cfn-guardian 0.1.0 → 0.3.3

data/lib/cfnguardian/resources/ecs_service.rb

@@ -8,7 +8,7 @@ module CfnGuardian
         alarm.metric_name = 'MemoryUtilization'
         alarm.comparison_operator = 'LessThanOrEqualToThreshold'
         alarm.statistic = 'SampleCount'
-        alarm.threshold = 15
+        alarm.threshold = 0
         alarm.evaluation_periods = 10
         alarm.treat_missing_data = 'breaching'
         alarm.datapoints_to_alarm = 8
@@ -19,7 +19,7 @@ module CfnGuardian
         alarm.metric_name = 'MemoryUtilization'
         alarm.comparison_operator = 'LessThanOrEqualToThreshold'
         alarm.statistic = 'SampleCount'
-        alarm.threshold = 15
+        alarm.threshold = 1
         alarm.evaluation_periods = 10
         alarm.treat_missing_data = 'breaching'
         alarm.datapoints_to_alarm = 8

data/lib/cfnguardian/resources/http.rb

@@ -14,8 +14,9 @@ module CfnGuardian::Resource
       alarm.metric_name = 'StatusCodeMatch'
       @alarms.push(alarm)
             
-      alarm = CfnGuardian::Models::ElasticLoadBalancerAlarm.new(@resource)
+      alarm = CfnGuardian::Models::HttpAlarm.new(@resource)
       alarm.name = 'EndpointTimeTaken'
+      alarm.comparison_operator = 'GreaterThanThreshold'
       alarm.metric_name = 'TimeTaken'
       alarm.statistic = 'Minimum'
       alarm.threshold = 1000
@@ -29,6 +30,20 @@ module CfnGuardian::Resource
         alarm.metric_name = 'ResponseBodyRegexMatch'
         @alarms.push(alarm)
       end
+      
+      if @resource.has_key?('Ssl') && @resource['Ssl']
+        alarm = CfnGuardian::Models::SslAlarm.new(@resource)
+        alarm.name = 'ExpiresInDaysCritical'
+        alarm.metric_name = 'ExpiresInDays'
+        alarm.threshold = 5
+        @alarms.push(alarm)
+        
+        alarm = CfnGuardian::Models::SslAlarm.new(@resource)
+        alarm.name = 'ExpiresInDaysTask'
+        alarm.metric_name = 'ExpiresInDays'
+        alarm.threshold = 30
+        @alarms.push(alarm)
+      end
     end
     
     def default_events()

data/lib/cfnguardian/resources/internal_http.rb

@@ -0,0 +1,74 @@
+require 'digest/md5'
+
+module CfnGuardian::Resource
+  class InternalHttp < Base
+    
+    def initialize(resource)
+      super(resource)
+      @resource_list = resource['Hosts']
+      @environment = resource['Environment']
+    end
+    
+    def default_alarms    
+      @resource_list.each do |host|
+        alarm = CfnGuardian::Models::HttpAlarm.new(host)
+        alarm.name = 'EndpointAvailable'
+        alarm.metric_name = 'Available'
+        @alarms.push(alarm)
+        
+        alarm = CfnGuardian::Models::HttpAlarm.new(host)
+        alarm.name = 'EndpointStatusCodeMatch'
+        alarm.metric_name = 'StatusCodeMatch'
+        @alarms.push(alarm)
+              
+        alarm = CfnGuardian::Models::HttpAlarm.new(host)
+        alarm.name = 'EndpointTimeTaken'
+        alarm.comparison_operator = 'GreaterThanThreshold'
+        alarm.metric_name = 'TimeTaken'
+        alarm.statistic = 'Minimum'
+        alarm.threshold = 1000
+        alarm.period = 300
+        alarm.evaluation_periods = 1
+        @alarms.push(alarm)
+        
+        if host.has_key?('BodyRegex')
+          alarm = CfnGuardian::Models::HttpAlarm.new(host)
+          alarm.name = 'EndpointBodyRegexMatch'
+          alarm.metric_name = 'ResponseBodyRegexMatch'
+          @alarms.push(alarm)
+        end
+        
+        if host.has_key?('Ssl') && host['Ssl']
+          alarm = CfnGuardian::Models::SslAlarm.new(host)
+          alarm.name = 'ExpiresInDaysCritical'
+          alarm.metric_name = 'ExpiresInDays'
+          alarm.threshold = 5
+          @alarms.push(alarm)
+          
+          alarm = CfnGuardian::Models::SslAlarm.new(host)
+          alarm.name = 'ExpiresInDaysTask'
+          alarm.metric_name = 'ExpiresInDays'
+          alarm.threshold = 30
+          @alarms.push(alarm)
+        end
+      end
+    end
+    
+    def default_events()
+      @resource_list.each do |host| 
+        @events.push(CfnGuardian::Models::InternalHttpEvent.new(host,@environment))
+        if host.has_key?('Ssl') && host['Ssl']
+          @events.push(CfnGuardian::Models::InternalSslEvent.new(host,@environment))
+        end
+      end
+    end
+    
+    def default_checks()
+      @checks.push(CfnGuardian::Models::InternalHttpCheck.new(@resource))
+      if @resource_list.any? {|host| host.has_key?('Ssl') && host['Ssl'] }
+        @checks.push(CfnGuardian::Models::InternalSslCheck.new(@resource))
+      end
+    end
+    
+  end
+end

