runbooks 0.7.0__py3-none-any.whl → 0.7.6__py3-none-any.whl

runbooks/remediation/CLAUDE.md

@@ -0,0 +1,100 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+This is a Python-based security remediation tool for resolving Dome9 (now Check Point CloudGuard) compliance issues across AWS accounts. The tool provides both individual command execution and bulk operations across multiple AWS accounts.
+
+## Development Setup
+
+### Prerequisites
+- Conda environment
+- AWS credentials configured (either via credentials file or AWS SSO)
+
+### Installation
+```bash
+pip install -r requirements.txt
+```
+
+## Commands and Usage
+
+### Individual Command Execution
+Use the CLI interface for single-account operations:
+```bash
+python src/cli.py s3 list
+python src/cli.py s3 block_public_access
+python src/cli.py api_gateway list
+python src/cli.py lambda list
+python src/cli.py cognito list_active_users
+```
+
+### Bulk Operations Across Multiple Accounts
+Use `bulk_run.py` for multi-account operations:
+```bash
+python src/bulk_run.py --function enable_public_access_block_on_all_buckets --credentials-path ../credentials
+python src/bulk_run.py --function list_lambda_functions --credentials-path ../credentials
+python src/bulk_run.py --function kms_operations_enable_key_rotation --credentials-path ../credentials
+python src/bulk_run.py --function find_object_in_s3 --kwargs 'object_to_find:my-object' --credentials-path ../credentials
+```
+
+### Testing
+Run unit tests using:
+```bash
+python -m unittest Tests.update_policy
+```
+
+## Architecture
+
+### Core Components
+
+**CLI Interface (`src/cli.py`)**
+- Main entry point for single-account operations
+- Uses Click framework for command grouping
+- Groups commands by AWS service (s3, api_gateway, lambda, cognito)
+
+**Bulk Operations (`src/bulk_run.py`)**
+- Handles multi-account remediation across AWS organizations
+- Supports both file-based credentials and AWS SSO authentication
+- Contains a registry of all available functions for bulk execution
+- Implements comprehensive logging to both console and files
+
+**AWS Commons (`src/aws/commons.py`)**
+- Central utilities for AWS client/resource creation
+- AWS SSO authentication flow with browser-based device authorization
+- Credentials management for both static files and SSO tokens
+- Common helper functions for AWS API operations (pricing, CloudWatch metrics, etc.)
+- Caching decorators for performance optimization
+
+### AWS Service Modules Structure
+All AWS-specific functionality is organized under `src/aws/` with individual modules for each service and operation:
+
+- **S3 Operations**: Bucket management, public access blocking, encryption, SSL policies
+- **EC2 Operations**: Security group management, EBS volume cleanup, public IP management
+- **IAM/Security**: KMS key rotation, certificate management
+- **Serverless**: Lambda function management, API Gateway operations
+- **Data Services**: DynamoDB encryption and optimization, RDS management
+- **Monitoring**: CloudTrail modifications, CloudWatch integration
+- **Identity**: Cognito user management and operations
+
+### Authentication Patterns
+
+The tool supports two authentication methods:
+
+1. **File-based Credentials**: Traditional AWS credentials file with access keys
+2. **AWS SSO**: Modern SSO flow with device authorization and browser-based authentication
+
+The commons module automatically handles credential refresh and multi-account iteration, making it transparent to individual remediation functions.
+
+### Logging and Output
+
+- Dual logging to console and file (configurable via `DOME9_REMEDIATION_FILE_LOG` environment variable)
+- CSV output generation for analysis and reporting
+- CloudWatch metrics integration for cost and usage analysis
+
+## Environment Variables
+
+- `ACCESS_PORTAL_URL`: AWS SSO start URL (default: "https://d-976752e8d5.awsapps.com/start")
+- `DOME9_REMEDIATION_FILE_LOG`: Custom log file path
+- `AWS_REGION`: Default AWS region for operations
+- Standard AWS environment variables (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`)

runbooks/remediation/DOME9.md

@@ -0,0 +1,218 @@
+# rule‑by‑rule mapping for Dome9 findings 
+
+> Each row links the finding to the **closest AWS‑managed Systems Manager Automation runbook** available today; where no managed runbook exists, I note **`Custom‑…`** so you can supply your own document (usually a short YAML wrapper that calls `aws:executeAwsApi`).
+
+---
+
+### How to read the table
+
+* **Severity / Compliance** – taken verbatim from your CSV.
+* **AWS SSM Runbook** – the document to launch.  All Amazon‑owned runbooks are in the official reference ([AWS Documentation][1]).
+
+  * If you prefer AWS Config integration, many of these also have an **`AWSConfigRemediation‑…`** variant.
+* **Notes** – one‑line remediation intent plus the security pillar or control the rule supports.
+
+---
+
+## Failed Tests by Rule report with *working* URLs from **AWS Systems Manager Automation Runbook Reference**.
+Custom gaps remain **Custom‑…** (no AWS‑managed equivalent).
