Easily Transform Compliance to Code using AWS Config, Config Rules, and the Rules Development Kit

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Raisa Hashem
Easily Transform Compliance to Code
using AWS Config, Config Rules, and the
Rules Development Kit
August 2018

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential and Trademark
Key Takeaways
• Learn AWS Config and Config Rules Concepts
• Understand best practice and concepts on Behaviour Driven Development
for config rules
• Learn to develop lambda functions for config rules in python using the
Rules Development Kit (RDK)
• Discover how to securely set up your environment for deployments

Scale consistently
to all workloads
Focus time and
resources on value
Part of
day-to-day
Expertise is not
given to all
Time-consuming
for everyone
Get-ready-for-
the-audit
mindset
Traditional
Compliance
Continuous
Compliance

Compliance-as-Code
Introduction to AWS Config and Config Rules

AWS Config Concepts
AWS Config

AWS Config Concepts
AWS Config
Configuration ItemsConfiguration
Recorder
EC2 CloudTrail S3
…(Others)

AWS Config Concepts
EC2 CloudTrail S3
…(Others)
AWS Config
Configuration Items
22 services, 60+ resources types
Configuration
Recorder

AWS Config Concepts
EC2 CloudTrail S3
…(Others)
AWS Config
Configuration
Recorder
Delivery
Channel
Configuration
Snapshots
Configuration Items

AWS Config Rules
EC2 CloudTrail S3
…(Others)
AWS Config
Configuration
Recorder
Delivery
Channel
Configuration
Snapshots Rules
Rule 1 on AWS::CloudTrail::Trail
Rule 2 on AWS::S3::Bucket
Rule 3 on AWS::EC2::InternetGateway
Configuration Items

AWS Config Rules
EC2 CloudTrail S3
…(Others)
AWS Config
Configuration
Recorder
Delivery
Channel
Configuration
Snapshots Rules
Rule 1 on AWS::CloudTrail::Trail
Rule 2 on AWS::S3::Bucket
Rule 3 on AWS::EC2::InternetGateway
Managed Rules – 60+ out-of-the-box rules
Configuration Items

Rules Receive Configuration Item in JSON
"configurationItemVersion": "1.0",
"configurationItemCaptureTime": "2017…",
"configurationStateID": “….",
"configurationItemStatus": "OK",
"resourceId": "vol-ce676ccc",
"arn": "arn:aws:us-west-………",
"accountId": "123456789012",
"availibilityZone": "us-west-2b",
"resourceType": "AWS::EC2::Volume",
"resourceCreationTime": "2014-02..",
"tags": {},
"relationships": [
{
"resourceId": "i-344c463d",
"resourceType": "AWS::EC2::Instance",
"name": "Attached to Instance"
}
],
"relatedEvents": [
"06c12a39-eb35-11de-ae07-db69edbb1e4",
],
Metadata
Common Attributes
Related Events
Relationships

Rules Receive Configuration Item in JSON
"configuration": {
"volumeId": "vol-ce676ccc",
"size": 1,
"snapshotId": "",
"availabilityZone": "us-west-2b",
"state": "in-use",
"createTime": "2017-02-……",
"attachments": [
{
"volumeId": "vol-ce676ccc",
"instanceId": "i-344c463d",
"device": "/dev/sdf",
"state": "attached",
"attachTime": "2014-03-",
"deleteOnTermination": false
}
],
"tags": [
{
"tagName": "environment",
"tagValue": "PROD"
}
],
"volumeType": "standard"
}
Current
Configuration

Compliance-as-Code using Config Rules
Rules
Managed
Rules
AWS Config
send the
configuration item
Snapshot – 22 services,
60+ resources types
EC2 CloudTrail S3
…
(Others)
Custom Rules
Managed Rules
1 Lambda function
per custom Rule
Run
Send the configuration item
Send the parameters
Read additional configuration(s)
via describe() call
Report the result
via PutEvaluation()