data/lib/cfnguardian/resources/internal_port.rb

@@ -0,0 +1,33 @@
+module CfnGuardian::Resource
+  class InternalPort < Base
+    
+    def initialize(resource)
+      super(resource)
+      @resource_list = resource['Hosts']
+      @environment = resource['Environment']
+    end
+    
+    def default_alarms    
+      @resource_list.each do |host|
+        alarm = CfnGuardian::Models::PortAlarm.new(host)
+        alarm.name = 'EndpointAvailable'
+        alarm.metric_name = 'Available'
+        @alarms.push(alarm)
+        
+        alarm = CfnGuardian::Models::PortAlarm.new(host)
+        alarm.name = 'EndpointTimeTaken'
+        alarm.metric_name = 'TimeTaken'
+        @alarms.push(alarm)
+      end
+    end
+    
+    def default_events()
+      @resource_list.each {|host| @events.push(CfnGuardian::Models::InternalPortEvent.new(host,@environment))}
+    end
+    
+    def default_checks()
+      @checks.push(CfnGuardian::Models::InternalPortCheck.new(@resource))
+    end
+    
+  end
+end

data/lib/cfnguardian/resources/internal_sftp.rb

@@ -0,0 +1,58 @@
+module CfnGuardian::Resource
+  class InternalSFTP < Base
+    
+    def initialize(resource)
+      super(resource)
+      @resource_list = resource['Hosts']
+      @environment = resource['Environment']
+    end
+    
+    def default_alarms
+      @resource_list.each do |host|
+        alarm = CfnGuardian::Models::SFTPAlarm.new(host)
+        alarm.name = 'Available'
+        alarm.metric_name = 'Available'
+        @alarms.push(alarm)
+        
+        alarm = CfnGuardian::Models::SFTPAlarm.new(host)
+        alarm.name = 'ConnectionTime'
+        alarm.metric_name = 'ConnectionTime'
+        alarm.comparison_operator = 'GreaterThanThreshold'
+        alarm.statistic = 'Minimum'
+        alarm.threshold = 1000
+        @alarms.push(alarm)
+        
+        if host.has_key?('File')
+          alarm = CfnGuardian::Models::SFTPAlarm.new(host)
+          alarm.name = 'FileExists'
+          alarm.metric_name = 'FileExists'
+          @alarms.push(alarm)
+        
+          alarm = CfnGuardian::Models::SFTPAlarm.new(host)
+          alarm.name = 'FileGetTime'
+          alarm.metric_name = 'FileGetTime'
+          alarm.comparison_operator = 'GreaterThanThreshold'
+          alarm.statistic = 'Minimum'
+          alarm.threshold = 1000
+          @alarms.push(alarm)
+          
+          if host.has_key?('FileRegexMatch')
+            alarm = CfnGuardian::Models::SFTPAlarm.new(host)
+            alarm.name = 'FileBodyMatch'
+            alarm.metric_name = 'FileBodyMatch'
+            @alarms.push(alarm)
+          end
+        end
+      end
+    end
+    
+    def default_events
+      @resource_list.each {|host| @events.push(CfnGuardian::Models::InternalSFTPEvent.new(host,@environment)) }
+    end
+    
+    def default_checks
+      @checks.push(CfnGuardian::Models::InternalSFTPCheck.new(@resource))
+    end
+    
+  end
+end

