heimdall_tools 1.3.36 → 1.3.37

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 34a80978c354919fb48f33582e9a6b4e2676eb884c1868e8d710daeb6c8bfb9f
-  data.tar.gz: 58a1f7cde61bf0ad07454fd3cc90448ad40385a9f9d8dd951f24901ccce7a79d
+  metadata.gz: b6e9d50bdf3b2f06cdd02be70517a574ca2a4f979abdb80d705682f02fe7dd45
+  data.tar.gz: a695c5f4f843802da69e4e150befbbbc9914a87d4aa20319a8156fbf376e9805
 SHA512:
-  metadata.gz: 49faba0d70053387a28208efc837a3978bb100e44d65436e0c8f9f6d335d1d8639987b77b44607a2d195cbafaf4646e2e4b80894a8ebb06a7206a929e2a115d3
-  data.tar.gz: 42c71d905a92366eb864113d86de09997cf1043133049d6e16efbc34967a5af2d648d4cb31b6a92fb17874941be8c92f367abcad3d37c26bb8f6b4d46d600f56
+  metadata.gz: 2295f30b0e973d2e59f2860d7ed7fcfa2dd75367a5731f250d1c6b5842326d9df984db383ee8a03b9aedc741a73729c8a0b6d6fb5ef13bc463cfe3b750238801
+  data.tar.gz: 56a80ca04c456e1aff7769ce3f0f554a5a7c533a801cfff800812898d9a888d96264e5da0c08c86576432e7e690fbfe7aad4bc3f21f59c9107bfc1c12bb425ed

data/README.md

@@ -14,6 +14,7 @@ HeimdallTools supplies several methods to convert output from various tools to "
 - **nikto_mapper** - open-source web server scanner 
 - **jfrog_xray_mapper** - package vulnerability scanner
 - **dbprotect_mapper** - database vulnerability scanner
+- **aws_config_mapper** - assess, audit, and evaluate AWS resources
 
 Ruby 2.4 or higher (check using "ruby -v")
 
@@ -213,6 +214,26 @@ FLAGS:
 example: heimdall_tools dbprotect_mapper -x check_results_details_report.xml -o db_protect_hdf.json
 ```
 
+## aws_config_mapper
+
+aws_config_mapper pulls Ruby AWS SDK data to translate AWS Config Rule results into HDF format json to be viewable in Heimdall
+
+### AWS Config Rule Mapping:
+  The mapping of AWS Config Rules to 800-53 Controls was sourced from [this link](https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_4.html).
+  
+### Authentication with AWS:
+  [Developer Guide for configuring Ruby AWS SDK for authentication](https://docs.aws.amazon.com/sdk-for-ruby/v3/developer-guide/setup-config.html)
+  
+```
+USAGE: heimdall_tools aws_config_mapper [OPTIONS] -o <hdf-scan-results.json>
+
+FLAGS:
+    -o --output <scan-results>       : path to output scan-results json.
+    -V --verbose                     : verbose run [optional].
