cfn-guardian 0.11.5 → 0.11.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f723e435275fc1a6e2b27f9af51fe3ca405f19621c761aa26fdcf1db6567258c
-  data.tar.gz: d84f42b73498a82d831b7ccccaaa42d379df99c73d719e75ca3262b544de35c9
+  metadata.gz: '0288f9b06a2fd6e602a31c949af12e5e5cd3fab1c0c954cd3a0317cd27011416'
+  data.tar.gz: 346f47481b46bc57049669188fdb872a15efd442f093ca59a204954d46548daa
 SHA512:
-  metadata.gz: 4b843af3e2e6a131853d472575eb71edd22d529e93e4203cf4c726b231101f4644426acd69e1b21ad4c03ec675620b4836d7f3dc2c1a8ec864c6769ea564bde3
-  data.tar.gz: 765da898a28024041595acdcd7e46de3e34c172861f0b4df7aeb82e434de4c8ec99abf659370e4fc58615ddf32abbb885224c7ee13e48e02dd3c2d29a1fd170f
+  metadata.gz: 66aacccb1582066e32779c8edef2c621eaab5858df2b402b0504ea4635fd2bb8ee30ebdebfe5c41ca62f5bbc5a4152afb816cf4162a890ccd3e33981eb1ff1cf
+  data.tar.gz: e57bb9c8a734f2e0be7d40400e9a4e76d5e89bf6b5f530115f8c44fc05e97698871f9debb55724e9bdcb29cc01eadcf0f302f60ed965572ece09885a1daa11d0

data/README.md

@@ -22,7 +22,7 @@ CfnGuardian is a AWS monitoring tool with a few capabilities:
     - tls version checking
 
 **Supported AWS Resources**
-
+- ACM Certificates
 - AmazonMq(RabbitMQ and ActiveMQ)
 - ApiGateway
 - Application Targetgroups

data/docs/resources.md

@@ -36,6 +36,7 @@ Resources:
 
 | Resource Group              | Require Keys     |
 | --------------------------- | ---------------- |
+| Acm                         | Id               |
 | ApiGateway                  | Id               |
 | AmazonMQBroker              | Id               |
 | AutoScalingGroup            | Id               |

data/lib/cfnguardian/compile.rb

@@ -5,6 +5,7 @@ require 'cfnguardian/stacks/resources'
 require 'cfnguardian/stacks/main'
 require 'cfnguardian/models/composite'
 require 'cfnguardian/resources/base'
+require 'cfnguardian/resources/acm'
 require 'cfnguardian/resources/apigateway'
 require 'cfnguardian/resources/application_targetgroup'
 require 'cfnguardian/resources/amazonmq_broker'
@@ -139,6 +140,9 @@ module CfnGuardian
           @cost += resource_class.get_cost
         end
       end
+
+      # Add default event subscriptions
+      @resources.concat generate_default_event_subscriptions()
       
       @maintenance_groups.each do |maintenance_group,resource_groups|
         resource_groups.each do |group, alarms|
@@ -251,6 +255,19 @@ module CfnGuardian
 
       File.write("out/template-config.guardian.json", template.to_json)
     end
-        
+       
+    def generate_default_event_subscriptions()
+      # List of Classes which default events should be deployed
+      default_resource_classes = ['CfnGuardian::Resource::Acm']
+      default_event_subscriptions = []
+
+      default_resource_classes.each do |resource_class|
+        resource_instance = Kernel.const_get(resource_class).new({"Id"=>resource_class}) # Dummy ID 
+        default_event_subscriptions.concat(resource_instance.default_event_subscriptions())
+      end
+
+      return default_event_subscriptions
+    end
+
   end
 end

data/lib/cfnguardian/models/alarm.rb

@@ -66,6 +66,15 @@ module CfnGuardian
       end      
     end
     
+    class AcmAlarm < BaseAlarm
+      def initialize(resource)
+        super(resource)
+        @group = 'Acm'
+        @namespace = 'AWS/CertificateManager'
+        @dimensions = { CertificateArn: { "Fn::Sub" => "arn:aws:acm:${AWS::Region}:${AWS::AccountId}:certificate/#{resource['Id']}"}}
+      end
+    end
+
     class ApiGatewayAlarm < BaseAlarm
       def initialize(resource)
         super(resource)

data/lib/cfnguardian/models/check.rb

@@ -42,8 +42,8 @@ module CfnGuardian
         @name = 'HttpCheck'
         @package = 'http-check'
         @handler = 'handler.http_check'
-        @version = '0e945240f9d93242f807e86d1a9b3383a1764b96'
-        @runtime = 'python3.7'
+        @version = '077c726ed691a1176caf95497b8b02f05f00e0cb'
+        @runtime = 'python3.11'
       end
     end
     class WebSocketCheck < BaseCheck      
@@ -53,8 +53,8 @@ module CfnGuardian
         @name = 'WebSocketCheck'
         @package = 'websocket-check'
         @handler = 'handler.websocket_check'
-        @version = 'fb374fcf606b921d3745d7171d81ab5a32135d2f'
-        @runtime = 'python3.7'
+        @version = 'bb0125e878e127028dfb3d4a0de93e580e77305e'
+        @runtime = 'python3.11'
         @branch = 'main'
       end
     end
@@ -77,8 +77,8 @@ module CfnGuardian
         @name = 'PortCheck'
         @package = 'port-check'
         @handler = 'handler.port_check'
-        @version = '356203b2a720ba0730622f978e677b88f8d0c328'
-        @runtime = 'python3.7'
+        @version = 'd773db7333fddea1f4e1781f9906bb05c363dd42'
+        @runtime = 'python3.11'
       end
     end
     