data/lib/cfnguardian/resources/log_group.rb

@@ -0,0 +1,26 @@
+module CfnGuardian::Resource
+  class LogGroup < Base
+    
+    def initialize(resource)
+      super(resource)
+      @resource_list = resource['MetricFilters']
+    end
+    
+    def default_alarms()
+      @resource_list.each do |filter|
+        alarm = CfnGuardian::Models::LogGroupAlarm.new(@resource)
+        alarm.name = filter['MetricName']
+        alarm.metric_name = filter['MetricName']
+        @alarms.push(alarm)
+      end
+    end
+    
+    def default_metric_filters()
+      @resource_list.each do |filter|
+        metric_filter = CfnGuardian::Models::MetricFilter.new(@resource['Id'],filter)
+        @metric_filters.push(metric_filter)
+      end
+    end
+    
+  end
+end

data/lib/cfnguardian/resources/network_targetgroup.rb

@@ -5,6 +5,7 @@ module CfnGuardian::Resource
       alarm = CfnGuardian::Models::NetworkTargetGroupAlarm.new(@resource)
       alarm.name = 'HealthyHosts'
       alarm.metric_name = 'HealthyHostCount'
+      alarm.comparison_operator = 'LessThanThreshold'
       alarm.statistic = 'Minimum'
       alarm.threshold = 2
       alarm.evaluation_periods = 1

data/lib/cfnguardian/resources/port.rb

@@ -0,0 +1,25 @@
+module CfnGuardian::Resource
+  class Port < Base
+    
+    def default_alarms    
+      alarm = CfnGuardian::Models::PortAlarm.new(@resource)
+      alarm.name = 'EndpointAvailable'
+      alarm.metric_name = 'Available'
+      @alarms.push(alarm)
+      
+      alarm = CfnGuardian::Models::PortAlarm.new(@resource)
+      alarm.name = 'EndpointTimeTaken'
+      alarm.metric_name = 'TimeTaken'
+      @alarms.push(alarm)
+    end
+    
+    def default_events()
+      @events.push(CfnGuardian::Models::PortEvent.new(@resource))
+    end
+    
+    def default_checks()
+      @checks.push(CfnGuardian::Models::PortCheck.new(@resource))
+    end
+    
+  end
+end

data/lib/cfnguardian/resources/rds_instance.rb

@@ -7,6 +7,7 @@ module CfnGuardian::Resource
       alarm.metric_name = 'FreeStorageSpace'
       alarm.threshold = 50000000000
       alarm.evaluation_periods = 1
+      alarm.comparison_operator = 'LessThanThreshold'
       @alarms.push(alarm)
       
       alarm = CfnGuardian::Models::RDSInstanceAlarm.new(@resource)
@@ -14,6 +15,7 @@ module CfnGuardian::Resource
       alarm.metric_name = 'FreeStorageSpace'
       alarm.threshold = 100000000000
       alarm.evaluation_periods = 1
+      alarm.comparison_operator = 'LessThanThreshold'
       alarm.alarm_action = 'Task'
       @alarms.push(alarm)
          