+
+example: heimdall_tools aws_config_mapper -o aws_config_results_hdf.json
+```
+
 ## version  
 
 Prints out the gem version

data/lib/data/aws-config-mapping.csv

@@ -0,0 +1,107 @@
+AwsConfigRuleName,NIST-ID,Rev
+secretsmanager-scheduled-rotation-success-check,AC-2(1)|AC-2(j),4
+iam-user-group-membership-check,AC-2(1)|AC-2(j)|AC-3|AC-6,4
+iam-password-policy,AC-2(1)|AC-2(f)|AC-2(j)|IA-2|IA-5(1)(a)(d)(e)|IA-5(4),4
+access-keys-rotated,AC-2(1)|AC-2(j),4
+iam-user-unused-credentials-check,AC-2(1)|AC-2(3)|AC-2(f)|AC-3|AC-6,4
+securityhub-enabled,AC-2(1)|AC-2(4)|AC-2(12)(a)|AC-2(g)|AC-17(1)|AU-6(1)(3)|CA-7(a)(b)|SA-10|SI-4(2)|SI-4(4)|SI-4(5)|SI-4(16)|SI-4(a)(b)(c),4
+guardduty-enabled-centralized,AC-2(1)|AC-2(4)|AC-2(12)(a)|AC-2(g)|AC-17(1)|AU-6(1)(3)|CA-7(a)(b)|RA-5|SA-10|SI-4(1)|SI-4(2)|SI-4(4)|SI-4(5)|SI-4(16)|SI-4(a)(b)(c),4
+cloud-trail-cloud-watch-logs-enabled,AC-2(4)|AC-2(g)|AU-2(a)(d)|AU-3|AU-6(1)(3)|AU-7(1)|AU-12(a)(c)|CA-7(a)(b)|SI-4(2)|SI-4(4)|SI-4(5)|SI-4(a)(b)(c),4
+cloudtrail-enabled,AC-2(4)|AC-2(g)|AU-2(a)(d)|AU-3|AU-12(a)(c),4
+multi-region-cloudtrail-enabled,AC-2(4)|AU-2(a)(d)|AU-3|AU-12(a)(c),4
+rds-logging-enabled,AC-2(4)|AC-2(g)|AU-2(a)(d)|AU-3|AU-12(a)(c),4
+cloudwatch-alarm-action-check,AC-2(4)|AU-6(1)(3)|AU-7(1)|CA-7(a)(b)|IR-4(1)|SI-4(2)|SI-4(4)|SI-4(5)|SI-4(a)(b)(c),4
+redshift-cluster-configuration-check,AC-2(4)|AC-2(g)|AU-2(a)(d)|AU-3|AU-12(a)(c)|SC-13|SC-28,4
+iam-root-access-key-check,AC-2(f)|AC-2(j)|AC-3|AC-6|AC-6(10),4
+s3-bucket-logging-enabled,AC-2(g)|AU-2(a)(d)|AU-3|AU-12(a)(c),4
+cloudtrail-s3-dataevents-enabled,AC-2(g)|AU-2(a)(d)|AU-3|AU-12(a)(c),4
+root-account-mfa-enabled,AC-2(j)|IA-2(1)(11),4
+emr-kerberos-enabled,AC-2(j)|AC-3|AC-5(c)|AC-6,4
+iam-group-has-users-check,AC-2(j)|AC-3|AC-5(c)|AC-6|SC-2,4
+iam-policy-no-statements-with-admin-access,AC-2(j)|AC-3|AC-5(c)|AC-6|SC-2,4
+iam-user-no-policies-check,AC-2(j)|AC-3|AC-5(c)|AC-6,4
+s3-bucket-public-write-prohibited,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+lambda-function-public-access-prohibited,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+rds-snapshots-public-prohibited,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+redshift-cluster-public-access-check,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+s3-bucket-policy-grantee-check,AC-3|AC-6|SC-7|SC-7(3),4
+s3-bucket-public-read-prohibited,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+s3-account-level-public-access-blocks,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+dms-replication-not-public,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+ebs-snapshot-public-restorable-check,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+sagemaker-notebook-no-direct-internet-access,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+rds-instance-public-access-check,AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+lambda-inside-vpc,AC-4|SC-7|SC-7(3),4
+ec2-instances-in-vpc,AC-4|SC-7|SC-7(3),4
+restricted-common-ports,AC-4|CM-2|SC-7|SC-7(3),4
+restricted-ssh,AC-4|SC-7|SC-7(3),4
+vpc-default-security-group-closed,AC-4|SC-7|SC-7(3),4
+vpc-sg-open-only-to-authorized-ports,AC-4|SC-7|SC-7(3),4
+acm-certificate-expiration-check,AC-4|AC-17(2)|SC-12,4