Compliance-as-Code using Config Rules
Rules
Managed
Rules
AWS Config
Change Triggers
send the
configuration item
EC2 CloudTrail S3
…
(Others)
Custom Rules
Managed Rules
1 Lambda function
per custom Rule
Run
Send the configuration item
Send the parameters
Read additional configuration(s)
via describe() call
Report the result
via PutEvaluation()
Time Triggers
No configuration
item is sent
Snapshot – 22 services,
60+ resources types

Lambda Event Provided by Config Rules
{
"invokingEvent": {
"configurationItem": {
"configurationItemCaptureTime": "2016-02-17T01:36:34.043Z",
"awsAccountId": "123456789012",
"configurationItemStatus": "OK",
…
},
"messageType": "ConfigurationItemChangeNotification"
},
"ruleParameters": {
"myParameterKey1": "myParameterValue1",
"myParameterKey2": "myParameterValue2"
},
"resultToken": "myResultToken",
"eventLeftScope": false,
"executionRoleArn": "arn:aws:iam::123456789012:role/config-role",
"configRuleArn": "arn:aws:config:us-east-2:123456789012:config-rule/config-rule-0123456",
"configRuleName": "change-triggered-config-rule",
"configRuleId": "config-rule-0123456",
"accountId": "123456789012",
"version": "1.0"
}

Choosing the right trigger(s)
Use Case Recommendation
AWS Config is tracking this resource type. Configuration change
AWS Config is not tracking this resource. Periodic
AWS Config is tracking this resource, and time
matters.
Configuration change
and Periodic

Designing Custom Config Rules
Behaviour Driven Security Development

Define the Use Case and Test Cases
Gherkin-like documentation!
Feature: Some terse yet descriptive text of what is desired
Scenario: Some determinable business situation
Given some precondition
And some other precondition
Then some testable outcome is achieved
Scenario: A different situation
...

Writing Test Cases 101
1. Cover all permutations of inputs
2. Keep distinct coverage in the test cases
3. Keep in mind that humans need to fix it (initially)
4. A reasoning approach is the future, and the future is now

Example
Write a rule checking for MFA on an IAM user

Scenarios for Rule IAM_User_MFA_Enabled
Feature:
In order to: enforce strong authentication
As: a security Officer
I want: to ensure that IAM users have MFA configured, except if whitelisted
Scenarios:
Scenario 1:
Given: WhitelistedUserList is configured
And: The IAM User’s UniqueID is listed in WhitelistedUserList
Then: Return COMPLIANT
Scenario 2:
And: The IAM User’s UniqueID is not listed in WhitelistedUserList
And: The IAM User has MFA attached

Scenarios for Rule IAM_User_MFA_Enabled Continued…
Scenario 3:
And: The IAM User’s UniqueID is not listed in WhitelistedUserList
And: The IAM User has no MFA attached
Then: Return NON_COMPLIANT
Scenario 4:
Given: WhitelistedUserList is not configured
And: The IAM User has MFA attached
Scenario 5:
Given: WhitelistedUserList is not configured
And: The IAM User has no MFA attached
Then: Return NON_COMPLIANT

Building a Custom Config Rule
Diving into the code

Introducing the Rule Development Kit (RDK)
The fastest way to develop, and easiest way to test custom
AWS Config Rules
Designed to support your first Config Rule, enterprise-grade
Rule development, and CI/CD pipelines.
Open source software, maintained by AWS. Documentation and contributions
at https://github.com/awslabs/aws-config-rdk
$ pip install rdkEasy install via pip:

Deploy
Debug
Write
Tests
Write
Code
Test
Setup
Enables a Natural Development Workflow for Config Rules

Before coding…
Element Decision
Goal Define what you want to do: use cases, test cases.
Scope and trigger
Define a trigger: on change, on time, or both.
Define what you want to track.
Parameters
Define the parameters.
Decide whether a parameter is optional or mandatory.
Evaluation Define on which resource type you want to report.