+
+| #   | Dome9 Rule Name                 | Sev. | Compliance Section | **Mapped Runbook (clickable)**                                                                                                                                                                                            | CIS / NIST Control | Notes                               |
+| --- | ------------------------------- | ---- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | ----------------------------------- |
+|  1  | S3 buckets must enforce SSL     | H    | SEC 7 & 10         | [AWSConfigRemediation‑ConfigureS3BucketPublicAccessBlock](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-block-public-s3-bucket.html) ([AWS Documentation][1])           | CIS 3.8 / SC‑13    | Denies non‑TLS requests             |
+|  2  | Encrypt S3 PUT actions          | H    | SEC 7 & 9          | [AWS‑EnableS3BucketEncryption](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-enableS3bucketencryption.html) ([AWS Documentation][2])                                    | CIS 3.3 / SC‑28    | Forces SSE‑KMS                      |
+|  3  | Subnets auto‑assign public IP   | H    | SEC 6              | [AWSConfigRemediation‑DisableSubnetAutoAssignPublicIP](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-disable-subnet-auto-public-ip.html) ([AWS Documentation][3])       | CIS 4.3 / AC‑4     | Sets `MapPublicIpOnLaunch=false`    |
+|  4  | SGs expose admin ports          | H    | SEC 6              | [AWS‑DisablePublicAccessForSecurityGroup](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-disablepublicaccessforsecuritygroup.html) ([AWS Documentation][4])              | CIS 4.1 / SC‑7     | Removes 0.0.0.0/0 on 22/3389        |
+|  5  | RDS publicly accessible         | H    | SEC 6              | [AWSConfigRemediation‑DisablePublicAccessToRDSInstance](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-disable-rds-instance-public-access.html) ([AWS Documentation][5]) | CIS 4.1 / SC‑7     | Switches `PubliclyAccessible=false` |
+|  6  | CMK rotation disabled           | H    | SEC 4 & REL 4      | [AWSConfigRemediation‑EnableKeyRotation](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-enable-key-rotation.html) ([AWS Documentation][6])                               | CIS 2.9 / SC‑12    | Enables annual rotation             |
+|  7  | CloudTrail log validation off   | L    | SEC 4 & REL 4      | [AWS‑EnableCloudTrailLogFileValidation](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/enable-cloudtrail-log-validation.html) ([AWS Documentation][7])                                  | CIS 2.4 / AU‑10    | Turns on digest validation          |
+|  8  | CloudTrail not KMS‑encrypted    | M    | SEC 4 & REL 4      | [AWS‑EnableCloudTrailKmsEncryption](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/enable-cloudtrail-kms-encryption.html) ([AWS Documentation][8])                                      | CIS 2.3 / SC‑13    | Adds CMK                            |
+|  9  | CloudTrail bucket lacks logging | M    | SEC 4 & REL 4      | [AWS‑ConfigureS3BucketLogging](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-configures3bucketlogging.html) ([AWS Documentation][9])                                    | CIS 2.8 / AU‑9     | Enables server‑access logs          |
+|  10 | Public S3 GET/LIST/PUT/DEL      | H    | SEC 3              | *same as #1*                                                                                                                                                                                                              | CIS 3.1‑3.7 / SC‑7 | Blocks public principals            |
+|  11 | S3 bucket lacks SSE             | H    | SEC 9              | *same as #2*                                                                                                                                                                                                              | CIS 3.3 / SC‑28    | Default encryption                  |
+|  12 | No HTTPS‑only policy            | H    | SEC 7              | **Custom‑ConfigureS3BucketSecureTransport**                                                                                                                                                                               | CIS 3.8 / SC‑13    | Deny non‑SSL (custom)               |
+|  13 | Unused ACM certs                | M    | SEC 7              | **Custom‑RemoveUnusedACMCerts**                                                                                                                                                                                           | CIS 1.23 / CM‑6    | Certificate hygiene                 |
+|  14 | Expired ACM certs               | M    | SEC 7              | **Custom‑RemoveExpiredACMCerts**                                                                                                                                                                                          | CIS 1.23 / CM‑6    | Remove/renew                        |
+|  15 | Certs expiring ≤ 7 days         | H    | SEC 7              | **Custom‑RenewACMCertificate**                                                                                                                                                                                            | CIS 1.23 / CM‑6    | Renew immediately                   |
+|  16 | CloudFront default SSL cert     | H    | SEC 6              | **Custom‑AssociateCloudFrontCustomCert**                                                                                                                                                                                  | CIS 3.8 / SC‑13    | Attach ACM cert                     |
+|  17 | CloudFront weak TLS             | H    | SEC 7              | **Custom‑ConfigureCloudFrontTLSCipher**                                                                                                                                                                                   | CIS 3.9 / SC‑13    | Enforce modern policy               |
+|  18 | Geo restriction off             | L    | SEC 6              | **Custom‑EnableCloudFrontGeoRestriction**                                                                                                                                                                                 | CIS 1.21 / AC‑6    | Apply geo limits                    |
+|  19 | CloudFront logging off          | M    | SEC 6              | **Custom‑EnableCloudFrontLogging**                                                                                                                                                                                        | CIS 3.11 / AU‑12   | Enable CF logs                      |
+|  20 | Container health checks missing | M    | OPS 8 & 9          | **Custom‑EnableECSHealthCheck**                                                                                                                                                                                           | NIST SI‑4          | Add `HEALTHCHECK`                   |
+|  21 | Idle ECS services               | M    | SEC 6              | **Custom‑ScaleDownIdleECSService**                                                                                                                                                                                        | NIST CM‑2          | Remove idle                         |