+ec2-instance-no-public-ip,AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+elasticsearch-in-vpc-only,AC-4|SC-7|SC-7(3),4
+emr-master-no-public-ip,AC-4|AC-21(b)|SC-7|SC-7(3),4
+internet-gateway-authorized-vpc-only,AC-4|AC-17(3)|SC-7|SC-7(3),4
+codebuild-project-envvar-awscred-check,AC-6|IA-5(7)|SA-3(a),4
+ec2-imdsv2-check,AC-6,4
+iam-no-inline-policy-check,AC-6,4
+alb-http-to-https-redirection-check,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-13|SC-23,4
+redshift-require-tls-ssl,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-13,4
+s3-bucket-ssl-requests-only,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-13,4
+elb-acm-certificate-required,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-13,4
+alb-http-drop-invalid-header-enabled,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-23,4
+elb-tls-https-listeners-only,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-23,4
+api-gw-execution-logging-enabled,AU-2(a)(d)|AU-3|AU-12(a)(c),4
+elb-logging-enabled,AU-2(a)(d)|AU-3|AU-12(a)(c),4
+vpc-flow-logs-enabled,AU-2(a)(d)|AU-3|AU-12(a)(c),4
+wafv2-logging-enabled,AU-2(a)(d)|AU-3|AU-12(a)(c)|SC-7|SI-4(a)(b)(c),4
+cloud-trail-encryption-enabled,AU-9|SC-13|SC-28,4
+cloudwatch-log-group-encrypted,AU-9|SC-13|SC-28,4
+s3-bucket-replication-enabled,AU-9(2)|CP-9(b)|CP-10|SC-5|SC-36,4
+cw-loggroup-retention-period-check,AU-11|SI-12,4
+ec2-instance-detailed-monitoring-enabled,CA-7(a)(b)|SI-4(2)|SI-4(a)(b)(c),4
+rds-enhanced-monitoring-enabled,CA-7(a)(b),4
+ec2-instance-managed-by-systems-manager,CM-2|CM-7(a)|CM-8(1)|CM-8(3)(a)|SA-3(a)|SA-10|SI-2(2)|SI-7(1),4
+ec2-managedinstance-association-compliance-status-check,CM-2|CM-7(a)|CM-8(3)(a)|SI-2(2),4
+ec2-stopped-instance,CM-2,4
+ec2-volume-inuse-check,CM-2|SC-4,4
+elb-deletion-protection-enabled,CM-2|CP-10,4
+cloudtrail-security-trail-enabled,CM-2,4
+ec2-managedinstance-patch-compliance-status-check,CM-8(3)(a)|SI-2(2)|SI-7(1),4
+db-instance-backup-enabled,CP-9(b)|CP-10|SI-12,4
+dynamodb-pitr-enabled,CP-9(b)|CP-10|SI-12,4
+elasticache-redis-cluster-automatic-backup-check,CP-9(b)|CP-10|SI-12,4
+dynamodb-in-backup-plan,CP-9(b)|CP-10|SI-12,4
+ebs-in-backup-plan,CP-9(b)|CP-10|SI-12,4
+efs-in-backup-plan,CP-9(b)|CP-10|SI-12,4
+rds-in-backup-plan,CP-9(b)|CP-10|SI-12,4
+dynamodb-autoscaling-enabled,CP-10|SC-5,4
+rds-multi-az-support,CP-10|SC-5|SC-36,4
+s3-bucket-versioning-enabled,CP-10|SI-12,4
+vpc-vpn-2-tunnels-up,CP-10,4
+elb-cross-zone-load-balancing-enabled,CP-10|SC-5,4
+root-account-hardware-mfa-enabled,IA-2(1)(11),4
+mfa-enabled-for-iam-console-access,IA-2(1)(2)(11),4
+iam-user-mfa-enabled,IA-2(1)(2)(11),4
+guardduty-non-archived-findings,IR-4(1)|IR-6(1)|IR-7(1)|RA-5|SA-10|SI-4(a)(b)(c),4
+codebuild-project-source-repo-url-check,SA-3(a),4
+autoscaling-group-elb-healthcheck-required,SC-5,4
+rds-instance-deletion-protection-enabled,SC-5,4
+alb-waf-enabled,SC-7|SI-4(a)(b)(c),4
+elasticsearch-node-to-node-encryption-check,SC-7|SC-8|SC-8(1),4
+cmk-backing-key-rotation-enabled,SC-12,4
+kms-cmk-not-scheduled-for-deletion,SC-12|SC-28,4
+api-gw-cache-enabled-and-encrypted,SC-13|SC-28,4
+efs-encrypted-check,SC-13|SC-28,4
+elasticsearch-encrypted-at-rest,SC-13|SC-28,4
+encrypted-volumes,SC-13|SC-28,4
+rds-storage-encrypted,SC-13|SC-28,4
+s3-bucket-server-side-encryption-enabled,SC-13|SC-28,4
