terrafying-components 1.11.17 → 1.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a597ed1a9773ee6eef4e65893a4edf3a69091c289132b56fb700841e34fe1a59
-  data.tar.gz: 45294b5718c25d69537e3ce17e23b5b04d11b7596cdaba7bf2f680d7e2a3a39f
+  metadata.gz: 0e8b1f7525856d30f5b3c2b5c776299d2431c3ac30302e9a38b7bde28524f3c7
+  data.tar.gz: c2b07db3700099242c7fc134742b15ccfee8aa9bf42a4bc8cacf2eb53831c7a4
 SHA512:
-  metadata.gz: 783f6277ce5541c5dc86a8245a3b0eeed51dba6d7ff6c40529f094c5f63ffb5d4dfd576d837b23fbbe6df422167535d3a2c24bfc75145ccd1b5351b77249f35e
-  data.tar.gz: '0558b9b6b004597060200dbc490ec36b6aa072e94b9d0deb69f5e0a8e6de460bd61c9a13a1a2b6821c48168785742d2f567fb4cb1759a0543cf8813e4b8f6e92'
+  metadata.gz: 3fb6c161d5f16620b0f11e1314fb9bed55eafe18c73186d2b0cc38936f78897950bb32f701b78317aa34be29c34416f5a5bcafd718b3c57895feda0d1e6d176b
+  data.tar.gz: 63f1f9a590d7603dec804f1d684532ed82b21b24869eb0b3aff6f461a09cea35a00773afa27123ab2e744e7ee573d947374c04c5d06bb5c463db8b4103c85594

data/lib/terrafying/components/security.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require 'terrafying/components/security/config'
+require 'terrafying/components/security/config_aggregator'
+require 'terrafying/components/security/pagerduty_topic'
+require 'terrafying/components/security/store'
+require 'terrafying/components/security/trail'

