@meyicloud/meyi-insight-server 1.0.0

package/dist/features/sources/cloudtrail/stackTemplates.js

@@ -0,0 +1,548 @@
+export const STACK_YAML = `AWSTemplateFormatVersion: '2010-09-09'
+Description: |
+  Meyi Connect Security Monitoring - Regional Events Stack.
+  Deploys regional security alerting rules and SNS webhook delivery.
+
+Parameters:
+  Environment:
+    Type: String
+    Default: "MeyiConnect"
+    Description: Environment name (used as a prefix for resource names)
+
+  WebhookUrl:
+    Type: String
+    Description: MeyiConnect webhook URL for security alerts.
+
+  CreateCloudTrail:
+    Type: String
+    Default: 'false'
+    Description: Kept for backwards compatibility.
+
+  PrimaryRegion:
+    Type: String
+    Default: 'us-east-1'
+    Description: Kept for backwards compatibility.
+
+  DeploymentMode:
+    Type: String
+    Default: 'Organizations'
+    Description: Kept for backwards compatibility.
+
+Resources:
+
+  # ============================================================
+  # SNS TOPIC & SUBSCRIPTION FOR ALERTS
+  # ============================================================
+
+  SecurityAlertsTopic:
+    Type: AWS::SNS::Topic
+    Properties:
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+
+  SecurityAlertsTopicPolicy:
+    Type: AWS::SNS::TopicPolicy
+    Properties:
+      Topics:
+        - !Ref SecurityAlertsTopic
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: events.amazonaws.com
+            Action: sns:Publish
+            Resource: !Ref SecurityAlertsTopic
+
+  WebhookSubscription:
+    Type: AWS::SNS::Subscription
+    Properties:
+      TopicArn: !Ref SecurityAlertsTopic
+      Endpoint: !Ref WebhookUrl
+      Protocol: https
+
+  # ============================================================
+  # EVENTBRIDGE RULES ON DEFAULT BUS
+  # Regional events fire directly in this region - no forwarding needed
+  # ============================================================
+
+  DataAndInfrastructureSecurityRule:
+    Type: AWS::Events::Rule
+    DependsOn: SecurityAlertsTopicPolicy
+    Properties:
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+      Description: EC2, VPC, network, S3, and RDS configuration changes in the deployment region
+      EventPattern:
+        source:
+          - aws.ec2
+          - aws.s3
+          - aws.rds
+        detail-type:
+          - AWS API Call via CloudTrail
+        detail:
+          eventSource:
+            - ec2.amazonaws.com
+            - s3.amazonaws.com
+            - rds.amazonaws.com
+          eventName:
+            # EC2 & Network Events
+            - StopInstances
+            - RunInstances
+            - RebootInstances
+            - StartInstances
+            - TerminateInstances
+            - CreateCustomerGateway
+            - DeleteCustomerGateway
+            - AttachInternetGateway
+            - CreateInternetGateway
+            - DeleteInternetGateway
+            - DetachInternetGateway
+            - CreateNetworkAcl
+            - DeleteNetworkAcl
+            - CreateNetworkAclEntry
+            - DeleteNetworkAclEntry
+            - ReplaceNetworkAclEntry
+            - ReplaceNetworkAclAssociation
+            - AuthorizeSecurityGroupIngress
+            - AuthorizeSecurityGroupEgress
+            - RevokeSecurityGroupIngress
+            - RevokeSecurityGroupEgress
+            - ModifySecurityGroupRules
+            - UpdateSecurityGroupRuleDescriptionsIngress
+            - UpdateSecurityGroupRuleDescriptionsEgress
+            - CreateSecurityGroup
+            - DeleteSecurityGroup
+            - CreateVpc
+            - DeleteVpc
+            - ModifyVpcAttribute
+            - AcceptVpcPeeringConnection
+            - CreateVpcPeeringConnection
+            - DeleteVpcPeeringConnection
+            - RejectVpcPeeringConnection
+            - AttachClassicLinkVpc
+            - DetachClassicLinkVpc
+            - DisableVpcClassicLink
+            - EnableVpcClassicLink
+            - ModifyImageAttribute
+            - ModifySnapshotAttribute
+            - ModifyInstanceAttribute
+            - ImportKeyPair
+            - CreateKeyPair
+            - DisableEbsEncryptionByDefault
+            - DeleteFlowLogs
+            # S3 Events
+            - PutBucketPublicAccessBlock
+            - DeletePublicAccessBlock
+            - PutBucketPolicy
+            - DeleteBucketPolicy
+            - PutBucketAcl
+            - PutBucketEncryption
+            - DeleteBucketEncryption
+            - DeleteBucket
+            # RDS Events