+sagemaker-endpoint-configuration-kms-key-configured,SC-13|SC-28,4
+sagemaker-notebook-instance-kms-key-configured,SC-13|SC-28,4
+sns-encrypted-kms,SC-13|SC-28,4
+dynamodb-table-encrypted-kms,SC-13,4
+s3-bucket-default-lock-enabled,SC-28,4
+ec2-ebs-encryption-by-default,SC-28,4
+rds-snapshot-encrypted,SC-28,4
+cloud-trail-log-file-validation-enabled,SI-7|SI-7(1),4

data/lib/heimdall_tools.rb

@@ -14,4 +14,5 @@ module HeimdallTools
   autoload :NiktoMapper, 'heimdall_tools/nikto_mapper'
   autoload :JfrogXrayMapper, 'heimdall_tools/jfrog_xray_mapper'
   autoload :DBProtectMapper, 'heimdall_tools/dbprotect_mapper'
+  autoload :AwsConfigMapper, 'heimdall_tools/aws_config_mapper'
 end

data/lib/heimdall_tools/aws_config_mapper.rb

@@ -0,0 +1,284 @@
+require 'aws-sdk-configservice'
+require 'heimdall_tools/hdf'
+require 'csv'
+require 'json'
+
+RESOURCE_DIR = Pathname.new(__FILE__).join('../../data')
+
+AWS_CONFIG_MAPPING_FILE = File.join(RESOURCE_DIR, 'aws-config-mapping.csv')
+
+NOT_APPLICABLE_MSG = 'No AWS resources found to evaluate complaince for this rule'.freeze
+INSUFFICIENT_DATA_MSG = 'Not enough data has been collectd to determine compliance yet.'.freeze
+
+##
+# HDF mapper for use with AWS Config rules.
+#
+# Ruby AWS Ruby SDK for ConfigService: 
+# - https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/ConfigService/Client.html
+#
+# rubocop:disable Metrics/AbcSize, Metrics/ClassLength
+module HeimdallTools
+  class AwsConfigMapper
+    def initialize(custom_mapping, verbose = false)
+      @verbose = verbose
+      @default_mapping = get_rule_mapping(AWS_CONFIG_MAPPING_FILE)
+      @custom_mapping = custom_mapping.nil? ? {} : get_rule_mapping(custom_mapping)
+      @client = Aws::ConfigService::Client.new
+      @issues = get_all_config_rules
+    end
+
+    ##
+    # Convert to HDF
+    #
+    # If there is overlap in rule names from @default_mapping and @custom_mapping,
+    # then the tags from both will be added to the rule.
+    def to_hdf
+      controls = @issues.map do |issue|
+        @item = {}
+        @item['id']              = issue[:config_rule_name]
+        @item['title']           = issue[:config_rule_name]
+        @item['desc']            = issue[:description]
+        @item['impact']          = 0.5
+        @item['tags']            = hdf_tags(issue)
+        @item['descriptions']    = hdf_descriptions(issue)
+        @item['refs']            = NA_ARRAY
+        @item['source_location'] = { ref: issue[:config_rule_arn], line: 1 }
+        @item['code']            = ''
+        @item['results']         = issue[:results]
+        # Avoid duplicating rules that exist in the custom mapping as 'unmapped' in this loop
+        if @custom_mapping.include?(issue[:config_rule_name]) && !@default_mapping.include?(issue[:config_rule_name])
+          nil
+        else
+          @item
+        end
+      end
+      results = HeimdallDataFormat.new(
+        profile_name: 'AWS Config',
+         title: 'AWS Config',
+         summary: 'AWS Config',
+         controls: controls,
+         statistics: { aws_config_sdk_version: Aws::ConfigService::GEM_VERSION }
+        )
+      results.to_hdf
+    end
+
+    private
+
+    ##
+    # Read in a config rule -> 800-53 control mapping CSV.