data/lib/terrafying/components/security/config.rb

@@ -0,0 +1,238 @@
+# frozen_string_literal: true
+
+require 'terrafying'
+
+module Terrafying
+
+  module Components
+
+    module Security
+
+      class Config < Terrafying::Context
+
+        def self.create(*args)
+          Config.new.create(*args)
+        end
+
+        def self.bucket_statements(bucket_name)
+          [
+            {
+              Sid: "AWSConfigAclCheck",
+              Effect: "Allow",
+              Principal: {
+                Service: "config.amazonaws.com"
+              },
+              Action: "s3:GetBucketAcl",
+              Resource: "arn:aws:s3:::#{bucket_name}"
+            },
+            {
+              Sid: "AWSConfigWrite",
+              Effect: "Allow",
+              Principal: {
+                Service: "config.amazonaws.com"
+              },
+              Action: "s3:PutObject",
+              Resource: "arn:aws:s3:::#{bucket_name}/*",
+              Condition: {
+                StringEquals: {
+                  "s3:x-amz-acl" => "bucket-owner-full-control"
+                }
+              }
+            }
+          ]
+        end
+
+
+        def create(
+              name,
+              provider:,
+              store:,
+              include_global:
+            )
+
+          ident = tf_safe(name)
+
+          @name = name
+          @ident = ident
+          @provider = provider
+          @include_global = include_global
+
+          role = resource :aws_iam_role, ident, {
+                            provider: @provider,
+                            name: name,
+                            assume_role_policy: {
+                              Version: "2012-10-17",
+                              Statement: [
+                                {
+                                  Action: "sts:AssumeRole",
+                                  Principal: {
+                                    Service: "config.amazonaws.com"
+                                  },
+                                  Effect: "Allow",
+                                  Sid: ""
+                                }
+                              ]
+                            }.to_json,
+                          }
+
+          policy = resource :aws_iam_policy, ident, {
+                              provider: @provider,
+                              policy: {
+                                Version: "2012-10-17",
+                                Statement: store.write_statements,
+                              }.to_json,
+                            }
+
+          resource :aws_iam_role_policy_attachment, ident, {
+                     provider: @provider,
+                     role: role["name"],
+                     policy_arn: policy["arn"],
+                   }
+
+          resource :aws_iam_role_policy_attachment, "#{ident}-config-policy", {
+                     provider: @provider,
+                     role: role["name"],
+                     policy_arn: "arn:aws:iam::aws:policy/service-role/AWSConfigRole",
+                   }
+
+          recorder = resource :aws_config_configuration_recorder, ident, {
+                                provider: @provider,
+                                name: name,
+                                role_arn: role["arn"],
+                                recording_group: {
+                                  include_global_resource_types: include_global,
+                                },
+                              }
+
+          resource :aws_config_delivery_channel, ident, {
+                     provider: @provider,
+                     s3_bucket_name: store.name,
+                     s3_key_prefix: "config",
+                     depends_on: [ "aws_config_configuration_recorder.#{ident}" ],
+                   }
+
+          resource :aws_config_configuration_recorder_status, ident, {
+                     provider: @provider,
+                     name: recorder["name"],
+                     is_enabled: true,
+                     depends_on: [ "aws_config_delivery_channel.#{ident}" ],
+                   }
+
+          self
+        end
+
+        def rule!(name:, source:, input: nil)
+          ident = tf_safe("#{@name}-#{name}")
+
+          if source.is_a? Symbol
+            source_config = {
+              owner: "AWS",
+              source_identifier: source.to_s,
+            }
+          else
+            raise "Can't support a non-AWS source at the moment"
+          end
+
+          resource :aws_config_config_rule, ident, {
+                     provider: @provider,
+                     name: name,
+                     source: source_config,
+                     input_parameters: input,
+                   }
+        end
+
+        def cis_benchmark!
+
+          if @include_global #IAM is a global resource, so the rules are only applicable where they are collected
+
+            # 1.2	Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password
+            rule!(
+              name: "AllUsersMFA",
+              source: :IAM_USER_MFA_ENABLED,
+            )
+            rule!(
+              name: "AllConsoleUsersMFA",
+              source: :MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS,
+            )
+
+            # 1.3	Ensure credentials unused for 90 days or greater are disabled
+            rule!(
+              name: "CredentialsOlder90Disabled",
+              source: :IAM_USER_UNUSED_CREDENTIALS_CHECK,
+              input: {
+                "maxCredentialUsageAge" => "90",
+              }.to_json,
+            )
+
+            # 1.4	Ensure access keys are rotated every 90 days or less
+            rule!(
+              name: "AccessKeysRotated",
+              source: :ACCESS_KEYS_ROTATED,
+              input: {
+                "maxAccessKeyAge" => "90",
+              }.to_json,
+            )
+
+            # 1.12	Ensure no root account access key exists
+            rule!(
+              name: "NoRootAccessKey",
+              source: :IAM_ROOT_ACCESS_KEY_CHECK,
+            )
+
+            # 1.13	Ensure MFA is enabled for the "root" account
+            rule!(
+              name: "RootMFA",
+              source: :ROOT_ACCOUNT_MFA_ENABLED,
+            )
+
+            # 1.14	Ensure hardware MFA is enabled for the "root" account
+            rule!(
+              name: "RootHardwareMFA",
+              source: :ROOT_ACCOUNT_MFA_ENABLED,
+            )
+
+            # 1.16	Ensure IAM policies are attached only to groups or roles
+            #rule!(
+            #       name: "
+            #     )
+
+
+            # 1.22	Ensure IAM policies that allow full "*:*" administrative privileges are not created
+            rule!(
+              name: "NoIAMAdminAccess",
+              source: :IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS,
+            )
+
+          end
+
+          # 2.8	Ensure rotation for customer created CMKs is enabled
+          #rule!(
+          #       name: "EnsureCMKRotationEnabled",
+          #       source: lamba,
+          #     )
+
+          # 2.9	Ensure VPC flow logging is enabled in all VPCs
+          #rule!(
+          #       name: "EnsureFlowLoggingEnabled",
+          #       source: lamba,
+          #     )
+
+
+          # 4.1	Ensure no security groups allow ingress from 0.0.0.0/0 to port 22
+          # 4.2	Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389
+          rule!(
+            name: "NoNaughtyIncomingTraffic",
+            source: :RESTRICTED_INCOMING_TRAFFIC,
+            input: {
+              "blockedPort1" => "22",
+              "blockedPort2" => "3389",
+            }.to_json
+          )
+
+        end
+
+      end
+
+    end
+  end
+end

