CfnGuardian
     class AmazonMQBrokerAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'AmazonMQBroker'
+        @group = 'AmazonMQBroker'
         @namespace = 'AWS/AmazonMQ'
         @dimensions = { Broker: resource['Id'] }
       end
@@ -94,7 +96,7 @@ module CfnGuardian
     class CloudFrontDistributionAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'CloudFrontDistribution'
+        @group = 'CloudFrontDistribution'
         @namespace = 'AWS/CloudFront'
         @dimensions = { 
           DistributionId: resource['Id'],
@@ -108,7 +110,7 @@ module CfnGuardian
     class AutoScalingGroupAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'AutoScalingGroup'
+        @group = 'AutoScalingGroup'
         @namespace = 'AWS/EC2'
         @dimensions = { AutoScalingGroupName: resource['Id'] }
       end
@@ -117,7 +119,7 @@ module CfnGuardian
     class DomainExpiryAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'DomainExpiry'
+        @group = 'DomainExpiry'
         @namespace = 'DNS'
         @dimensions = { Domain: resource['Id'] }
         @comparison_operator = 'LessThanThreshold'
@@ -127,7 +129,7 @@ module CfnGuardian
     class DynamoDBTableAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'DynamoDBTable'
+        @group = 'DynamoDBTable'
         @namespace = 'AWS/DynamoDB'
         @dimensions = { TableName: resource['Id'] }
       end
@@ -136,7 +138,7 @@ module CfnGuardian
     class Ec2InstanceAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'Ec2Instance'
+        @group = 'Ec2Instance'
         @namespace = 'AWS/EC2'
         @dimensions = { InstanceId: resource['Id'] }
       end
@@ -145,7 +147,7 @@ module CfnGuardian
     class ECSClusterAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'ECSCluster'
+        @group = 'ECSCluster'
         @namespace = 'AWS/ECS'
         @dimensions = { ClusterName: resource['Id'] }
         @threshold = 75
@@ -157,7 +159,7 @@ module CfnGuardian
     class ECSServiceAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'ECSService'
+        @group = 'ECSService'
         @namespace = 'AWS/ECS'
         @dimensions = {
           ServiceName: resource['Id'],
@@ -169,7 +171,7 @@ module CfnGuardian
     class ElastiCacheReplicationGroupAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'ElastiCacheReplicationGroup'
+        @group = 'ElastiCacheReplicationGroup'
         @namespace = 'AWS/ElastiCache'
         @dimensions = { CacheClusterId: resource['Id'] }
       end
@@ -178,7 +180,7 @@ module CfnGuardian
     class ElasticLoadBalancerAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'ElasticLoadBalancer'
+        @group = 'ElasticLoadBalancer'
         @namespace = 'AWS/ELB'
         @dimensions = { LoadBalancerName: resource['Id'] }
       end
@@ -187,7 +189,7 @@ module CfnGuardian
     class ElasticFileSystemAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'ElasticFileSystem'
+        @group = 'ElasticFileSystem'
         @namespace = 'AWS/EFS'
         @dimensions = { FileSystemId: resource['Id'] }
       end
@@ -196,7 +198,7 @@ module CfnGuardian
     class HttpAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'Http'
+        @group = 'Http'
         @namespace = 'HttpCheck'
         @dimensions = { Endpoint: resource['Id'] }
         @comparison_operator = 'LessThanThreshold'
@@ -204,11 +206,33 @@ module CfnGuardian
         @evaluation_periods = 2
       end
     end
+
+    class PortAlarm < Alarm
+      def initialize(resource)
+        super(resource)
+        @group = 'Port'
+        @namespace = 'TcpPortCheck'
+        @dimensions = { Endpoint: "#{resource['Id']}:#{resource['Port']}" }
+        @comparison_operator = 'LessThanThreshold'
+        @threshold = 1
+        @evaluation_periods = 2
+      end
+    end
+    
+    class SslAlarm < Alarm
+      def initialize(resource)
+        super(resource)
+        @group = 'Ssl'
+        @namespace = 'SSL'
+        @dimensions = { URL: resource['Id'] }
+        @comparison_operator = 'LessThanThreshold'
+      end
+    end
     