data/lib/cfnguardian/resources/sftp.rb

@@ -0,0 +1,50 @@
+module CfnGuardian::Resource
+  class SFTP < Base
+    
+    def default_alarms    
+      alarm = CfnGuardian::Models::SFTPAlarm.new(@resource)
+      alarm.name = 'Available'
+      alarm.metric_name = 'Available'
+      @alarms.push(alarm)
+      
+      alarm = CfnGuardian::Models::SFTPAlarm.new(@resource)
+      alarm.name = 'ConnectionTime'
+      alarm.metric_name = 'ConnectionTime'
+      alarm.comparison_operator = 'GreaterThanThreshold'
+      alarm.statistic = 'Minimum'
+      alarm.threshold = 1000
+      @alarms.push(alarm)
+      
+      if @resource.has_key?('File')
+        alarm = CfnGuardian::Models::SFTPAlarm.new(@resource)
+        alarm.name = 'FileExists'
+        alarm.metric_name = 'FileExists'
+        @alarms.push(alarm)
+      
+        alarm = CfnGuardian::Models::SFTPAlarm.new(@resource)
+        alarm.name = 'FileGetTime'
+        alarm.metric_name = 'FileGetTime'
+        alarm.comparison_operator = 'GreaterThanThreshold'
+        alarm.statistic = 'Minimum'
+        alarm.threshold = 1000
+        @alarms.push(alarm)
+        
+        if @resource.has_key?('FileRegexMatch')
+          alarm = CfnGuardian::Models::SFTPAlarm.new(@resource)
+          alarm.name = 'FileBodyMatch'
+          alarm.metric_name = 'FileBodyMatch'
+          @alarms.push(alarm)
+        end
+      end
+    end
+    
+    def default_events
+      @events.push(CfnGuardian::Models::SFTPEvent.new(@resource))
+    end
+    
+    def default_checks
+      @checks.push(CfnGuardian::Models::SFTPCheck.new(@resource))
+    end
+    
+  end
+end

data/lib/cfnguardian/resources/sql.rb

@@ -24,7 +24,7 @@ module CfnGuardian::Resource
     def default_events()
       @resource_list.each do |host|
         host['Queries'].each do |query|
-          @events.push(CfnGuardian::Models::SqlEvent.new(host,query['Query']))
+          @events.push(CfnGuardian::Models::SqlEvent.new(host,query['Query'],@environment))
         end
       end
     end

data/lib/cfnguardian/resources/tls.rb

@@ -0,0 +1,66 @@
+module CfnGuardian::Resource
+  class TLS < Base
+    
+    def default_alarms
+      
+      versions = @resource.fetch('Versions',['SSLv2','SSLv3','TLSv1','TLSv1.1','TLSv1.2'])
+      
+      if versions.include? "SSLv2"
+        alarm = CfnGuardian::Models::TLSAlarm.new(@resource)
+        alarm.name = "TLSVersionSSLv2"
+        alarm.metric_name = "SSLv2"
+        alarm.comparison_operator = 'GreaterThanThreshold'
+        alarm.threshold = 0
+        @alarms.push(alarm)
+      end
+      
+      if versions.include? "SSLv3"
+        alarm = CfnGuardian::Models::TLSAlarm.new(@resource)
+        alarm.name = "TLSVersionSSLv3"
+        alarm.metric_name = "SSLv3"
+        alarm.comparison_operator = 'GreaterThanThreshold'
+        alarm.threshold = 0
+        @alarms.push(alarm)
+      end
+      
+      if versions.include? "SSLv3"
+        alarm = CfnGuardian::Models::TLSAlarm.new(@resource)
+        alarm.name = "TLSVersionTLSv1"
+        alarm.metric_name = "TLSv1"
+        @alarms.push(alarm)
+      end
+      
+      if versions.include? "SSLv3"
+        alarm = CfnGuardian::Models::TLSAlarm.new(@resource)
+        alarm.name = "TLSVersionTLSv1.1"
+        alarm.metric_name = "TLSv1.1"
+        @alarms.push(alarm)
+      end
+      
+      if versions.include? "SSLv3"
+        alarm = CfnGuardian::Models::TLSAlarm.new(@resource)
+        alarm.name = "TLSVersionTLSv1.2"
+        alarm.metric_name = "TLSv1.2"
+        @alarms.push(alarm)
+      end
+    
+      if @resource.has_key?('CheckMax')
+        alarm = CfnGuardian::Models::TLSAlarm.new(@resource)
+        alarm.name = "TLSVersionMax"
+        alarm.metric_name = 'MaxVersion'
+        alarm.threshold = 3
+        alarm.evaluation_periods = 2
+        @alarms.push(alarm)
+      end
+    end
+    
+    def default_events
+      @events.push(CfnGuardian::Models::TLSEvent.new(@resource))
+    end
+    
+    def default_checks
+      @checks.push(CfnGuardian::Models::TLSCheck.new(@resource))
+    end
+    
+  end
+end