+            - ModifyDBInstance
+            - ModifyDBSnapshotAttribute
+            - DeleteDBInstance
+            - DeleteDBClusterSnapshot
+            - RestoreDBInstanceFromDBSnapshot
+      State: ENABLED
+      Targets:
+        - Arn: !Ref SecurityAlertsTopic
+          Id: SNSTarget
+
+  OperationsAndSecretsSecurityRule:
+    Type: AWS::Events::Rule
+    DependsOn: SecurityAlertsTopicPolicy
+    Properties:
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+      Description: Lambda, SSM, Secrets Manager, and KMS configuration/management events
+      EventPattern:
+        source:
+          - aws.lambda
+          - aws.ssm
+          - aws.secretsmanager
+          - aws.kms
+        detail-type:
+          - AWS API Call via CloudTrail
+        detail:
+          eventSource:
+            - lambda.amazonaws.com
+            - ssm.amazonaws.com
+            - secretsmanager.amazonaws.com
+            - kms.amazonaws.com
+          eventName:
+            # Lambda, SSM, Secrets Manager
+            - AddPermission
+            - CreateFunction
+            - UpdateFunctionCode
+            - CreateEventSourceMapping
+            - SendCommand
+            - StartSession
+            - PutParameter
+            - DeleteParameter
+            - DeleteSecret
+            - PutResourcePolicy
+            # KMS
+            - ScheduleKeyDeletion
+            - DisableKey
+            - DisableKeyRotation
+            - PutKeyPolicy
+            - DeleteAlias
+            - CancelKeyDeletion
+      State: ENABLED
+      Targets:
+        - Arn: !Ref SecurityAlertsTopic
+          Id: SNSTarget
+
+  AuditAndTamperingSecurityRule:
+    Type: AWS::Events::Rule
+    DependsOn: SecurityAlertsTopicPolicy
+    Properties:
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+      Description: CloudTrail, GuardDuty, Security Hub, and Config auditing or tampering events
+      EventPattern:
+        source:
+          - aws.cloudtrail
+          - aws.securityhub
+          - aws.guardduty
+          - aws.config
+        detail-type:
+          - AWS API Call via CloudTrail
+        detail:
+          eventSource:
+            - cloudtrail.amazonaws.com
+            - securityhub.amazonaws.com
+            - guardduty.amazonaws.com
+            - config.amazonaws.com
+          eventName:
+            # CloudTrail
+            - CreateTrail
+            - UpdateTrail
+            - DeleteTrail
+            - StartLogging
+            - StopLogging
+            - PutEventSelectors
+            - DeleteEventDataStore
+            # Security Services Tampering
+            - BatchDisableStandards
+            - DeleteMembers
+            - DisassociateMembers
+            - DeleteDetector
+            - UpdateDetector
+            - CreateFilter
+            - StopMonitoringMembers
+            - DisableSecurityHub
+            - StopConfigurationRecorder
+            - DeleteConfigurationRecorder
+            - DeleteDeliveryChannel
+      State: ENABLED
+      Targets:
+        - Arn: !Ref SecurityAlertsTopic
+          Id: SNSTarget
+
+  ControlTowerManagedRule:
+    Type: AWS::Events::Rule
+    DependsOn: SecurityAlertsTopicPolicy
+    Properties:
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+      Description: Security Hub findings imported by AWS Control Tower
+      EventPattern:
+        source:
+          - aws.securityhub
+        detail-type:
+          - Security Hub Findings - Imported
+        detail:
+          findings:
+            Compliance:
+              AssociatedStandards:
+                StandardsId:
+                  - prefix: standards/service-managed-aws-control-tower
+      State: ENABLED
+      Targets:
+        - Arn: !Ref SecurityAlertsTopic
+          Id: SNSTarget
+
+# ============================================================
+# OUTPUTS
+# ============================================================
+
+Outputs:
+  SecurityAlertsTopicArn:
+    Description: ARN of the regional security alerts SNS topic
+    Value: !Ref SecurityAlertsTopic`;
+export const GLOBAL_STACK_YAML = `AWSTemplateFormatVersion: '2010-09-09'
+Description: |
+  Meyi Connect Security Monitoring - Global Events Stack (us-east-1). Fully independent of
+  the regional Central Stack. Captures IAM, Root Login, Console Login Failure, and AWS Health
+  events (all global services that only fire in us-east-1) and delivers them directly to the
+  Meyi Connect webhook via Amazon SNS. No cross-region forwarding,
+  no shared resources with any other stack.