+|  22 | ECS cluster empty               | M    | SEC 6              | **Custom‑RegisterInstanceWithECSCluster**                                                                                                                                                                                 | NIST CM‑2          | Register capacity                   |
+|  23 | RDS not CMK‑encrypted           | M    | SEC 7              | **Custom‑EnableRDSCMKEncryption**                                                                                                                                                                                         | CIS 7.1 / SC‑28    | Encrypt storage                     |
+|  24 | RDS backup retention < 7d       | M    | SEC 11 & REL 6     | [AWSConfigRemediation‑EnableRDSInstanceBackup](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-enable-rds-instance-backup.html) ([AWS Documentation][10])                 | CIS 7.4 / CP‑9     | Sets retention ≥ 7 days             |
+|  25 | RDS unencrypted                 | H    | SEC 7              | **Custom‑EnableRDSEncryption**                                                                                                                                                                                            | CIS 7.1 / SC‑28    | Encrypt DB                          |
+|  26 | DynamoDB not CMK‑SSE            | M    | SEC 7              | **Custom‑EnableDynamoDBSSE**                                                                                                                                                                                              | CIS 3.3 / SC‑28    | Enable KMS                          |
+|  27 | Kinesis stream unencrypted      | H    | SEC 7 & 9          | [AWS‑EnableKinesisStreamEncryption](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/aws-enablekinesisstreamencryption.html) ([AWS Documentation][11])                                    | CIS 3.3 / SC‑28    | Turn on CMK                         |
+|  28 | Unused security groups          | M    | SEC 6              | [AWSConfigRemediation‑DeleteUnusedSecurityGroup](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-delete-ec2-security-group.html) ([AWS Documentation][12])                | CIS 4.2 / CM‑6     | Delete unattached SGs               |
+|  29 | SG open 0–65535 0.0.0.0/0       | H    | SEC 6              | *same as #4*                                                                                                                                                                                                              | CIS 4.1 / SC‑7     | Blanket ingress removal             |
+|  30 | Unattached EBS volume           | M    | COST 3             | [AWS‑AttachEBSVolume](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-attachebsvolume.html) ([AWS Documentation][13])                                                     | CM‑8               | Attach or snapshot & delete         |
+|  31 | Unused customer CMKs            | M    | SEC 1              | **Custom‑DisableUnusedCMK**                                                                                                                                                                                               | CM‑5               | Schedule deletion                   |
+|  32 | Lambda admin privileges         | H    | SEC 3              | **Custom‑RestrictLambdaRolePolicy**                                                                                                                                                                                       | CIS 1.13 / AC‑6    | Least‑privilege role                |
+|  33 | ALB listener HTTP open          | M    | SEC 6              | **Custom‑RedirectALBHTTPToHTTPS**                                                                                                                                                                                         | CIS 3.8 / SC‑13    | Force HTTPS                         |
+|  34 | ECS service w/o LB              | M    | SEC 6              | **Custom‑AttachLoadBalancerToService**                                                                                                                                                                                    | SC‑7               | Add ALB                             |
+|  35 | CloudFront WAF absent           | M    | SEC 6              | **Custom‑ConfigureCloudFrontWAF**                                                                                                                                                                                         | SI‑10              | Attach WAFv2 WebACL                 |
+
+**✔ All AWS‑managed rows link directly to the official Runbook Reference pages (verified July 2025).**
+Use this table as the definitive source for your CrewAI pipeline, compliance dashboards, and audit artefacts.
+
+[1]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-block-public-s3-bucket.html "AWSConfigRemediation-ConfigureS3BucketPublicAccessBlock - AWS Systems Manager Automation runbook reference"
+[2]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-enableS3bucketencryption.html?utm_source=chatgpt.com "AWS-EnableS3BucketEncryption - AWS Systems Manager ..."
+[3]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-disable-subnet-auto-public-ip.html?utm_source=chatgpt.com "AWSConfigRemediation-DisableSubnetAutoAssignPublicIP"
+[4]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-disablepublicaccessforsecuritygroup.html?utm_source=chatgpt.com "AWS-DisablePublicAccessForSecurityGroup - AWS Documentation"
+[5]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-disable-rds-instance-public-access.html?utm_source=chatgpt.com "AWSConfigRemediation-DisablePublicAccessToRDSInstance"
+[6]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-enable-key-rotation.html?utm_source=chatgpt.com "AWSConfigRemediation-EnableKeyRotation - AWS Documentation"
+[7]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/enable-cloudtrail-log-validation.html?utm_source=chatgpt.com "AWS-EnableCloudTrailLogFileValidation - AWS Systems Manager ..."
+[8]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/enable-cloudtrail-kms-encryption.html?utm_source=chatgpt.com "AWS-EnableCloudTrailKmsEncryption - AWS Systems Manager ..."
+[9]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-configures3bucketlogging.html?utm_source=chatgpt.com "AWS-ConfigureS3BucketLogging - AWS Systems Manager ..."
+[10]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-enable-rds-instance-backup.html?utm_source=chatgpt.com "AWSConfigRemediation-EnableRDSInstanceBackup"
+[11]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/aws-enablekinesisstreamencryption.html?utm_source=chatgpt.com "AWS-EnableKinesisStreamEncryption - AWS Systems Manager ..."
+[12]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-delete-ec2-security-group.html?utm_source=chatgpt.com "AWSConfigRemediation-DeleteUnusedSecurityGroup"
+[13]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-attachebsvolume.html?utm_source=chatgpt.com "AWS-AttachEBSVolume - AWS Systems Manager Automation ..."
+
+
+---
+
+## Failed Tests by Rule Dome9 Mapping - OLD
+
+> Each row aligns with an AWS‑managed SSM Automation runbook (or an explicit *Custom‑…* placeholder) and cites the exact rule lines from the HTML report.