data/lib/cfnguardian/s3.rb

@@ -4,10 +4,11 @@ module CfnGuardian
   class S3
     include Logging
 
-    attr_reader :bucket
+    attr_reader :bucket, :path
 
-    def initialize(bucket)
+    def initialize(bucket,path='')
       @bucket = set_bucket_name(bucket)
+      @path = path
     end
 
     def set_bucket_name(bucket)

data/lib/cfnguardian/stacks/main.rb

@@ -5,31 +5,87 @@ module CfnGuardian
     class Main
       include CfnDsl::CloudFormation
       
-      def build_template(stacks,checks)
+      attr_reader :parameters, :template
+      
+      def initialize()
+        @parameters = []
         @template = CloudFormation("Guardian main stack")
-        
+      end
+      
+      def build_template(stacks,checks,topics,maintenance_groups,ssm_parameters)     
+        parameters = {}
+           
         %w(Critical Warning Task Informational).each do |name|
           parameter = @template.Parameter(name)
           parameter.Type 'String'
           parameter.Description "SNS topic ARN for #{name} notifications"
+          parameter.Default topics[name] if topics.has_key?(name)
+          parameters[name] = Ref(name)
         end
         
-        parameters = {
-          Critical: Ref(:Critical),
-          Warning: Ref(:Warning),
-          Task: Ref(:Task),
-          Informational: Ref(:Informational)
-        }
+        maintenance_groups.each do |group|
+          topic = @template.SNS_Topic(group)
+          topic.TopicName group
+          topic.Tags([{ Key: 'Environment', Value: 'guardian' }])
+          parameters[group] = Ref(group)
+        end
         
-        build_iam_role()
+        add_iam_role(ssm_parameters)
         
-        checks.each {|check| parameters["#{check[:name]}Function#{check[:environment]}"] = add_lambda(check)}
+        checks.each {|check| parameters["#{check.name}Function#{check.environment}"] = add_lambda(check)}
         stacks.each {|stack| add_stack(stack['Name'],stack['TemplateURL'],parameters)}
         
-        return @template
+        @parameters = parameters.keys
       end
       
-      def build_iam_role()
+      def add_iam_role(ssm_parameters)
+        policies = []
+        policies << {
+          PolicyName: 'logging',
+          PolicyDocument: {
+            Version: '2012-10-17',
+            Statement: [{
+              Effect: 'Allow',
+              Action: [ 'logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents' ],
+              Resource: 'arn:aws:logs:*:*:*'
+            }]
+          }
+        }
+        policies << {
+          PolicyName: 'metrics',
+          PolicyDocument: {
+            Version: '2012-10-17',
+            Statement: [{
+              Effect: 'Allow',
+              Action: [ 'cloudwatch:PutMetricData' ],
+              Resource: '*'
+            }]
+          }
+        }
+        policies << {
+          PolicyName: 'attach-network-interface',
+          PolicyDocument: {
+            Version: '2012-10-17',
+            Statement: [{
+              Effect: 'Allow',
+              Action: [ 'ec2:CreateNetworkInterface', 'ec2:DescribeNetworkInterfaces', 'ec2:DeleteNetworkInterface' ],
+              Resource: '*'
+            }]
+          }
+        }
+        if ssm_parameters.any?
+          policies << {
+            PolicyName: 'ssm-parameters',
+            PolicyDocument: {
+              Version: '2012-10-17',
+              Statement: [{
+                Effect: 'Allow',
+                Action: [ 'ssm:GetParameter', 'ssm:GetParametersByPath', 'ssm:GetParameters' ],
+                Resource: ssm_parameters.map {|param| FnSub("arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter#{param}") }
+              }]
+            }
+          }
+        end
         @template.declare do
           IAM_Role(:LambdaExecutionRole) do
             AssumeRolePolicyDocument({
@@ -40,42 +96,8 @@ module CfnGuardian
                 Action: [ 'sts:AssumeRole' ]
               }]
             })
-            Path '/'
-            Policies([
-              {
-                PolicyName: 'logging',
-                PolicyDocument: {
-                  Version: '2012-10-17',
-                  Statement: [{
-                    Effect: 'Allow',
-                    Action: [ 'logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents' ],
-                    Resource: 'arn:aws:logs:*:*:*'
-                  }]
-                }
-              },
-              {
-                PolicyName: 'metrics',
-                PolicyDocument: {
-                  Version: '2012-10-17',
-                  Statement: [{
-                    Effect: 'Allow',
-                    Action: [ 'cloudwatch:PutMetricData' ],
-                    Resource: '*'
-                  }]
-                }
-              },
-              {
-                PolicyName: 'attach-network-interface',
-                PolicyDocument: {
-                  Version: '2012-10-17',
-                  Statement: [{
-                    Effect: 'Allow',
-                    Action: [ 'ec2:CreateNetworkInterface', 'ec2:DescribeNetworkInterfaces', 'ec2:DeleteNetworkInterface' ],
-                    Resource: '*'
-                  }]
-                }
-              }
-            ])
+            Path '/guardian/'
+            Policies(policies)
             Tags([
               { Key: 'Name', Value: 'guardian-lambda-role' },
               { Key: 'Environment', Value: 'guardian' }
@@ -86,49 +108,48 @@ module CfnGuardian
       