+
+Parameters:
+  Environment:
+    Type: String
+    Default: "MeyiConnect"
+    Description: Environment name (used as a prefix for resource names)
+
+  WebhookUrl:
+    Type: String
+    Description: MeyiConnect webhook URL for global security alerts.
+
+  CreateCloudTrail:
+    Type: String
+    Default: 'false'
+    Description: Dummy parameter for compatibility with meyi-security-monitoring.yaml.
+
+  PrimaryRegion:
+    Type: String
+    Default: 'us-east-1'
+    Description: Dummy parameter for compatibility with meyi-security-monitoring.yaml.
+
+  DeploymentMode:
+    Type: String
+    Default: 'Organizations'
+    AllowedValues:
+      - 'Organizations'
+      - 'Standalone'
+    Description: Whether this is deployed via AWS Organizations or as a standalone account.
+
+Resources:
+
+  # ============================================================
+  # SNS TOPIC & SUBSCRIPTION FOR GLOBAL ALERTS
+  # ============================================================
+
+  GlobalSecurityAlertsTopic:
+    Type: AWS::SNS::Topic
+    Properties:
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+
+  GlobalSecurityAlertsTopicPolicy:
+    Type: AWS::SNS::TopicPolicy
+    Properties:
+      Topics:
+        - !Ref GlobalSecurityAlertsTopic
+      PolicyDocument:
+        Version: '2012-10-17'
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: events.amazonaws.com
+            Action: sns:Publish
+            Resource: !Ref GlobalSecurityAlertsTopic
+
+  WebhookSubscription:
+    Type: AWS::SNS::Subscription
+    Properties:
+      TopicArn: !Ref GlobalSecurityAlertsTopic
+      Endpoint: !Ref WebhookUrl
+      Protocol: https
+
+  # ============================================================
+  # EVENTBRIDGE RULES - GLOBAL EVENTS
+  # IAM, Root Login, Console Login, Health, and Organizations all fire only in us-east-1
+  # ============================================================
+
+  IAMAndOrganizationsSecurityEventsRule:
+    Type: AWS::Events::Rule
+    DependsOn: GlobalSecurityAlertsTopicPolicy
+    Properties:
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+      Description: IAM and Organizations security configuration changes
+      EventPattern:
+        source:
+          - aws.iam
+          - aws.organizations
+        detail-type:
+          - AWS API Call via CloudTrail
+        detail:
+          eventName:
+            # IAM events
+            - CreateUser
+            - DeleteUser
+            - CreateAccessKey
+            - UpdateAccessKey
+            - DeleteAccessKey
+            - AttachRolePolicy
+            - DetachRolePolicy
+            - PutUserPolicy
+            - PutRolePolicy
+            - UpdateAssumeRolePolicy
+            - DeactivateMFADevice
+            - CreateLoginProfile
+            - UpdateLoginProfile
+            - DeleteLoginProfile
+            - CreateAccountAlias
+            - DeleteAccountAlias
+            - UpdateAccountPasswordPolicy
+            - DeleteAccountPasswordPolicy
+            - DeleteGroupPolicy
+            - PutGroupPolicy
+            - CreatePolicy
+            - DeletePolicy
+            - CreatePolicyVersion
+            - DeletePolicyVersion
+            - AttachUserPolicy
+            - DetachUserPolicy
+            - AttachGroupPolicy
+            - DetachGroupPolicy
+            - CreateRole
+            - DeleteRole
+            - CreateSAMLProvider
+            - UpdateSAMLProvider
+            - CreateOpenIDConnectProvider
+            - UpdateOpenIDConnectProvider
+            - CreateServiceSpecificCredential
+            # Organizations events
+            - LeaveOrganization
+            - RemoveAccountFromOrganization
+            - DeletePolicy
+            - DetachPolicy
+            - DisablePolicyType
+            - UpdatePolicy
+            - CreateAccount
+            - InviteAccountToOrganization
+      State: ENABLED
+      Targets:
+        - Arn: !Ref GlobalSecurityAlertsTopic
+          Id: SNSTarget
+
+  ConsoleLoginRule:
+    Type: AWS::Events::Rule
+    DependsOn: GlobalSecurityAlertsTopicPolicy
+    Properties:
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+      Description: Root login, failed console logins, and MFA-not-used console login attempts
+      EventPattern:
+        detail-type:
+          - AWS Console Sign In via CloudTrail
+        detail:
+          eventName:
+            - ConsoleLogin
+          \$or:
+            - userIdentity:
+                type:
+                  - Root
+              responseElements:
+                ConsoleLogin:
+                  - Success
+            - responseElements:
+                ConsoleLogin:
+                  - Failure
+            - responseElements:
+                ConsoleLogin:
+                  - Success
+              additionalEventData:
+                MFAUsed:
+                  - "No"
+      State: ENABLED
+      Targets:
+        - Arn: !Ref GlobalSecurityAlertsTopic
+          Id: SNSTarget
+
+  HealthEventsRule:
+    Type: AWS::Events::Rule
+    DependsOn: GlobalSecurityAlertsTopicPolicy
+    Properties:
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+      Description: AWS Health notifications
+      EventPattern:
+        source:
+          - aws.health
+        detail-type:
+          - AWS Health Event
+      State: ENABLED
+      Targets:
+        - Arn: !Ref GlobalSecurityAlertsTopic
+          Id: SNSTarget
+
+  RootAPICallsRule:
+    Type: AWS::Events::Rule
+    DependsOn: GlobalSecurityAlertsTopicPolicy
+    Properties:
+      Tags:
+        - Key: Project
+          Value: MeyiConnect
+        - Key: Created_for
+          Value: L1 Security
+        - Key: aws-apn-id
+          Value: pc:eyl8vo7kcwv8k9qctzbathhiq
+      Description: Capture any API call made by the Root user account in us-east-1
+      EventPattern:
+        detail-type:
+          - AWS API Call via CloudTrail
+        detail:
+          userIdentity:
+            type:
+              - Root
+      State: ENABLED
+      Targets:
+        - Arn: !Ref GlobalSecurityAlertsTopic
+          Id: SNSTarget
+
+# ============================================================
+# OUTPUTS
+# ============================================================
+
+Outputs:
+  TopicArn:
+    Description: Global security alerts SNS Topic ARN
+    Value: !Ref GlobalSecurityAlertsTopic
+
+  RulesDeployed:
+    Description: Rules deployed in this stack
+    Value: IAMAndOrganizationsSecurityEvents, ConsoleLogin, HealthEvents, RootAPICalls`;
+//# sourceMappingURL=stackTemplates.js.map

package/dist/features/sources/cloudtrail/stackTemplates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stackTemplates.js","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/stackTemplates.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA4SU,CAAC;AAErC,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uFAqPsD,CAAC"}

package/dist/features/sources/cloudtrail/template.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Unified Stack CloudFormation template for CloudTrail security monitoring.
+ *
+ * The raw YAML is embedded here verbatim from meyi-security-monitoring.yaml.
+ * Two server-side substitutions are applied at serve time:
+ *   __MEYI_WEBHOOK_URL__           → the source's authenticated webhook URL
+ *   __MEYI_DEPLOYMENT_STATUS_URL__ → the deployment-status callback URL (token-gated)
+ *   __MEYI_WEBHOOK_AUTH_TOKEN__    → webhook auth token
+ */
+export declare const ALL_AWS_ACTIVE_REGIONS: string;
+export declare function buildCloudTrailCentralStackTemplate(input: {
+    webhookUrl: string;
+    webhookAuthToken?: string | null;
+    deploymentStatusUrl: string;
+    createCloudTrail: boolean;
+    deploymentMode?: 'Organizations' | 'Standalone';
+    targetAccounts?: string;
+    targetRegions?: string;
+    targetOUs?: string;
+}): string;
+//# sourceMappingURL=template.d.ts.map

package/dist/features/sources/cloudtrail/template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../../../src/features/sources/cloudtrail/template.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,sBAAsB,QAUxB,CAAC;AAwqCZ,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,eAAe,GAAG,YAAY,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAoBT"}