Before coding…
Element Decision
Goal Stated in Gherkin-like documentation
Scope and trigger
Trigger: change
Scope: AWS::IAM::User
Parameters
Parameters: WhitelistedUserList
Mandatory or Optional: optional
Evaluation Resource type: AWS::IAM::User

Demo - RDK

IAM_User_MFA_Enabled Custom Rule
Writing test cases

config_client_mock = MagicMock()
sts_client_mock = MagicMock()
iam_client_mock = MagicMock()
def build_invoking_event(configurationItemStatus, userName, userId):
return json.dumps({
"configurationItemDiff":"SomeDifference",
"notificationCreationTime":"SomeTime",
"messageType": "ConfigurationItemChangeNotification",
"recordVersion":"SomeVersion",
"configurationItem":{
"resourceType":"AWS::IAM::User",
"resourceName": userName,
"configurationItemStatus":configurationItemStatus,
"resourceId": userId,
"configurationItemCaptureTime":"2018-02-20T06:56:55.533Z",
"configuration":{
"userName": userName,
"userId": userId
}
}
})
Build the invoking event with the Configuration Item:

class Scenario_1_TestWhitelistedUser(unittest.TestCase):
def test_Scenario_1_user_is_whitelisted(self):
ruleParam = '{ "WhitelistedUserList" : "AIDAIDFOUX2OSRO6DO7XM, AIDAIDFOUX2OSRO6DO7XN"}'
invokingEvent = build_invoking_event("ResourceDiscovered", "Testuser",
"AIDAIDFOUX2OSRO6DO7XN")
lambda_event = build_lambda_configurationchange_event(invoking_event=invokingEvent,
rule_parameters=ruleParam)
response = rule.lambda_handler(lambda_event, {})
resp_expected = []
resp_expected.append(build_expected_response('COMPLIANT', 'AIDAIDFOUX2OSRO6DO7XN'))
assert_successful_evaluation(self, response, resp_expected)
Define each test case based on Gherkin scenarios:

class Scenario_2_to_5_TestMFA(unittest.TestCase):
def constructMFADeviceList(self,UserName):
deviceList = { 'MFADevices': [{'UserName': 'CompliantUser', 'SerialNumber': 'ARN:IAM'}]}
return deviceList
def test_Scenario_2_Compliant_User(self):
iam_client_mock.list_mfa_devices = MagicMock(side_effect=self.constructMFADeviceList)
ruleParam = '{ "WhitelistedUserList" : "AIDAICVB3PKAQMPEGDW2C"}'
invokingEvent=build_invoking_event("ResourceDiscovered", "compliantUser",
"AIDAIDFOUX2OSRO6DO7XM")
response = rule.lambda_handler(lambda_event, {})
resp_expected = []
resp_expected.append(build_expected_response('COMPLIANT', 'AIDAIDFOUX2OSRO6DO7XM'))
assert_successful_evaluation(self, response, resp_expected, 1)

def test_Scenario_3_Non_Compliant_User(self):
iam_client_mock.list_mfa_devices = MagicMock(return_value={"MFADevices":[]})
ruleParam = '{ "WhitelistedUserList" : "AIDAICVB3PKAQMPEGDW2C"}'
invokingEvent=build_invoking_event("ResourceDiscovered", "nonCompliantUser",
response = rule.lambda_handler(lambda_event,{})
resp_expected = []
resp_expected.append(build_expected_response('NON_COMPLIANT', 'AIDAIDFOUX2OSRO6DO7XM’,
annotation='No MFA Device detected'))
def test_Scenario_4_Compliant_User(self):
iam_client_mock.list_mfa_devices = MagicMock(side_effect=self.constructMFADeviceList)
invokingEvent=build_invoking_event("ResourceDiscovered", "compliantUser",
lambda_event = build_lambda_configurationchange_event(invoking_event=invokingEvent)
resp_expected = []
resp_expected.append(build_expected_response('COMPLIANT', 'AIDAIDFOUX2OSRO6DO7XM'))

def test_Scenario_5_Non_Compliant_User(self):
iam_client_mock.list_mfa_devices = MagicMock(return_value={"MFADevices":[]})
invokingEvent=build_invoking_event("ResourceDiscovered", "nonCompliantUser",
lambda_event = build_lambda_configurationchange_event(invoking_event=invokingEvent)
resp_expected = []
resp_expected.append(build_expected_response('NON_COMPLIANT', 'AIDAIDFOUX2OSRO6DO7XM’,
annotation='No MFA Device detected'))