       def add_lambda(check)
         vpc_config = {}
-        
-        if check.has_key?(:vpc)
+        if !check.vpc.nil?
           @template.declare do
-            EC2_SecurityGroup("#{check[:name]}SecurityGroup#{check[:environment]}") do
-              VpcId check[:vpc]
-              GroupDescription "Guardian lambda function #{check[:class]} check"
+            EC2_SecurityGroup("#{check.name}SecurityGroup#{check.environment}") do
+              VpcId check.vpc
+              GroupDescription "Guardian lambda function #{check.group} check"
               Tags([
-                { Key: 'Name', Value: "guardian-#{check[:name]}-#{check[:environment]}" },
+                { Key: 'Name', Value: "guardian-#{check.name}-#{check.environment}" },
                 { Key: 'Environment', Value: 'guardian' }
               ])
             end
           end
           
-          vpc_config[:SecurityGroupIds] = Ref("#{check[:name]}SecurityGroup#{check[:environment]}")
-          vpc_config[:SubnetIds] = check[:subnets]
+          vpc_config[:SecurityGroupIds] = [Ref("#{check.name}SecurityGroup#{check.environment}")]
+          vpc_config[:SubnetIds] = check.subnets
         end
         
         @template.declare do
-          Lambda_Function("#{check[:name]}Function#{check[:environment]}") do
+          Lambda_Function("#{check.name}Function#{check.environment}") do
             Code({ 
-              S3Bucket: FnSub("base2.lambda.${AWS::Region}"), 
-              S3Key: "#{check[:package]}/#{check[:version]}/handler.zip"
+              S3Bucket: FnSub("base2.guardian.lambda.checks.${AWS::Region}"), 
+              S3Key: "#{check.package}/master/#{check.version}.zip"
             })
-            Handler check[:handler]
+            Handler check.handler
             MemorySize 128
-            Runtime check[:runtime]
+            Runtime check.runtime
             Timeout 120
             Role FnGetAtt(:LambdaExecutionRole, :Arn)
             VpcConfig vpc_config unless vpc_config.empty?
             Tags([
-              { Key: 'Name', Value: "guardian-#{check[:name]}-#{check[:class]}" },
+              { Key: 'Name', Value: "guardian-#{check.name}-#{check.group}" },
               { Key: 'Environment', Value: 'guardian' }
             ])
           end
           
-          Lambda_Permission("#{check[:name]}Permissions#{check[:environment]}") do
-            FunctionName Ref("#{check[:name]}Function#{check[:environment]}")
+          Lambda_Permission("#{check.name}Permissions#{check.environment}") do
+            FunctionName Ref("#{check.name}Function#{check.environment}")
             Action 'lambda:InvokeFunction'
             Principal 'events.amazonaws.com'
           end
         end
 
-        return FnGetAtt("#{check[:name]}Function#{check[:environment]}", :Arn)
+        return FnGetAtt("#{check.name}Function#{check.environment}", :Arn)
       end
       
       def add_stack(name,url,stack_parameters)