cfn-guardian 0.11.5 → 0.11.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f723e435275fc1a6e2b27f9af51fe3ca405f19621c761aa26fdcf1db6567258c
-  data.tar.gz: d84f42b73498a82d831b7ccccaaa42d379df99c73d719e75ca3262b544de35c9
+  metadata.gz: 9d2c40c9c770002c29f5944836df58ce457d497b8f650c4502f18fcf4e79cd71
+  data.tar.gz: c8d2396742afaeecc84ffcb30aab78a6be53af64292cd362581a75275f4332cb
 SHA512:
-  metadata.gz: 4b843af3e2e6a131853d472575eb71edd22d529e93e4203cf4c726b231101f4644426acd69e1b21ad4c03ec675620b4836d7f3dc2c1a8ec864c6769ea564bde3
-  data.tar.gz: 765da898a28024041595acdcd7e46de3e34c172861f0b4df7aeb82e434de4c8ec99abf659370e4fc58615ddf32abbb885224c7ee13e48e02dd3c2d29a1fd170f
+  metadata.gz: b8e74696940031d2e2010eb005172bd98eb6478b9c0feccdb7a5c413c70d6a9db36b7ab6d51022d7f2ea761a7fd170f166b3892b06e7627da2a9b7b04d2a6222
+  data.tar.gz: 39c24609796c7019a2cbe12ff6cef57e53a8532c89bd143eeb356813798c3fd354a24c9d61d94ff1fb981da030bdf0e42183fa2504cd7fad1a6b2155053c811c

data/README.md

@@ -22,7 +22,7 @@ CfnGuardian is a AWS monitoring tool with a few capabilities:
     - tls version checking
 
 **Supported AWS Resources**
-
+- ACM Certificates
 - AmazonMq(RabbitMQ and ActiveMQ)
 - ApiGateway
 - Application Targetgroups

data/docs/resources.md

@@ -36,6 +36,7 @@ Resources:
 
 | Resource Group              | Require Keys     |
 | --------------------------- | ---------------- |
+| Acm                         | Id               |
 | ApiGateway                  | Id               |
 | AmazonMQBroker              | Id               |
 | AutoScalingGroup            | Id               |

data/lib/cfnguardian/compile.rb

@@ -5,6 +5,7 @@ require 'cfnguardian/stacks/resources'
 require 'cfnguardian/stacks/main'
 require 'cfnguardian/models/composite'
 require 'cfnguardian/resources/base'
+require 'cfnguardian/resources/acm'
 require 'cfnguardian/resources/apigateway'
 require 'cfnguardian/resources/application_targetgroup'
 require 'cfnguardian/resources/amazonmq_broker'
@@ -139,6 +140,9 @@ module CfnGuardian
           @cost += resource_class.get_cost
         end
       end
+
+      # Add default event subscriptions
+      @resources.concat generate_default_event_subscriptions()
       
       @maintenance_groups.each do |maintenance_group,resource_groups|
         resource_groups.each do |group, alarms|
@@ -251,6 +255,19 @@ module CfnGuardian
 
       File.write("out/template-config.guardian.json", template.to_json)
     end
-        
+       
+    def generate_default_event_subscriptions()
+      # List of Classes which default events should be deployed
+      default_resource_classes = ['CfnGuardian::Resource::Acm']
+      default_event_subscriptions = []
+
+      default_resource_classes.each do |resource_class|
+        resource_instance = Kernel.const_get(resource_class).new({"Id"=>resource_class}) # Dummy ID 
+        default_event_subscriptions.concat(resource_instance.default_event_subscriptions())
+      end
+
+      return default_event_subscriptions
+    end
+
   end
 end

data/lib/cfnguardian/models/alarm.rb

@@ -66,6 +66,15 @@ module CfnGuardian
       end      
     end
     
+    class AcmAlarm < BaseAlarm
+      def initialize(resource)
+        super(resource)
+        @group = 'Acm'
+        @namespace = 'AWS/CertificateManager'
+        @dimensions = { CertificateArn: { "Fn::Sub" => "arn:aws:acm:${AWS::Region}:${AWS::AccountId}:certificate/#{resource['Id']}"}}
+      end
+    end
+
     class ApiGatewayAlarm < BaseAlarm
       def initialize(resource)
         super(resource)

data/lib/cfnguardian/models/event_subscription.rb

@@ -95,6 +95,7 @@ module CfnGuardian
       end
     end
 
+    class AcmEventSubscription < BaseEventSubscription; end
     class ApiGatewayEventSubscription < BaseEventSubscription; end
     class ApplicationTargetGroupEventSubscription < BaseEventSubscription; end
     class AmazonMQBrokerEventSubscription < BaseEventSubscription; end

data/lib/cfnguardian/resources/acm.rb

@@ -0,0 +1,39 @@
+module CfnGuardian::Resource
+    class Acm < Base
+
+    def default_alarms    
+        alarm = CfnGuardian::Models::AcmAlarm.new(@resource)
+        alarm.name = 'CertificateExpiry'
+        alarm.metric_name = 'DaysToExpiry'
+        alarm.statistic = 'Average'
+        alarm.threshold = 30
+        alarm.comparison_operator = 'LessThanThreshold'
+        alarm.evaluation_periods = 1
+        alarm.period = 86400
+        @alarms.push(alarm)
+        end
+
+      def default_event_subscriptions()
+        event_subscription = CfnGuardian::Models::AcmEventSubscription.new(@resource)
+        event_subscription.name = 'AcmCertificateNearExpiry'
+        event_subscription.detail_type = 'ACM Certificate Approaching Expiration'
+        event_subscription.source = 'aws.acm'
+        event_subscription.detail = {
+        'DaysToExpiry' => [31]
+        }
+        @event_subscriptions.push(event_subscription)
+
+        event_subscription = CfnGuardian::Models::AcmEventSubscription.new(@resource)
+        event_subscription.name = 'AcmCertificateExpired'
+        event_subscription.detail_type = 'ACM Certificate Expired'
+        event_subscription.source = 'aws.acm'
+        @event_subscriptions.push(event_subscription)
+
+        event_subscription = CfnGuardian::Models::AcmEventSubscription.new(@resource)
+        event_subscription.name = 'AcmRenewalActionRequired'
+        event_subscription.detail_type = 'ACM Certificate Renewal Action Required'
+        event_subscription.source = 'aws.acm'
+        @event_subscriptions.push(event_subscription)
+      end
+    end
+  end

data/lib/cfnguardian/version.rb

@@ -1,4 +1,4 @@
 module CfnGuardian
-  VERSION = "0.11.5"
+  VERSION = "0.11.6"
   CHANGE_SET_VERSION = VERSION.gsub('.', '-').freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cfn-guardian
 version: !ruby/object:Gem::Version
-  version: 0.11.5
+  version: 0.11.6
 platform: ruby
 authors:
 - Guslington
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-09-14 00:00:00.000000000 Z
+date: 2023-10-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -328,6 +328,7 @@ files:
 - lib/cfnguardian/models/event.rb
 - lib/cfnguardian/models/event_subscription.rb
 - lib/cfnguardian/models/metric_filter.rb
+- lib/cfnguardian/resources/acm.rb
 - lib/cfnguardian/resources/amazonmq_broker.rb
 - lib/cfnguardian/resources/amazonmq_rabbitmq.rb
 - lib/cfnguardian/resources/apigateway.rb