     class NrpeAlarm < Alarm
       def initialize(resource,environment)
         super(resource)
-        @class = 'Nrpe'
+        @group = 'Nrpe'
         @namespace = 'NRPE'
         @dimensions = { Host: "#{environment}-#{resource['Id']}" }
         @treat_missing_data = 'breaching'
@@ -219,7 +243,7 @@ module CfnGuardian
     class LambdaAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'Lambda'
+        @group = 'Lambda'
         @namespace = 'AWS/Lambda'
         @dimensions = { FunctionName: resource['Id'] }
         @statistic = 'Average'
@@ -230,7 +254,7 @@ module CfnGuardian
     class NetworkTargetGroupAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'NetworkTargetGroup'
+        @group = 'NetworkTargetGroup'
         @namespace = 'AWS/NetworkELB'
         @dimensions = { 
           TargetGroup: resource['Id'],
@@ -242,7 +266,7 @@ module CfnGuardian
     class RedshiftClusterAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'RedshiftCluster'
+        @group = 'RedshiftCluster'
         @namespace = 'AWS/Redshift'
         @dimensions = { ClusterIdentifier: resource['Id'] }
       end
@@ -251,7 +275,7 @@ module CfnGuardian
     class RDSClusterInstanceAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'RDSClusterInstance'
+        @group = 'RDSClusterInstance'
         @namespace = 'AWS/RDS'
         @dimensions = { DBInstanceIdentifier: resource['Id'] }
       end
@@ -260,7 +284,7 @@ module CfnGuardian
     class RDSInstanceAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'RDSInstance'
+        @group = 'RDSInstance'
         @namespace = 'AWS/RDS'
         @dimensions = { DBInstanceIdentifier: resource['Id'] }
       end
@@ -269,7 +293,7 @@ module CfnGuardian
     class SqlAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'Sql'
+        @group = 'Sql'
         @namespace = 'SQL'
         @dimensions = { Host: resource['Id'] }
         @treat_missing_data = 'breaching'
@@ -280,7 +304,7 @@ module CfnGuardian
     class SQSQueueAlarm < Alarm
       def initialize(resource)
         super(resource)
-        @class = 'SQSQueue'
+        @group = 'SQSQueue'
         @namespace = 'AWS/SQS'
         @dimensions = { QueueName: resource['Id'] }
         @statistic = 'Average'
@@ -288,5 +312,43 @@ module CfnGuardian
       end
     end
     
+    class LogGroupAlarm < Alarm
+      def initialize(resource)
+        super(resource)
+        @group = 'LogGroup'
+        @namespace = "MetricFilters"
+        @statistic = 'Sum'
+        @threshold = 1
+        @period = 300
+        @alarm_action = 'Informational'
+      end
+    end
+    
+    class SFTPAlarm < Alarm
+      def initialize(resource)
+        super(resource)
+        @group = 'SFTP'
+        @namespace = 'SftpCheck'
+        @period = 300
+        @comparison_operator = 'LessThanThreshold'
+        @threshold = 1
+        @dimensions = { Host: resource['Id'], User: resource['User'] }
+      end
+    end
+    
+    class TLSAlarm < Alarm
+      def initialize(resource)
+        super(resource)
+        @group = 'TLS'
+        @namespace = 'TLSVersionCheck'
+        @period = 300
+        @port = resource.fetch('Port', 443)
+        @dimensions = { Endpoint: "#{resource['Id']}:#{@port}" }
+        @comparison_operator = 'LessThanThreshold'
+        @threshold = 1
+        @evaluation_periods = 1
+      end
+    end
+    
   end
 end

data/lib/cfnguardian/models/check.rb

@@ -5,51 +5,84 @@ module CfnGuardian
     class Check
       
       attr_reader :type
-      attr_accessor :class,
+      attr_accessor :group,
         :name,
+        :package,
         :handler,
         :version,
         :runtime,
-        :environment
+        :environment,
+        :subnets, 
+        :vpc
         
       def initialize(resource)
         @type = 'Check'
-        @class = nil
+        @group = nil
         @name = nil
         @package = nil
         @handler = nil
         @version = nil
         @runtime = nil
         @environment = ''
-      end
-      
-      def to_h
-        Hash[instance_variables.map { |name| [name[1..-1].to_sym, instance_variable_get(name)] } ]
+        @subnets = nil
+        @vpc = nil
       end
     end
     
     class HttpCheck < Check      
       def initialize(resource)
         super(resource)
-        @class = 'Http'
+        @group = 'Http'
         @name = 'HttpCheck'
-        @package = 'aws-lambda-http-check'
-        @handler = 'handler.main'
-        @version = '0.1'
+        @package = 'http-check'
+        @handler = 'handler.http_check'
+        @version = '0bc33e51abb1f27729ecb170611bf6b440e71a0e'
+        @runtime = 'python3.7'
+      end
+    end
+    
+    class InternalHttpCheck < HttpCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'InternalHttp'
+        @name = 'InternalHttpCheck'
+        @subnets = resource['Subnets']
+        @vpc = resource['VpcId']
+        @environment = resource['Environment']
+      end
+    end
+    
+    class PortCheck < Check      
+      def initialize(resource)
+        super(resource)
+        @group = 'Port'
+        @name = 'PortCheck'
+        @package = 'port-check'
+        @handler = 'handler.port_check'
+        @version = '356203b2a720ba0730622f978e677b88f8d0c328'
         @runtime = 'python3.6'
       end
     end
     
