cfn-global.yml

AWSTemplateFormatVersion: "2010-09-09"
Transform: "AWS::Serverless-2016-10-31"
Description: aws-security-survival-kit alerting - global events - https://zoph.io
###########################################################
Parameters:
  ###########################################################
  AlarmRecipient:
    Type: String
    AllowedPattern: "^[\\x20-\\x45]?[\\w-\\+]+(\\.[\\w]+)*@[\\w-]+(\\.[\\w]+)*(\\.[a-z]{2,})$"
    ConstraintDescription: Email address required.
    Description: Alarm recipient email address
  Project:
    Type: String
    Description: Project Name
###############################################################################

###########################################################
Resources:
  ###########################################################

  EventsRuleRootSignIn:
    Type: AWS::Events::Rule
    Properties:
      Description: !Sub "[${Project}] Monitor root AWS Console sign-in events"
      EventPattern:
        detail-type:
          - AWS Console Sign In via CloudTrail
        detail:
          userIdentity:
            type:
              - Root
      Name:
        Fn::Sub: "${AWS::StackName}-RootActivityRule"
      State: ENABLED
      Targets:
        - Arn:
            Ref: CtAlertingTopic
          Id: CtAlertingTopic
          InputTransformer:
            InputPathsMap:
              EventId: "$.id"
              EventTime: "$.detail.eventTime"
              EventName: "$.detail.eventName"
              EventAccountId: "$.account"
              EventSourceIp: "$.detail.sourceIPAddress"
              EventRegion: "$.region"
              EventBlame: "$.detail.userIdentity.principalId"
              EventBlameDetails: "$.detail.userIdentity.sessionContext.sessionIssuer.userName"
            # Doc: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-rule-inputtransformer.html
            InputTemplate: |
              {
                "🆔 EventId": <EventId>,
                "🕑 EventTime": <EventTime>,
                "👉 EventName": <EventName>,
                "🧾 EventAccountId": <EventAccountId>,
                "🌐 EventSourceIp": <EventSourceIp>,
                "🌏 EventRegion": <EventRegion>,
                "👨‍🏭 EventBlame": <EventBlame>,
                "📃 EventBlameDetails": <EventBlameDetails>
              }

  EventRuleCTChange:
    Type: "AWS::Events::Rule"
    Properties:
      Name: !Sub "${Project}-detect-cloudtrail-changes-global"
      Description: !Sub "[${Project}] Monitor change on CloudTrail setup"
      State: "ENABLED"
      Targets:
        - Arn:
            Ref: CtAlertingTopic
          Id: CtAlertingTopic
          InputTransformer:
            InputPathsMap:
              EventId: "$.id"
              EventTime: "$.detail.eventTime"
              EventName: "$.detail.eventName"
              EventAccountId: "$.account"
              EventSourceIp: "$.detail.sourceIPAddress"
              EventRegion: "$.region"
              EventBlame: "$.detail.userIdentity.principalId"
              EventBlameDetails: "$.detail.userIdentity.sessionContext.sessionIssuer.userName"
            # Doc: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-rule-inputtransformer.html
            InputTemplate: |
              {
                "🆔 EventId": <EventId>,
                "🕑 EventTime": <EventTime>,
                "👉 EventName": <EventName>,
                "🧾 EventAccountId": <EventAccountId>,
                "🌐 EventSourceIp": <EventSourceIp>,
                "🌏 EventRegion": <EventRegion>,
                "👨‍🏭 EventBlame": <EventBlame>,
                "📃 EventBlameDetails": <EventBlameDetails>
              }
      EventPattern:
        detail-type:
          - "AWS API Call via CloudTrail"
        detail:
          eventSource:
            - "cloudtrail.amazonaws.com"
          eventName:
            - "StopLogging"
            - "DeleteTrail"
            - "UpdateTrail"