+
+| #   | Dome9 Rule Name                                       | Severity | Compliance Section | **Mapped AWS SSM Runbook**                               | Primary Standard / Control          | Notes                                       |
+| --- | ----------------------------------------------------- | -------- | ------------------ | -------------------------------------------------------- | ----------------------------------- | ------------------------------------------- |
+|  1  | S3 Buckets Secure Transport (SSL)                     | High     | SEC 7, SEC 10      | **AWS‑ConfigureS3BucketPublicAccessBlock**               | WA Security #7 (Encrypt in Transit) | Adds bucket policy denying non‑TLS requests |
+|  2  | Use encryption for S3 Bucket write actions            | High     | SEC 7, SEC 9       | **AWS‑EnableS3BucketEncryption**                         | WA Security #9 (Encrypt at Rest)    | Forces SSE‑KMS on PUT actions               |
+|  3  | VPC subnets auto‑assign public IP enabled             | High     | SEC 6              | **AWSConfigRemediation‑DisableSubnetAutoAssignPublicIP** | WA Network #6                       | Sets `MapPublicIpOnLaunch=false`            |
+|  4  | Security groups expose admin ports                    | High     | SEC 6              | **AWS‑DisablePublicAccessForSecurityGroup**              | CIS AWS 1.3                         | Restricts 0.0.0.0/0 on 22/3389              |
+|  5  | RDS open to large CIDR scope                          | High     | SEC 6              | **AWS‑RestrictRDSPublicAccess**                          | WA Reliability #6                   | Removes public SG rules                     |
+|  6  | CMK rotation disabled                                 | High     | SEC 4, REL 4       | **AWS‑RotateKMSKey**                                     | CIS AWS 2.3                         | Enables annual key rotation                 |
+|  7  | CloudTrail log validation disabled                    | Low      | SEC 4, REL 4       | **AWS‑ConfigureCloudTrailValidation**                    | CIS AWS 2.4                         | Turns on file‑integrity validation          |
+|  8  | CloudTrail logs not KMS‑encrypted                     | Medium   | SEC 4, REL 4       | **AWS‑ConfigureCloudTrailKMS**                           | WA Security #4                      | Adds KMS key to trails                      |
+|  9  | CloudTrail bucket lacks access logging                | Medium   | SEC 4, REL 4       | **AWS‑ConfigureS3BucketLogging**                         | CIS AWS 2.8                         | Enables S3 access logs                      |
+|  10 | S3 bucket access logging disabled (CloudTrail bucket) | High     | SEC 4, REL 4       | **same as 9**                                            | Same control                        | —                                           |
+|  11 | S3 bucket public GET/LIST/PUT/DELETE                  | High     | SEC 3              | **AWS‑ConfigureS3BucketPublicAccessBlock**               | CIS AWS 3.x                         | Blocks public IAM/principal actions         |
+|  12 | S3 bucket lacks SSE                                   | High     | SEC 9              | **AWS‑EnableS3BucketEncryption**                         | WA Security #9                      | Enables default encryption                  |
+|  13 | S3 bucket lacks HTTPS‑only policy                     | High     | SEC 7              | **Custom‑ConfigureS3BucketSecureTransport**              | WA Security #7                      | Custom runbook to deny insecure transport   |
+|  14 | ACM unused certificates                               | Medium   | SEC 7              | **Custom‑RemoveUnusedACMCerts**                          | WA Security #7                      | Deletes orphaned certs                      |
+|  15 | ACM expired certificates                              | Medium   | SEC 7              | **Custom‑RemoveExpiredACMCerts**                         | WA Security #7                      | Remove/renew expiring certs                 |
+|  16 | SSL/TLS certs expiring in 7 days                      | High     | SEC 7              | **same as 15**                                           | —                                   | Renew immediately                           |
+|  17 | CloudFront default SSL cert                           | High     | SEC 6              | **Custom‑AssociateCloudFrontCustomCert**                 | WA Security #6                      | Attach ACM cert                             |
+|  18 | CloudFront weak cipher suite                          | High     | SEC 7              | **Custom‑ConfigureCloudFrontTLSCipher**                  | WA Security #7                      | Enforce modern TLS policy                   |
+|  19 | CloudFront geo restriction disabled                   | Low      | SEC 6              | **Custom‑EnableCloudFrontGeoRestriction**                | WA Security #6                      | Apply geo whitelist/blacklist               |
+|  20 | CloudFront access logging disabled                    | Medium   | SEC 6              | **Custom‑EnableCloudFrontLogging**                       | CIS AWS 3.15                        | Enable S3 logs                              |
+|  21 | Container health checks missing                       | Medium   | OPS 8, OPS 9       | **Custom‑EnableECSHealthCheck**                          | WA Operational Excellence #8        | Add `HEALTHCHECK` to task def               |
+|  22 | ECS services without running tasks                    | Medium   | SEC 6              | **Custom‑ScaleDownIdleECSService**                       | WA Reliability #6                   | Delete or scale to 0                        |
+|  23 | ECS cluster empty                                     | Medium   | SEC 6              | **Custom‑RegisterInstanceWithECSCluster**                | WA Reliability #6                   | Register capacity provider                  |
+|  24 | RDS encryption lacks CMK                              | Medium   | SEC 7, SEC 9       | **Custom‑EnableRDSCMKEncryption**                        | WA Security #9                      | Convert storage encryption                  |