+    #
+    # Params: 
+    # - path: The file path to the CSV file
+    #
+    # Returns: A mapped version of the csv in the format { rule_name: row, ... }
+    def get_rule_mapping(path)
+      Hash[CSV.read(path, headers: true).map { |row| [row[0], row] }]
+    end
+
+    ##
+    # Fetches information on all of the config rules available to the
+    # AWS account.
+    #
+    # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/ConfigService/Client.html#describe_config_rules-instance_method
+    #
+    # Returns: list of hash for all config rules available
+    def get_all_config_rules
+      config_rules = []
+
+      # Fetch all rules with pagination
+      response = @client.describe_config_rules
+      config_rules += response.config_rules
+      while response.next_token
+        response = @client.describe_config_rules(next_token: response.next_token)
+        config_rules += response.config_rules
+      end
+      config_rules = config_rules.map(&:to_h)
+
+      # Add necessary data to rules using helpers
+      add_compliance_to_config_rules(config_rules)
+      add_results_to_config_rules(config_rules)
+    end
+
+    ##
+    # Adds compliance information for config rules to the config rule hash
+    # from AwsConfigMapper::get_all_config_rules.
+    #
+    # `complaince_type` may be any of the following:
+    # ["COMPLIANT", "NON_COMPLIANT", "NOT_APPLICABLE", "INSUFFICIENT_DATA"]
+    #
+    # Params:
+    # - config_rules: The list of hash from AwsConfigMapper::get_all_config_rules
+    #
+    # Returns: The same config_rules array with `compliance` key added to each rule
+    def add_compliance_to_config_rules(config_rules)
+      mapped_compliance_results = fetch_all_compliance_info(config_rules)
+
+      # Add compliance to config_rules
+      config_rules.each do |rule|
+        rule[:compliance] = mapped_compliance_results[rule[:config_rule_name]]&.dig(:compliance, :compliance_type)
+      end
+
+      config_rules
+    end
+
+    ##
+    # Fetch and combine all compliance information for the config rules.
+    #
+    # AWS allows passing up to 25 rules at a time to this endpoint.
+    #
+    # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/ConfigService/Client.html#describe_compliance_by_config_rule-instance_method
+    #
+    # Params:
+    # - config_rules: The list of hash from AwsConfigMapper::get_all_config_rules
+    #
+    # Returns: Results mapped by config rule in the format { name: {<response>}, ... }
+    def fetch_all_compliance_info(config_rules)
+      compliance_results = []
+
+      config_rules.each_slice(25).each do |slice|
+        config_rule_names = slice.map { |r| r[:config_rule_name] }
+        response = @client.describe_compliance_by_config_rule(config_rule_names: config_rule_names)
+        compliance_results += response.compliance_by_config_rules
+      end
+
+      # Map based on name for easy lookup
+      Hash[compliance_results.collect { |r| [r.config_rule_name, r.to_h] }]
+    end
+
+    ##
+    # Takes in config rules and formats the results for hdf format.
+    #
+    # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/ConfigService/Client.html#get_compliance_details_by_config_rule-instance_method
+    #
+    # Example hdf results:
+    # [
+    #   {
+    #     "code_desc": "This rule...",
+    #     "run_time": 0.314016,
+    #     "start_time": "2018-11-18T20:21:40-05:00",
+    #     "status": "passed"
+    #   },
+    #   ...
+    # ]
+    #
+    # Status may be any of the following: ['passed', 'failed', 'skipped', 'loaded']
+    #
+    # Params:
+    # - rule: Rules from AwsConfigMapper::get_all_config_rules
+    #
+    # Returns: The same config_rules array with `results` key added to each rule.