+    class InternalPortCheck < PortCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'InternalPort'
+        @name = 'InternalPortCheck'
+        @subnets = resource['Subnets']
+        @vpc = resource['VpcId']
+        @environment = resource['Environment']
+      end
+    end
+    
     class NrpeCheck < Check
-      attr_accessor :subnets, :vpc
-      
       def initialize(resource)
         super(resource)
-        @class = 'Nrpe'
+        @group = 'Nrpe'
         @name = 'NrpeCheck'
         @package = 'aws-lambda-nrpe-check'
         @handler = 'main'
-        @version = '0.2'
+        @version = 'aa51a0ad497a6c012a3639da0eb3446e4c0f9540'
         @runtime = 'go1.x'
         @subnets = resource['Subnets']
         @vpc = resource['VpcId']
@@ -60,37 +93,46 @@ module CfnGuardian
     class SslCheck < Check
       def initialize(resource)
         super(resource)
-        @class = 'Ssl'
+        @group = 'Ssl'
         @name = 'SslCheck'
         @package = 'aws-lambda-ssl-check'
         @handler = 'main'
-        @version = '0.1'
+        @version = 'a25fd4006d1f95c06f3c098188543f5eea1986da'
         @runtime = 'go1.x'
       end
     end
     
+    class InternalSslCheck < SslCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'InternalSsl'
+        @name = 'InternalSslCheck'
+        @subnets = resource['Subnets']
+        @vpc = resource['VpcId']
+        @environment = resource['Environment']
+      end
+    end
+    
     class DomainExpiryCheck < Check
       def initialize(resource)
         super(resource)
-        @class = 'DomainExpiry'
+        @group = 'DomainExpiry'
         @name = 'DomainExpiryCheck'
         @package = 'aws-lambda-dns-check'
         @handler = 'main'
-        @version = '0.1'
+        @version = '9db96ca32379faddc47e55849b7e296b7b70a48e'
         @runtime = 'go1.x'
       end
     end
     
     class SqlCheck < Check
-      attr_accessor :subnets, :vpc
-      
       def initialize(resource)
         super(resource)
-        @class = 'Sql'
+        @group = 'Sql'
         @name = 'SqlCheck'
         @package = 'aws-lambda-sql-check'
         @handler = 'main'
-        @version = '0.1'
+        @version = '83bd6399c0376c98df90dd5f29e49d629c556cee'
         @runtime = 'go1.x'
         @subnets = resource['Subnets']
         @vpc = resource['VpcId']
@@ -101,14 +143,49 @@ module CfnGuardian
     class ContainerInstanceCheck < Check
       def initialize(resource)
         super(resource)
-        @class = 'ContainerInstance'
+        @group = 'ContainerInstance'
         @name = 'ContainerInstanceCheck'
-        @package = 'aws-lambda-ecs-container-instance-check'
+        @package = 'ecs-containder-instance-check'
         @handler = 'handler.run_check'
-        @version = '0.1'
+        @version = '4f650d5846d6e8d19f0139bccdeeb147f03f0dd6'
         @runtime = 'python3.6'
       end
     end
+    
+    class TLSCheck < Check
+      def initialize(resource)
+        super(resource)
+        @group = 'TLS'
+        @name = 'TLSCheck'
+        @package = 'tls-version-check'
+        @handler = 'handler.run_check'
+        @version = 'de83afdde0d976364af37ad7552a8496c3c94ab5'
+        @runtime = 'python3.7'
+      end
+    end
+    
+    class SFTPCheck < Check
+      def initialize(resource)
+        super(resource)
+        @group = 'SFTP'
+        @name = 'SFTPCheck'
+        @package = 'sftp-check'
+        @handler = 'handler.sftp_check'
+        @version = '987e71f2607347e13e3f156535059d6d3ce1ceed'
+        @runtime = 'python3.7'
+      end
+    end
+    
+    class InternalSFTPCheck < SFTPCheck
+      def initialize(resource)
+        super(resource)
+        @group = 'InternalSFTP'
+        @name = 'InternalSFTPCheck'
+        @subnets = resource['Subnets']
+        @vpc = resource['VpcId']
+        @environment = resource['Environment']
+      end
+    end
 
   end
 end