+|  25 | RDS retention < 7 days                                | Medium   | SEC 11, REL 6      | **AWS‑ModifyRDSBackupRetention**                         | CIS AWS 3.1                         | Set ≥ 7 days                                |
+|  26 | RDS not encrypted (general)                           | High     | SEC 7              | **Custom‑EnableRDSEncryption**                           | WA Security #9                      | Encrypt unencrypted DBs                     |
+|  27 | DynamoDB not SSE‑CMK                                  | Medium   | SEC 7              | **Custom‑EnableDynamoDBSSE**                             | WA Security #9                      | Enable KMS encryption                       |
+|  28 | Kinesis stream not CMK‑encrypted                      | High     | SEC 7, SEC 9       | **Custom‑EnableKinesisStreamEncryption**                 | WA Security #9                      | Turn on KMS SSE                             |
+|  29 | Unused security groups                                | Medium   | SEC 6              | **AWS‑DeleteUnusedSecurityGroups**                       | CIS AWS 4.1                         | Remove unattached SGs                       |
+|  30 | SG open to all ports 0.0.0.0/0                        | High     | SEC 6              | **AWS‑DisablePublicAccessForSecurityGroup**              | CIS AWS 4.1                         | Blanket ingress removal                     |
+|  31 | EBS volume unattached                                 | Medium   | COST 3             | **AWS‑AttachEBSVolume**                                  | WA Cost‑Optimisation #3             | Attach or snapshot & delete                 |
+|  32 | Customer CMKs unusable                                | Medium   | SEC 1              | **Custom‑DisableUnusedCMK**                              | WA Security #1                      | Schedule key deletion                       |
+|  33 | Lambda functions with Admin privileges                | High     | SEC 3              | **Custom‑RestrictLambdaRolePolicy**                      | CIS AWS 1.5                         | Replace with least‑priv role                |
+|  34 | ALB listener allows HTTP                              | Medium   | SEC 6              | **Custom‑RedirectALBHTTPToHTTPS**                        | WA Security #6                      | Force redirect 80 → 443                     |
+|  35 | ALB no attached LB to ECS service                     | Medium   | SEC 6              | **Custom‑AttachLoadBalancerToService**                   | WA Reliability #6                   | Ensure LB front‑end exists                  |
+
+> **Legend**
+> *WA* = AWS Well‑Architected Framework.
+> *CIS AWS x.y* = CIS AWS Foundations Benchmark control.
+
+---
+
+\### How this table was built 
+
+* **Source lines**: Each rule name, severity, and section is drawn from your HTML report lines – see citations.
+* **Runbook mapping**: Follows the hardened mapping catalogue; AWS‑managed where available, otherwise *Custom‑…* placeholders ready for YAML authoring.
+* **Standards alignment**: Every row references a primary security control (CIS or WA).
+
+This fully enriched matrix is **ready for CSV/HTML export** and can feed both your executive dashboards and the CrewAI pipeline (as static metadata for context injection). It meets enterprise reproducibility requirements and aligns with AWS security best practices.
+
+---
+
+
+
+---
+
+> Old Version
+
+| #   | Dome9 **Rule Name**                          | Severity | Compliance Section | **AWS SSM Runbook**                                                                 | Notes / Security Standard                                 |
+| --- | -------------------------------------------- | -------- | ------------------ | ----------------------------------------------------------------------------------- | --------------------------------------------------------- |
+|  1  | AWS Cloud Front – WAF Integration            | Medium   |  SEC\_6            | `Custom‑ConfigureCloudFrontWAF`                                                     | Attach WAF WebACL to distribution (Well‑Arch Security #6) |
+|  2  | AWS Kinesis data at rest lacks SSE           | High     |  SEC\_7 \| SEC\_9  | `Custom‑EnableKinesisStreamEncryption`                                              | Turn on KMS CMK SSE (Encryption)                          |
+|  3  | Kinesis streams not using KMS CMK            | High     |  SEC\_7 \| SEC\_9  | `Custom‑EnableKinesisStreamEncryption`                                              | Same as #2                                                |
+|  4  | Determine if CloudFront CDN is in use        | Low      |  SEC\_6            | *Advisory*                                                                          | Informational only – no remediation                       |
+|  5  | ECS cluster should have active services only | Medium   |  SEC\_6            | `Custom‑DeleteIdleECSCluster`                                                       | Remove empty/idle clusters                                |
+|  6  | ECS service task defs have empty roles       | Medium   |  SEC\_3            | `Custom‑ValidateECSTaskRoles`                                                       | Enforce least‑privilege IAM role                          |
+|  7  | ECS services without running tasks           | Medium   |  SEC\_6            | `Custom‑ScaleDownIdleECSService`                                                    | Delete or scale to 0                                      |
+|  8  | ELB – recommended TLS protocol               | High     |  SEC\_7            | `Custom‑ConfigureELBListenerTLS`                                                    | Apply ELB SecurityPolicy‑2023‑06                          |
+|  9  | ELB not using SSL                            | High     |  SEC\_7            | `Custom‑ConfigureELBHTTPS`                                                          | Add cert & force HTTPS                                    |
+|  10 | Enable container health checks               | Low      |  OPS\_8 \| OPS\_9  | `Custom‑EnableECSHealthCheck`                                                       | Add `HEALTHCHECK` to task definitions                     |
+|  11 | ACM contains wildcard certs                  | Medium   |  SEC\_7            | `Custom‑ValidateACMCerts`                                                           | Delete/replace wildcard certs                             |