@@ -165,8 +165,8 @@ module CfnGuardian
         @name = 'ContainerInstanceCheck'
         @package = 'ecs-container-instance-check'
         @handler = 'handler.run_check'
-        @version = '387446fbe2eb18fb4f75462c27cc07caad4a26b8'
-        @runtime = 'python3.7'
+        @version = '5cb604acccd0823c74b21e83d7e40612ef38e313'
+        @runtime = 'python3.11'
       end
     end
     
@@ -177,8 +177,8 @@ module CfnGuardian
         @name = 'TLSCheck'
         @package = 'tls-version-check'
         @handler = 'handler.run_check'
-        @version = 'de83afdde0d976364af37ad7552a8496c3c94ab5'
-        @runtime = 'python3.7'
+        @version = '2b4fcbf55e266e793ee06e72013ed098f4eb2c0a'
+        @runtime = 'python3.11'
       end
     end
     
@@ -189,8 +189,8 @@ module CfnGuardian
         @name = 'SFTPCheck'
         @package = 'sftp-check'
         @handler = 'handler.sftp_check'
-        @version = '901a63a0b9bbb4f09d1efae7049b20de4a1a22e2'
-        @runtime = 'python3.7'
+        @version = '03e934328939cd87e5fb41fb01d6a690a94dc94c'
+        @runtime = 'python3.11'
       end
     end
     
@@ -212,8 +212,8 @@ module CfnGuardian
         @name = 'AzureFileCheck'
         @package = 'azure-file-check'
         @handler = 'handler.file_check'
-        @version = 'cc37aa8fe4855570132431611b507274b390f4c1'
-        @runtime = 'python3.7'
+        @version = '6a5abdbed4408592a3045638a1a5a74c89a37e12'
+        @runtime = 'python3.11'
         @memory = 256
         @timeout = 600
       end
@@ -225,8 +225,8 @@ module CfnGuardian
         @name = 'MaintenanceGroupCheck'
         @package = 'maintenance-group-check'
         @handler = 'handler.maintenance_group_check'
-        @version = '5b795e6509068d1767e4be80f2e6868cbeb3b425'
-        @runtime = 'python3.7'
+        @version = '5e880ffc7d0c478383fa353e28fe3e9f8310a93c'
+        @runtime = 'python3.11'
       end 
     end
 

data/lib/cfnguardian/models/event_subscription.rb

@@ -95,6 +95,7 @@ module CfnGuardian
       end
     end
 
+    class AcmEventSubscription < BaseEventSubscription; end
     class ApiGatewayEventSubscription < BaseEventSubscription; end
     class ApplicationTargetGroupEventSubscription < BaseEventSubscription; end
     class AmazonMQBrokerEventSubscription < BaseEventSubscription; end

data/lib/cfnguardian/resources/acm.rb

@@ -0,0 +1,39 @@
+module CfnGuardian::Resource
+    class Acm < Base
+
+    def default_alarms    
+        alarm = CfnGuardian::Models::AcmAlarm.new(@resource)
+        alarm.name = 'CertificateExpiry'
+        alarm.metric_name = 'DaysToExpiry'
+        alarm.statistic = 'Average'
+        alarm.threshold = 30
+        alarm.comparison_operator = 'LessThanThreshold'
+        alarm.evaluation_periods = 1
+        alarm.period = 86400
+        @alarms.push(alarm)
+        end
+
+      def default_event_subscriptions()
+        event_subscription = CfnGuardian::Models::AcmEventSubscription.new(@resource)
+        event_subscription.name = 'AcmCertificateNearExpiry'
+        event_subscription.detail_type = 'ACM Certificate Approaching Expiration'
+        event_subscription.source = 'aws.acm'
+        event_subscription.detail = {
+        'DaysToExpiry' => [31]
+        }
+        @event_subscriptions.push(event_subscription)
+
+        event_subscription = CfnGuardian::Models::AcmEventSubscription.new(@resource)
+        event_subscription.name = 'AcmCertificateExpired'
+        event_subscription.detail_type = 'ACM Certificate Expired'
+        event_subscription.source = 'aws.acm'
+        @event_subscriptions.push(event_subscription)
+
+        event_subscription = CfnGuardian::Models::AcmEventSubscription.new(@resource)
+        event_subscription.name = 'AcmRenewalActionRequired'
+        event_subscription.detail_type = 'ACM Certificate Renewal Action Required'
+        event_subscription.source = 'aws.acm'
+        @event_subscriptions.push(event_subscription)
+      end
+    end
+  end

data/lib/cfnguardian/version.rb

@@ -1,4 +1,4 @@
 module CfnGuardian
-  VERSION = "0.11.5"
+  VERSION = "0.11.7"
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-guardian
 version: !ruby/object:Gem::Version
-  version: 0.11.5
+  version: 0.11.7
 platform: ruby
 authors:
 - Guslington
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-09-14 00:00:00.000000000 Z
+date: 2023-11-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -328,6 +328,7 @@ files:
 - lib/cfnguardian/models/event.rb
 - lib/cfnguardian/models/event_subscription.rb
 - lib/cfnguardian/models/metric_filter.rb
+- lib/cfnguardian/resources/acm.rb
 - lib/cfnguardian/resources/amazonmq_broker.rb
 - lib/cfnguardian/resources/amazonmq_rabbitmq.rb
 - lib/cfnguardian/resources/apigateway.rb