data/lib/terrafying/components/security/config_aggregator.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require 'terrafying'
+
+module Terrafying
+
+  module Components
+
+    module Security
+
+      class ConfigAggregator < Terrafying::Context
+
+        def self.create(*args)
+          ConfigAggregator.new.create(*args)
+        end
+
+        def create(
+              name,
+              whole_organisation: false
+            )
+
+          ident = tf_safe(name)
+
+          role = resource :aws_iam_role, ident, {
+                            name: name,
+                            assume_role_policy: {
+                              Version: "2012-10-17",
+                              Statement: [
+                                {
+                                  Action: "sts:AssumeRole",
+                                  Principal: {
+                                    Service: "config.amazonaws.com"
+                                  },
+                                  Effect: "Allow",
+                                  Sid: ""
+                                }
+                              ]
+                            }.to_json,
+                          }
+
+          resource :aws_iam_role_policy_attachment, "#{ident}-config-org-policy", {
+                     provider: @provider,
+                     role: role["name"],
+                     policy_arn: "arn:aws:iam::aws:policy/service-role/AWSConfigRoleForOrganizations",
+                   }
+
+          source = {}
+
+          if whole_organisation
+            source[:organization_aggregation_source] = {
+              all_regions: true,
+              role_arn: role["arn"],
+            }
+          else
+            source[:account_aggregation_source] = {
+              account_ids: [ aws.account_id ],
+              all_regions: true,
+            }
+          end
+
+          resource :aws_config_configuration_aggregator, ident, {
+                     depends_on: [ "aws_iam_role_policy_attachment.#{ident}-config-org-policy" ],
+
+                     name: name,
+                     organization_aggregation_source: {
+                       all_regions: true,
+                       role_arn: role["arn"],
+                     }
+                   }
+
+          self
+        end
+
+      end
+    end
+  end
+end

data/lib/terrafying/components/security/pagerduty_topic.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require 'terrafying'
+
+module Terrafying
+
+  module Components
+
+    module Security
+
+      class PagerdutyTopic < Terrafying::Context
+
+        attr_reader :arn
+
+        def self.create(*args)
+          PagerdutyTopic.new.create(*args)
+        end
+
+        def create(
+              name,
+              escalation_policy_id:
+            )
+
+          ident = tf_safe(name)
+
+          service = resource :pagerduty_service, ident, {
+                               name: name,
+                               auto_resolve_timeout: 14400,
+                               acknowledgement_timeout: 600,
+                               escalation_policy: escalation_policy_id,
+                             }
+
+          vendor = data :pagerduty_vendor, ident, {
+                          name: "Amazon CloudWatch",
+                        }
+
+          integration = resource :pagerduty_service_integration, ident, {
+                                   name: "SNS",
+                                   vendor: vendor["id"],
+                                   service: service["id"],
+                                 }
+
+          topic = resource :aws_sns_topic, ident, {}
+
+          @arn = topic["arn"]
+
+          resource :aws_sns_topic_subscription, ident, {
+                     topic_arn: @arn,
+                     protocol: "https",
+                     endpoint: "https://events.pagerduty.com/integration/#{integration["integration_key"]}/enqueue",
+                     endpoint_auto_confirms: true,
+                   }
+
+          self
+        end
+
+      end
+
+    end
+  end
+end