+|  12 | ALB listener still allows HTTP               | Medium   |  SEC\_6            | `Custom‑RedirectALBHTTPToHTTPS`                                                     | Force‑redirect 80→443                                     |
+|  13 | CloudFront access logging disabled           | Medium   |  SEC\_6            | `Custom‑EnableCloudFrontLogging`                                                    | Enable S3 log bucket                                      |
+|  14 | CloudFront geo‑restriction missing           | Medium   |  SEC\_6            | `Custom‑EnableCloudFrontGeoRestriction`                                             | Apply whitelist/blacklist                                 |
+|  15 | CloudFront uses default SSL cert             | Medium   |  SEC\_7            | `Custom‑AssociateCloudFrontCustomCert`                                              | Attach ACM cert                                           |
+|  16 | EBS volumes not attached                     | Medium   |  REL\_5            | **`AWS-AttachEBSVolume`**                                                           | Attach or clean up orphaned EBS                           |
+|  17 | IAM policies overly permissive               | High     |  SEC\_1            | **`AWS-RestrictIAMPolicyPrivileges`**                                               | Remove `*` actions                                        |
+|  18 | RDS automatic minor upgrades off             | Medium   |  REL\_6            | `Custom‑EnableRDSAutoMinorUpgrade`                                                  | Set `AutoMinorVersionUpgrade=true`                        |
+|  19 | RDS not Multi‑AZ                             | Medium   |  REL\_6            | `Custom‑ConvertRDSMultiAZ`                                                          | Modify instance to Multi‑AZ                               |
+|  20 | RDS backup retention < 7 days                | Medium   |  REL\_6            | **`AWS-ModifyRDSBackupRetention`**                                                  | Set ≥ 7 days                                              |
+|  21 | Subnet auto‑assign public IP on              | High     |  SEC\_6            | **`AWSConfigRemediation‑DisableSubnetAutoAssignPublicIP`** ([AWS Documentation][2]) | Set `MapPublicIpOnLaunch=false`                           |
+|  22 | DynamoDB not using SSE (KMS)                 | Medium   |  SEC\_7            | `Custom‑EnableDynamoDBSSE`                                                          | Turn on KMS encryption                                    |
+|  23 | CloudTrail log validation disabled           | Medium   |  SEC\_4            | **`AWS-ConfigureCloudTrailValidation`**                                             | Enable hash + sig checks                                  |
+|  24 | CloudTrail not encrypted with KMS            | Medium   |  SEC\_4            | **`AWS-ConfigureCloudTrailKMS`**                                                    | Add KMS key                                               |
+|  25 | CloudTrail bucket lacks access logging       | Medium   |  SEC\_6            | **`AWS-ConfigureS3BucketLogging`**                                                  | Enable access logs                                        |
+|  26 | S3 bucket is public                          | High     |  SEC\_3            | **`AWS-ConfigureS3BucketPublicAccessBlock`**                                        | Block public ACLs                                         |
+|  27 | Expired ACM certificates present             | Medium   |  SEC\_7            | `Custom‑RemoveExpiredACMCerts`                                                      | Delete expired certs                                      |
+|  28 | SG allows 0.0.0.0/0 all ports                | High     |  SEC\_6            | **`AWS-DisablePublicAccessForSecurityGroup`** ([AWS Documentation][3])              | Remove open rules                                         |
+|  29 | SG allows 0.0.0.0/0 RDP 3389                 | High     |  SEC\_6            | **same as 28**                                                                      | Restrict RDP                                              |
+|  30 | SG allows 0.0.0.0/0 SSH 22                   | High     |  SEC\_6            | **same as 28**                                                                      | Restrict SSH                                              |
+|  31 | Unused ACM certificates                      | Low      |  SEC\_7            | `Custom‑RemoveUnusedACMCerts`                                                       | Clean up inventory                                        |
+|  32 | Service deployment without RUNNING task      | Medium   |  OPS\_8            | `Custom‑ValidateECSTaskStatus`                                                      | Ensure at least one task                                  |
+|  33 | RDS not encrypted with CMK                   | High     |  SEC\_7            | `Custom‑EnableRDSCMKEncryption`                                                     | Convert storage encryption                                |
+|  34 | Lambda has Admin role                        | High     |  SEC\_3            | `Custom‑RestrictLambdaRolePolicy`                                                   | Replace admin privileges                                  |
+|  35 | RDS SG open to world                         | High     |  SEC\_6            | **`AWS-RestrictRDSPublicAccess`**                                                   | Remove `0.0.0.0/0`                                        |
+|  36 | Unused Security Groups                       | Medium   |  SEC\_6            | **`AWS-DeleteUnusedSecurityGroups`**                                                | Delete unattached SGs                                     |
+|  37 | S3 bucket lacks HTTPS‑only policy            | High     |  SEC\_7            | `Custom‑ConfigureS3BucketSecureTransport`                                           | Deny non‑SSL                                              |
+|  38 | S3 bucket lacks SSE                          | High     |  SEC\_9            | **`AWS-EnableS3BucketEncryption`** ([AWS Documentation][4])                         | Enable SSE‑S3/KMS                                         |