+    def add_results_to_config_rules(config_rules)
+      config_rules.each do |rule|
+        response = @client.get_compliance_details_by_config_rule(config_rule_name: rule[:config_rule_name], limit: 100)
+        rule_results = response.to_h[:evaluation_results]
+        while response.next_token
+          response = @client.get_compliance_details_by_config_rule(next_token: response.next_token, limit: 100)
+          rule_results += response.to_h[:evaluation_results]
+        end
+
+        rule[:results] = []
+        rule_results.each do |result|
+          hdf_result = {}
+          # code_desc
+          hdf_result['code_desc'] = result.dig(:evaluation_result_identifier, :evaluation_result_qualifier)&.map do |k, v|
+                                      "#{k}: #{v}"
+                                    end&.join(', ')
+          # start_time
+          hdf_result['start_time'] = if result.key?(:config_rule_invoked_time)
+                                       DateTime.parse(result[:config_rule_invoked_time].to_s).strftime('%Y-%m-%dT%H:%M:%S%:z')
+                                     end
+          # run_time
+          hdf_result['run_time'] = if result.key?(:result_recorded_time) && result.key?(:config_rule_invoked_time)
+                                     (result[:result_recorded_time] - result[:config_rule_invoked_time]).round(6)
+                                   end
+          # status
+          hdf_result['status'] = case result.dig(:compliance_type)
+                                 when 'COMPLIANT'
+                                   'passed'
+                                 when 'NON_COMPLIANT'
+                                   'failed'
+                                 else
+                                   'skipped'
+                                 end
+          hdf_result['message'] = "(#{hdf_result['code_desc']}): #{result[:annotation] || 'Rule does not pass rule compliance'}" if hdf_result['status'] == 'failed'
+          rule[:results] << hdf_result
+        end
+        next unless rule[:results].empty?
+
+        case rule[:compliance]
+        when 'NOT_APPLICABLE'
+          rule[:impact] = 0
+          rule[:results] << {
+            'run_time': 0,
+            'code_desc': NOT_APPLICABLE_MSG,
+            'skip_message': NOT_APPLICABLE_MSG,
+            'start_time': DateTime.now.strftime('%Y-%m-%dT%H:%M:%S%:z'),
+            'status': 'skipped'
+          }
+        when 'INSUFFICIENT_DATA'
+          rule[:results] << {
+            'run_time': 0,
+            'code_desc': INSUFFICIENT_DATA_MSG,
+            'skip_message': INSUFFICIENT_DATA_MSG,
+            'start_time': DateTime.now.strftime('%Y-%m-%dT%H:%M:%S%:z'),
+            'status': 'skipped'
+          }
+        end
+      end
+
+      config_rules
+    end
+
+    ##
+    # Takes in a config rule and pulls out tags that are useful for HDF.
+    #
+    # Params:
+    # - config_rule: A single config rule from AwsConfigMapper::get_all_config_rules
+    #
+    # Returns: Hash containing all relevant HDF tags
+    def hdf_tags(config_rule)
+      result = {}
+
+      @default_mapping
+      @custom_mapping
+
+      # NIST tag
+      result['nist'] = []
+      default_mapping_match = @default_mapping[config_rule[:config_rule_name]]
+      
+      result['nist'] += default_mapping_match[1].split('|') unless default_mapping_match.nil?
+
+      custom_mapping_match = @custom_mapping[config_rule[:config_rule_name]]
+      
+      result['nist'] += custom_mapping_match[1].split('|').map { |name| "#{name} (user provided)" } unless custom_mapping_match.nil?
+
+      result['nist'] = ['unmapped'] if result['nist'].empty?
+
+      result
+    end
+
+    def check_text(config_rule)
+      params = (JSON.parse(config_rule[:input_parameters]).map { |key, value| "#{key}: #{value}" }).join('<br/>')
+      check_text = config_rule[:config_rule_arn]
+      check_text += "<br/>#{params}" unless params.empty?