IAM_User_MFA_Enabled Custom Rule
Writing the rule

def evaluate_compliance(event, configuration_item, valid_rule_parameters):
###############################
# Add your custom logic here. #
###############################
iam_user_name = configuration_item["resourceName"]
iam_user_id = configuration_item["resourceId"]
if ”WhitelistedUserList" in valid_rule_parameters:
if iam_user_id in valid_rule_parameters[”WhitelistedUserList"].split(","):
return build_evaluation_from_config_item(configuration_item, "COMPLIANT",
"User is whitelisted")
iam_client = get_client("iam", event)
result = iam_client.list_mfa_devices(UserName=iam_user_name)
if result["MFADevices"]:
return build_evaluation_from_config_item(configuration_item, "COMPLIANT")
return build_evaluation_from_config_item(configuration_item, "NON_COMPLIANT", "No
MFA Device detected")
Define rule logic:

def evaluate_parameters(rule_parameters):
if WhitelistedUserList' in rule_parameters:
for user_id in rule_parameters['whitelist'].split(","):
if not user_id.isalnum():
raise ValueError("User ID's should be alphanumeric.")
if not user_id.startswith("AIDA"):
raise ValueError("User ID's should start with the string 'AIDA'")
valid_rule_parameters = rule_parameters
return valid_rule_parameters
Validate parameter:

Demo – Config Rule Deploy

Secure Multi-account Deployments
Account Structure, IAM Roles, and Deployment Methods

Multi-Account Structure for Secure Deployment
SecOps Publisher Account App Account A
App Account B
Rule X Lambda
Function
Rule Y Lambda
Function
Config
Rule X
Config
Rule Y
Config
Rule X
Config
Rule Y

Cross-Account IAM Roles
App Account B
Rule X Lambda
Function
Rule Y Lambda
Function
Lambda
Role
Config
Service Role
Config
Service Role
Config
Rule X
Config
Rule Y
Config
Rule X
Config
Rule Y

Cross-Account IAM Roles
App Account B
Rule X Lambda
Function
Rule Y Lambda
Function
Lambda
Role
Config
Service Role
Config
Service Role
Config
Rule X
Config
Rule Y
Config
Rule X
Config
Rule Y
"s3:PutObject*”,
"sns:Publish”,
"config:Put*",
"config:Get*",
"config:List*",
"config:Describe*"
Permissions
include List and
describe resources
along with:

Deployment Using Cloudformation Stacksets
App Account B
Rule X Lambda
Function
Rule Y Lambda
Function
Lambda
Role
Config
Service Role
Config
Service Role
Config
Rule X
Config
Rule Y
Config
Rule X
Config
Rule Y
Rule X Stackset
Rule Y Stackset
Stackset
Admin
Role

Deployment Using Cloudformation Stacksets
App Account B
Rule X Lambda
Function
Rule Y Lambda
Function
Lambda
Role
Config
Service Role
Config
Service Role
Config
Rule X
Config
Rule Y
Config
Rule X
Config
Rule Y
Rule X Stackset
Rule Y Stackset
Stackset
Admin
Role
Stackset
Execution
Role
Stackset
Execution
Role

Continuous Compliance
Design
Build & Test
DeployAnalyse
Respond
Security
Requirements

Summary
• Use AWS Config and Custom Config Rules to transform your compliance
to code
• Implement Behaviour Driven Development to help easily define business
requirements as security controls
• Fast-track Config Rules development using the Rules Development Kit
(RDK)
• Isolate Config Rule Lambda functions in a SecOps Account for secure
scaled deployments

Q&APresenter: Raisa Hashem
Q&A Speaker: Aparna Elangovan, Paul Hawkins
Thank you!

Easily Transform Compliance to Code using AWS Config, Config Rules, and the Rules Development Kit

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Easily Transform Compliance to Code using AWS Config, Config Rules, and the Rules Development Kit

Similar to Easily Transform Compliance to Code using AWS Config, Config Rules, and the Rules Development Kit (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Easily Transform Compliance to Code using AWS Config, Config Rules, and the Rules Development Kit