+|  39 | S3 bucket – public DELETE                    | High     |  SEC\_3            | **`AWS-ConfigureS3BucketPublicAccessBlock`**                                        | Block deletes                                             |
+|  40 | S3 bucket – public GET                       | High     |  SEC\_3            | **same as 39**                                                                      | Block GET                                                 |
+|  41 | S3 bucket – public LIST                      | High     |  SEC\_3            | **same as 39**                                                                      | Block LIST                                                |
+|  42 | S3 bucket – public PUT                       | High     |  SEC\_3            | **same as 39**                                                                      | Block PUT                                                 |
+|  43 | S3 bucket – public PUT/RESTORE               | High     |  SEC\_3            | **same as 39**                                                                      | Block restore                                             |
+|  44 | ACM cert expires in 1 month                  | Medium   |  SEC\_7            | `Custom‑RenewACMCertificate`                                                        | Begin renewal workflow                                    |
+|  45 | ACM cert expires in 1 week                   | High     |  SEC\_7            | **same as 44**                                                                      | Critical renewal                                          |
+|  46 | SG exposes admin ports                       | High     |  SEC\_6            | **same as 28**                                                                      | Generic admin port exposure                               |
+|  47 | Use Encrypted RDS storage                    | High     |  SEC\_7            | `Custom‑EnableRDSEncryption`                                                        | Encrypt unencrypted RDS                                   |
+|  48 | Encrypt storage for DB EC2 hosts             | High     |  SEC\_7            | `Custom‑EnableEC2EBSVolumeEncryption`                                               | Enable EBS default encryption                             |
+|  49 | Encrypt S3 PUT actions                       | High     |  SEC\_7            | **`AWS-EnableS3BucketEncryption`**                                                  | Require encrypted PUT                                     |
+|  50 | CloudFront weak cipher suite                 | High     |  SEC\_7            | `Custom‑ConfigureCloudFrontTLSCipher`                                               | Enforce modern ciphers                                    |
+|  51 | Unusable customer CMKs present               | Medium   |  SEC\_4            | `Custom‑DisableUnusedCMK`                                                           | Schedule key deletion                                     |
+|  52 | CMK rotation disabled                        | High     |  SEC\_4            | **`AWS-RotateKMSKey`**                                                              | Turn on annual rotation                                   |
+|  53 | DynamoDB encrypted with AWS‑owned CMK        | Medium   |  SEC\_7            | `Custom‑EnableDynamoDBKmsCMK`                                                       | Switch to AWS‑managed CMK                                 |
+|  54 | ELB SG inbound rules too open                | High     |  SEC\_6            | **same as 28**                                                                      | Tighter SG                                                |
+|  55 | Service lacks attached LB                    | Medium   |  SEC\_6            | `Custom‑AttachLoadBalancerToService`                                                | Add ALB/NLB                                               |
+|  56 | ECS cluster has zero instances               | Medium   |  SEC\_6            | `Custom‑RegisterInstanceWithECSCluster`                                             | Register capacity provider                                |
+|  57 | EFS not encrypted with CMK                   | Medium   |  SEC\_7            | `Custom‑EnableEFSKmsEncryption`                                                     | Enable EFS CMEK                                           |
+|  58 | Lambda functions share execution role        | Medium   |  SEC\_3            | `Custom‑UniqueLambdaRoles`                                                          | Unique least‑privilege role                               |
+
+---
+
+### Next actions
+
+1. **Import this table** into a DynamoDB “Remediation Catalogue”.
+2. **Point the Step Functions Map state** at the catalogue so each finding selects the right runbook.
+3. For every `Custom‑…` entry, author a 4‑step YAML document (Pre‑check → Action `aws:executeAwsApi` → Post‑check → Outputs) and store it in the delegated‑admin account.
+4. Enable **cross‑account Automation** by creating an `AutomationAssumeRole` in every target account/Region.
+5. Wire the pipeline to your Dome9 S3 drop‑zone and you’ll have **near‑real‑time, auditable, multi‑account remediation**.
+
+With this catalogue in place, your organisation moves from manual CSV triage to *automated, standards‑aligned security hygiene*—all backed by Systems Manager Automation’s immutable execution history.
+
+[1]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-runbook-reference.html?utm_source=chatgpt.com "AWS Systems Manager Automation Runbook Reference"
+[2]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-disable-subnet-auto-public-ip.html?utm_source=chatgpt.com "AWSConfigRemediation-DisableSubnetAutoAssignPublicIP"
+[3]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-disablepublicaccessforsecuritygroup.html?utm_source=chatgpt.com "AWS-DisablePublicAccessForSecurityGroup - AWS Documentation"
+[4]: https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-enableS3bucketencryption.html?utm_source=chatgpt.com "AWS-EnableS3BucketEncryption - AWS Systems Manager ..."

runbooks/remediation/README.md

@@ -0,0 +1,26 @@
+# Project Title
+
+## Description
+
+Resolve Dome 9 issues in Cloud accounts.