data/lib/terrafying/components/security/store.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require 'terrafying'
+
+module Terrafying
+
+  module Components
+
+    module Security
+
+      class Store < Terrafying::Context
+
+        attr_reader :name, :key_arn
+
+        def self.create(*args)
+          Store.new.create(*args)
+        end
+
+        def create(
+              name,
+              bucket_policy: nil,
+              key_policy: nil
+            )
+
+          ident = tf_safe(name)
+
+          @name = name
+          @key = resource :aws_kms_key, ident, { policy: key_policy }
+          @key_arn = @key["arn"]
+
+          resource :aws_kms_alias, ident, {
+                     name: "alias/#{name}",
+                     target_key_id: @key["id"],
+                   }
+
+          @bucket = resource :aws_s3_bucket, ident, {
+                               bucket: name,
+                               acl: "private",
+                               force_destroy: false,
+                               versioning: {
+                                 enabled: true,
+                               },
+                               policy: bucket_policy,
+                               server_side_encryption_configuration: {
+                                 rule: {
+                                   apply_server_side_encryption_by_default: {
+                                     kms_master_key_id: @key["arn"],
+                                     sse_algorithm: "aws:kms",
+                                   }
+                                 }
+                               },
+                               tags: {
+                                 Name: name,
+                               }
+                             }
+
+          self
+        end
+
+        def read_statements(prefix: "*")
+          bucket_glob = [@bucket["arn"], prefix].join("/")
+
+          [
+            {
+              Effect: "Allow",
+              Action: [
+                "s3:ListBucket",
+                "s3:GetBucketAcl",
+              ],
+              Resource: @bucket["arn"],
+            },
+            {
+              Effect: "Allow",
+              Action: [
+                "s3:GetObject*",
+              ],
+              Resource: bucket_glob,
+            },
+            {
+              Effect: "Allow",
+              Action: [
+                "kms:Decrypt",
+              ],
+              Resource: @key["arn"],
+            }
+          ]
+        end
+
+        def write_statements(prefix: "*")
+          bucket_glob = [@bucket["arn"], prefix].join("/")
+
+          [
+            {
+              Effect: "Allow",
+              Action: [
+                "s3:ListBucket",
+                "s3:GetBucketAcl",
+              ],
+              Resource: @bucket["arn"],
+            },
+            {
+              Effect: "Allow",
+              Action: [
+                "s3:GetObject*",
+                "s3:PutObject*",
+              ],
+              Resource: bucket_glob,
+            },
+            {
+              Effect: "Allow",
+              Action: [
+                "kms:Encrypt",
+                "kms:Decrypt",
+                "kms:GenerateDataKey"
+              ],
+              Resource: @key["arn"],
+            }
+          ]
+        end
+
+      end
+
+    end
+  end
+end