+      check_text
+    end
+
+    ##
+    # Takes in a config rule and pulls out information for the descriptions array
+    #
+    # Params:
+    # - config_rule: A single config rule from AwsConfigMapper::get_all_config_rules
+    #
+    # Returns: Array containing all relevant descriptions information
+    def hdf_descriptions(config_rule)
+      [
+        {
+          'label': 'check',
+          'data': check_text(config_rule)
+        }
+      ]
+    end
+  end
+end
+# rubocop:enable Metrics/AbcSize, Metrics/ClassLength

data/lib/heimdall_tools/cli.rb

@@ -98,7 +98,7 @@ module HeimdallTools
       puts "\r\HDF Generated:\n"
       puts "#{options[:output]}"
     end
-
+    
     desc 'dbprotect_mapper', 'dbprotect_mapper translates dbprotect results xml to HDF format Json be viewed on Heimdall'
     long_desc Help.text(:dbprotect_mapper)
     option :xml, required: true, aliases: '-x'
@@ -111,6 +111,18 @@ module HeimdallTools
       puts "#{options[:output]}"
     end
 
+    desc 'aws_config_mapper', 'aws_config_mapper pulls Ruby AWS SDK data to translate AWS Config Rule results into HDF format Json to be viewable in Heimdall'
+    long_desc Help.text(:aws_config_mapper)
+    # option :custom_mapping, required: false, aliases: '-m'
+    option :output, required: true, aliases: '-o'
+    option :verbose, type: :boolean, aliases: '-V'
+    def aws_config_mapper
+      hdf = HeimdallTools::AwsConfigMapper.new(options[:custom_mapping]).to_hdf
+      File.write(options[:output], hdf)
+      puts "\r\HDF Generated:\n"
+      puts "#{options[:output]}"
+    end
+
     desc 'version', 'prints version'
     def version
       puts VERSION

data/lib/heimdall_tools/hdf.rb

@@ -29,7 +29,8 @@ module HeimdallTools
                    groups: NA_ARRAY,
                    status: 'loaded',
                    controls: NA_TAG,
-                   target_id: NA_TAG)
+                   target_id: NA_TAG,
+                   statistics: NA_HASH)
 
       @results_json = {}
       @results_json['platform'] = {}
@@ -40,6 +41,7 @@ module HeimdallTools
 
       @results_json['statistics'] = {}
       @results_json['statistics']['duration'] = duration || NA_TAG
+      @results_json['statistics'].merge! statistics
 
       @results_json['profiles'] = []
 

data/lib/heimdall_tools/help/aws_config_mapper.md

@@ -0,0 +1,30 @@
+  aws_config_mapper pulls Ruby AWS SDK data to translate AWS Config Rule results into HDF format json to be viewable in Heimdall
+
+AWS Config Rule Mapping:
+  The mapping of AWS Config Rules to 800-53 Controls was sourced from [this link](https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_4.html).
+  
+Authentication with AWS:
+  [Developer Guide for configuring Ruby AWS SDK for authentication](https://docs.aws.amazon.com/sdk-for-ruby/v3/developer-guide/setup-config.html)
+
+  Authentication Example:
+  
+  - Create `~/.aws/credentials`
+  - Add contents to file, replacing with your access ID and key 
+
+        ```
+        [default]
+        aws_access_key_id = your_access_key_id
+        aws_secret_access_key = your_secret_access_key
+        ```
+
+  - (optional) set AWS region through `~/.aws/config` file with contents
+
+        ```
+        [default]
+        output = json
+        region = us-gov-west-1
+        ```
+
+Examples:
+
+  heimdall_tools aws_config_mapper -o aws_config_results.json

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: heimdall_tools
 version: !ruby/object:Gem::Version
-  version: 1.3.36
+  version: 1.3.37
 platform: ruby
 authors:
 - Robert Thew
@@ -12,6 +12,20 @@ bindir: exe
 cert_chain: []
 date: 2021-03-01 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-configservice
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -181,11 +195,13 @@ files:
 - Rakefile
 - exe/heimdall_tools
 - lib/data/U_CCI_List.xml
+- lib/data/aws-config-mapping.csv
 - lib/data/cwe-nist-mapping.csv
 - lib/data/nessus-plugins-nist-mapping.csv
 - lib/data/nikto-nist-mapping.csv
 - lib/data/owasp-nist-mapping.csv
 - lib/heimdall_tools.rb
+- lib/heimdall_tools/aws_config_mapper.rb
 - lib/heimdall_tools/burpsuite_mapper.rb
 - lib/heimdall_tools/cli.rb
 - lib/heimdall_tools/command.rb
@@ -193,6 +209,7 @@ files:
 - lib/heimdall_tools/fortify_mapper.rb
 - lib/heimdall_tools/hdf.rb
 - lib/heimdall_tools/help.rb
+- lib/heimdall_tools/help/aws_config_mapper.md
 - lib/heimdall_tools/help/burpsuite_mapper.md
 - lib/heimdall_tools/help/dbprotect_mapper.md
 - lib/heimdall_tools/help/fortify_mapper.md