+
+## Installation
+
+### Prerequisites
+- Conda 
+
+### Steps
+
+1. Install conda and create a new environment
+2. Install the required packages using pip:
+```bash
+pip install -r requirements.txt
+```
+
+## Usage
+
+```bash
+python cli.py s3 list_buckets
+python cli.py s3 block_public_access
+python cli.py api_gateway list
+```

runbooks/remediation/Tests/update_policy.py

@@ -0,0 +1,74 @@
+import unittest
+
+from src.aws.lambda_list import update_policy_document
+
+
+class TestUpdatePolicyDocument(unittest.TestCase):
+    def test_update_policy_document_simple(self):
+        # Define a policy document for testing
+        policy_document = {
+            "policy1": {
+                "Statement": [
+                    {"Action": "*", "Resource": "arn:aws:cloudformation:*:*:*"},
+                    {"Action": "codepipeline:PutJobSuccessResult", "Resource": "*"},
+                ]
+            }
+        }
+
+        # Call the function with the test policy document
+        changes, new_policy_document = update_policy_document(policy_document)
+
+        # Define the expected results
+        expected_changes = {"policy1": ["cloudformation:*", "arn:aws:codepipeline:*:*:*"]}
+        expected_new_policy_document = {
+            "policy1": {
+                "Statement": [
+                    {"Action": "cloudformation:*", "Resource": "arn:aws:cloudformation:*:*:*"},
+                    {"Action": "codepipeline:PutJobSuccessResult", "Resource": "arn:aws:codepipeline:*:*:*"},
+                ]
+            }
+        }
+
+        # Assert that the function returns the expected results
+        self.assertEqual(changes, expected_changes)
+        self.assertEqual(new_policy_document, expected_new_policy_document)
+
+    def test_update_policy_document_no_change(self):
+        policy_document = {
+            "MeterWriteService-prod-lambda": {
+                "Version": "2012-10-17",
+                "Statement": [
+                    {
+                        "Action": ["cloudformation:Describe*"],
+                        "Resource": ["arn:aws:cloudformation:*:*:*"],
+                        "Effect": "Allow",
+                    },
+                    {
+                        "Action": [
+                            "codepipeline:PutJobSuccessResult",
+                            "codepipeline:PutJobFailureResult",
+                            "logs:CreateLogGroup",
+                            "logs:CreateLogStream",
+                            "logs:Describe*",
+                            "logs:PutLogEvents",
+                            "s3:List*",
+                        ],
+                        "Resource": ["arn:aws:codepipeline:*:*:*", "arn:aws:logs:*:*:*", "arn:aws:s3:::*"],
+                        "Effect": "Allow",
+                    },
+                    {
+                        "Action": ["s3:Get*", "s3:Put*"],
+                        "Resource": [
+                            "arn:aws:s3:::prod-meterwriteservice-cd-codepipelineartifactbuck-ueiwuorier",
+                            "arn:aws:s3:::prod-meterwriteservice-cd-codepipelineartifactbuck-ueiwuorier/*",
+                        ],
+                        "Effect": "Allow",
+                    },
+                ],
+            }
+        }
+
+        changes, new_policy_document = update_policy_document(policy_document)
+
+        expected_changes = {}
+        self.assertEqual(changes, expected_changes)

runbooks/remediation/__init__.py

@@ -0,0 +1,95 @@
+"""
+Enterprise AWS Remediation Module - Automated Security & Compliance Fixes
+
+The `runbooks.remediation` module provides enterprise-grade automated remediation
+capabilities for AWS security and compliance findings, completing the CloudOps
+automation lifecycle by bridging assessment findings to automated fixes.
+
+## CloudOps Automation Lifecycle
+
+1. **🔍 DISCOVER** (`runbooks.inventory`) - Multi-account resource discovery
+2. **📊 ASSESS** (`runbooks.security`, `runbooks.cfat`) - Security posture evaluation
+3. **🔧 REMEDIATE** (`runbooks.remediation`) - **Automated fix implementation**
+4. **⚙️ OPERATE** (`runbooks.operate`) - Ongoing resource lifecycle management
+
+## Core Capabilities
+
+### 🗄️ S3 Security & Compliance (9 Operations)
+- Public Access Control, Encryption Enforcement, Access Logging
+- Policy Enforcement, Configuration Auditing
+
+### 🖥️ EC2 & Networking Security (4 Operations)
+- Security Group Hardening, Network Security, Resource Cleanup
+- Compliance Automation
+
+### 🔐 Encryption & Key Management (2 Operations)
+- KMS Key Rotation, Database Encryption, Cross-Service Encryption
+
+### 🗃️ Database & Storage Security (4 Operations)
+- RDS Security, DynamoDB Optimization, Snapshot Management
+- Storage Compliance
+
+### ☁️ Serverless & API Security (4 Operations)
+- Lambda Security, API Gateway Hardening, Cognito Management
+- Serverless Compliance
+
+### 🏅 Certificate & Identity Management (6 Operations)
+- ACM Certificate Lifecycle Management, Cognito User Security
+- SSL/TLS Certificate Cleanup, User Authentication Controls
+
+### 📋 Audit & Monitoring (5 Operations)
+- CloudTrail Policy Analysis & Reversion, Resource Scanning
+- Workspace Management, Cross-Service Utilities
+
+Version: 0.7.6 - Enterprise Production Ready
+Compatibility: AWS SDK v3, Python 3.8+, Multi-deployment ready
+"""
+
+from runbooks.remediation.acm_remediation import ACMRemediation
+from runbooks.remediation.base import (
+    BaseRemediation,
+    ComplianceMapping,
+    RemediationContext,
+    RemediationResult,
+    RemediationStatus,
+)
+from runbooks.remediation.cloudtrail_remediation import CloudTrailRemediation
+from runbooks.remediation.cognito_remediation import CognitoRemediation
+from runbooks.remediation.dynamodb_remediation import DynamoDBRemediation
+from runbooks.remediation.ec2_remediation import EC2SecurityRemediation
+from runbooks.remediation.kms_remediation import KMSSecurityRemediation
+from runbooks.remediation.lambda_remediation import LambdaSecurityRemediation
+from runbooks.remediation.multi_account import MultiAccountRemediator
+from runbooks.remediation.rds_remediation import RDSSecurityRemediation
+
+# Import remediation operations
+from runbooks.remediation.s3_remediation import S3SecurityRemediation
+
+# Version info
+__version__ = "0.7.6"
+__author__ = "CloudOps Runbooks Team"
+
+# Public API exports
+__all__ = [
+    # Core architecture
+    "BaseRemediation",
+    "RemediationContext",
+    "RemediationResult",
+    "RemediationStatus",
+    "ComplianceMapping",
+    # Service-specific remediation
+    "S3SecurityRemediation",
+    "EC2SecurityRemediation",
+    "KMSSecurityRemediation",
+    "DynamoDBRemediation",
+    "RDSSecurityRemediation",
+    "LambdaSecurityRemediation",
+    "ACMRemediation",
+    "CognitoRemediation",
+    "CloudTrailRemediation",
+    # Enterprise features
+    "MultiAccountRemediator",
+    # Module metadata
+    "__version__",
+    "__author__",
+]