data/lib/terrafying/components/security/trail.rb

@@ -0,0 +1,304 @@
+# frozen_string_literal: true
+
+require 'terrafying'
+
+module Terrafying
+
+  module Components
+
+    module Security
+
+      class Trail < Terrafying::Context
+
+        def self.create(*args)
+          Trail.new.create(*args)
+        end
+
+        def self.bucket_statements(bucket_name)
+          [
+            {
+              Sid: "AWSCloudTrailAclCheck",
+              Effect: "Allow",
+              Principal: {
+                Service: "cloudtrail.amazonaws.com"
+              },
+              Action: "s3:GetBucketAcl",
+              Resource: "arn:aws:s3:::#{bucket_name}"
+            },
+            {
+              Sid: "AWSCloudTrailWrite",
+              Effect: "Allow",
+              Principal: {
+                Service: "cloudtrail.amazonaws.com"
+              },
+              Action: "s3:PutObject",
+              Resource: "arn:aws:s3:::#{bucket_name}/*",
+              Condition: {
+                StringEquals: {
+                  "s3:x-amz-acl" => "bucket-owner-full-control"
+                }
+              }
+            }
+          ]
+        end
+
+        def self.key_statements
+          [
+            {
+              Sid: "Allow CloudTrail to encrypt logs",
+              Effect: "Allow",
+              Principal: {"Service": ["cloudtrail.amazonaws.com"]},
+              Action: "kms:GenerateDataKey*",
+              Resource: "*",
+              Condition: {"StringLike": {"kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:#{aws.account_id}:trail/*"}}
+            },
+            {
+              Sid: "Allow CloudTrail to describe key",
+              Effect: "Allow",
+              Principal: {"Service": ["cloudtrail.amazonaws.com"]},
+              Action: "kms:DescribeKey",
+              Resource: "*"
+            },
+            {
+              Sid: "Allow principals in the account to decrypt log files",
+              Effect: "Allow",
+              Principal: {"AWS": "*"},
+              Action: [
+                "kms:Decrypt",
+                "kms:ReEncryptFrom"
+              ],
+              Resource: "*",
+              Condition: {
+                StringEquals: {"kms:CallerAccount": aws.account_id},
+                StringLike: {"kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:#{aws.account_id}:trail/*"}
+              }
+            },
+          ]
+        end
+
+        def create(
+              name,
+              store:,
+              topic:,
+              include_all_regions: true,
+              include_all_organisation: true
+            )
+
+          @name = name
+          @topic = topic
+
+          @log_group = resource :aws_cloudwatch_log_group, "cloudtrail-#{name}", {
+                                  name: "cloudtrail-#{name}",
+                                }
+
+          log_role = resource :aws_iam_role, "cloudtrail-#{name}-logs", {
+                                name: "cloudtrail-#{name}-logs",
+                                assume_role_policy: {
+                                  Version: "2012-10-17",
+                                  Statement: [
+                                    {
+                                      Sid: "",
+                                      Effect: "Allow",
+                                      Principal: {
+                                        Service: "cloudtrail.amazonaws.com"
+                                      },
+                                      Action: "sts:AssumeRole",
+                                    },
+                                  ],
+                                }.to_json,
+                              }
+
+          log_role_policy = resource :aws_iam_policy, "cloudtrail-#{name}-logs", {
+                                       name: "cloudtrail-#{name}-logs",
+                                       policy: {
+                                         Version: "2012-10-17",
+                                         Statement: [
+                                           {
+                                             Sid: "AWSCloudTrailCreateLogStream2014110",
+                                             Effect: "Allow",
+                                             Action: [
+                                               "logs:CreateLogStream"
+                                             ],
+                                             Resource: [
+                                               @log_group["arn"],
+                                             ]
+                                           },
+                                           {
+                                             Sid: "AWSCloudTrailPutLogEvents20141101",
+                                             Effect: "Allow",
+                                             Action: [
+                                               "logs:PutLogEvents"
+                                             ],
+                                             Resource: [
+                                               @log_group["arn"],
+                                             ]
+                                           }
+                                         ]
+                                       }.to_json
+                                     }
+
+          resource :aws_iam_role_policy_attachment, "cloudtrail-#{name}-logs", {
+                     role: log_role["name"],
+                     policy_arn: log_role_policy["arn"],
+                   }
+
+          resource :aws_cloudtrail, "#{name}", {
+                     name: "#{name}",
+                     s3_bucket_name: store.name,
+                     s3_key_prefix: "cloudtrail",
+                     include_global_service_events: true,
+                     is_multi_region_trail: include_all_regions,
+                     is_organization_trail: include_all_organisation,
+                     enable_log_file_validation: true,
+                     kms_key_id: store.key_arn,
+
+                     cloud_watch_logs_group_arn: @log_group["arn"],
+                     cloud_watch_logs_role_arn: log_role["arn"],
+
+                     event_selector: [
+                       {
+                         read_write_type: "All",
+                         include_management_events: true,
+
+                         data_resource: {
+                           type: "AWS::Lambda::Function",
+                           values: ["arn:aws:lambda"],
+                         },
+                       },
+                       {
+                         read_write_type: "All",
+                         include_management_events: true,
+
+                         data_resource: {
+                           type: "AWS::S3::Object",
+                           values: ["arn:aws:s3:::"],
+                         },
+                       },
+                     ],
+                   }
+          self
+        end
+
+        def alert!(name:, pattern:, threshold: 1, topic: @topic)
+
+          ident = "cloudwatch-#{@name}-#{name}"
+
+          resource :aws_cloudwatch_log_metric_filter, ident, {
+                     name: name,
+                     pattern: pattern,
+                     log_group_name: @log_group["name"],
+
+                     metric_transformation: {
+                       name: "EventCount",
+                       namespace: "CloudTrail/#{name}",
+                       value: "1",
+                     },
+                   }
+
+          resource :aws_cloudwatch_metric_alarm, ident, {
+                     alarm_name: name,
+                     comparison_operator: "GreaterThanOrEqualToThreshold",
+                     evaluation_periods: "1",
+                     metric_name: "EventCount",
+                     namespace: "CloudTrail/#{name}",
+                     period: "300",
+                     statistic: "Sum",
+                     threshold: "#{threshold}",
+                     alarm_actions: [ topic ],
+                   }
+
+        end
+
+        def cis_benchmark!
+
+          # 3.1	Ensure a log metric filter and alarm exist for unauthorized API calls
+          alert!(
+            name: "UnauthorizedAPICalls",
+            pattern: "{ ($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode = \"AccessDenied*\") }",
+          )
+
+          # 3.2	Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
+          alert!(
+            name: "NoMFAConsoleSignin",
+            pattern: "{ ($.eventName = \"ConsoleLogin\") && ($.additionalEventData.MFAUsed != \"Yes\") }",
+          )
+
+          # 3.3	Ensure a log metric filter and alarm exist for usage of "root" account
+          alert!(
+            name: "RootUsage",
+            pattern: "{ $.userIdentity.type = \"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != \"AwsServiceEvent\" }",
+          )
+
+          # 3.4	Ensure a log metric filter and alarm exist for IAM policy changes
+          alert!(
+            name: "IAMChanges",
+            pattern: "{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}",
+          )
+
+          # 3.5	Ensure a log metric filter and alarm exist for CloudTrail configuration changes
+          alert!(
+            name: "CloudTrailCfgChanges",
+            pattern: "{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }",
+          )
+
+          # 3.6	Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
+          alert!(
+            name: "ConsoleSigninFailures",
+            pattern: "{ ($.eventName = ConsoleLogin) && ($.errorMessage = \"Failed authentication\") }",
+          )
+
+          # 3.7	Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs
+          alert!(
+            name: "DisableOrDeleteCMK",
+            pattern: "{ ($.eventSource = kms.amazonaws.com) && (($.eventName = DisableKey) || ($.eventName = ScheduleKeyDeletion)) }",
+          )
+
+          # 3.8	Ensure a log metric filter and alarm exist for S3 bucket policy changes
+          alert!(
+            name: "S3BucketPolicyChanges",
+            pattern: "{ ($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }",
+          )
+
+          # 3.9	Ensure a log metric filter and alarm exist for AWS Config configuration changes
+          alert!(
+            name: "AWSConfigChanges",
+            pattern: "{ ($.eventSource = config.amazonaws.com) && (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.eventName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder)) }",
+          )
+
+          # 3.10	Ensure a log metric filter and alarm exist for security group changes
+          alert!(
+            name: "SecurityGroupChanges",
+            pattern: "{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}",
+          )
+
+          # 3.11	Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)
+          alert!(
+            name: "NACLChanges",
+            pattern: "{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }",
+          )
+
+          # 3.12	Ensure a log metric filter and alarm exist for changes to network gateways
+          alert!(
+            name: "NetworkGWChanges",
+            pattern: "{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }",
+          )
+
+          # 3.13	Ensure a log metric filter and alarm exist for route table changes
+          alert!(
+            name: "RouteTableChanges",
+            pattern: "{ ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }",
+          )
+
+          # 3.14	Ensure a log metric filter and alarm exist for VPC changes
+          alert!(
+            name: "VPCChanges",
+            pattern: "{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }",
+          )
+
+        end
+
+      end
+
+    end
+  end
+end

data/lib/terrafying/components/version.rb

@@ -2,6 +2,6 @@
 
 module Terrafying
   module Components
-    VERSION = '1.11.17'
+    VERSION = '1.12.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: terrafying-components
 version: !ruby/object:Gem::Version
-  version: 1.11.17
+  version: 1.12.0
 platform: ruby
 authors:
 - uSwitch Limited
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-05-21 00:00:00.000000000 Z
+date: 2019-05-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -115,6 +115,12 @@ files:
 - lib/terrafying/components/loadbalancer.rb
 - lib/terrafying/components/ports.rb
 - lib/terrafying/components/prometheus.rb
+- lib/terrafying/components/security.rb
+- lib/terrafying/components/security/config.rb
+- lib/terrafying/components/security/config_aggregator.rb
+- lib/terrafying/components/security/pagerduty_topic.rb
+- lib/terrafying/components/security/store.rb
+- lib/terrafying/components/security/trail.rb
 - lib/terrafying/components/selfsignedca.rb
 - lib/terrafying/components/service.rb
 - lib/terrafying/components/staticset.rb