  EventRuleHealth:
    Type: "AWS::Events::Rule"
    Properties:
      Name: !Sub "${Project}-detect-aws-health-events"
      Description: !Sub "[${Project}] Monitor AWS Health Dashboard events"
      State: "ENABLED"
      Targets:
        - Arn:
            Ref: CtAlertingTopic
          Id: CtAlertingTopic
          InputTransformer:
            InputPathsMap:
              EventId: "$.id"
              EventTime: "$.detail.lastUpdatedTime"
              EventName: "$.detail.eventTypeCode"
              EventAccountId: "$.account"
              EventRegion: "$.detail.eventRegion"
              EventDescription: "$.detail.eventDescription[0].latestDescription"
              Service: "$.detail.service"
              StatusCode: "$.detail.statusCode"
            # Doc: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-rule-inputtransformer.html
            InputTemplate: |
              {
                "🆔 EventId": <EventId>,
                "🕑 EventTime": <EventTime>,
                "👉 EventName": <EventName>,
                "🧾 EventAccountId": <EventAccountId>,
                "🌏 EventRegion": <EventRegion>,
                "📄 EventDescription": <EventDescription>,
                "🔧 Service": <Service>,
                "⚠️ StatusCode": <StatusCode>
              }
      EventPattern:
        detail-type:
          - "AWS Health Event"
        source:
          - "aws.health"

  EventRuleIAMUsers:
    Type: "AWS::Events::Rule"
    Properties:
      Name: !Sub "${Project}-detect-iam-user-changes"
      Description: !Sub "[${Project}] Monitor IAM Users changes"
      State: "ENABLED"
      Targets:
        - Arn:
            Ref: CtAlertingTopic
          Id: CtAlertingTopic
          InputTransformer:
            InputPathsMap:
              EventId: "$.id"
              EventTime: "$.detail.eventTime"
              EventName: "$.detail.eventName"
              EventAccountId: "$.account"
              EventSourceIp: "$.detail.sourceIPAddress"
              EventRegion: "$.region"
              EventBlame: "$.detail.userIdentity.principalId"
              EventBlameDetails: "$.detail.userIdentity.sessionContext.sessionIssuer.userName"
            # Doc: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-rule-inputtransformer.html
            InputTemplate: |
              {
                "🆔 EventId": <EventId>,
                "🕑 EventTime": <EventTime>,
                "👉 EventName": <EventName>,
                "🧾 EventAccountId": <EventAccountId>,
                "🌐 EventSourceIp": <EventSourceIp>,
                "🌏 EventRegion": <EventRegion>,
                "👨‍🏭 EventBlame": <EventBlame>,
                "📃 EventBlameDetails": <EventBlameDetails>
              }
      EventPattern:
        detail-type:
          - "AWS API Call via CloudTrail"
        detail:
          eventSource:
            - "iam.amazonaws.com"
          eventName:
            - "AddUserToGroup"
            - "ChangePassword"
            - "CreateAccessKey"
            - "DeleteAccessKey"
            - "CreateUser"
            - "DeleteUser"
            - "UpdateAccessKey"
            - "UpdateGroup"
            - "UpdateUser"
            - "AttachGroupPolicy"
            - "AttachUserPolicy"
            - "DeleteUserPolicy"
            - "DetachGroupPolicy"
            - "DetachUserPolicy"
            - "PutUserPolicy"

  EventRuleMFAChanges:
    Type: "AWS::Events::Rule"
    Properties:
      Name: !Sub "${Project}-detect-iam-mfa-changes"
      Description: !Sub "[${Project}] Monitor MFA Changes"
      State: "ENABLED"
      Targets:
        - Arn:
            Ref: CtAlertingTopic
          Id: CtAlertingTopic
          InputTransformer:
            InputPathsMap:
              EventId: "$.id"
              EventTime: "$.detail.eventTime"
              EventName: "$.detail.eventName"
              EventAccountId: "$.account"
              EventSourceIp: "$.detail.sourceIPAddress"
              EventRegion: "$.region"
              EventBlame: "$.detail.userIdentity.principalId"
              EventBlameDetails: "$.detail.userIdentity.sessionContext.sessionIssuer.userName"
            # Doc: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-events-rule-inputtransformer.html
            InputTemplate: |
              {
                "🆔 EventId": <EventId>,
                "🕑 EventTime": <EventTime>,
                "👉 EventName": <EventName>,
                "🧾 EventAccountId": <EventAccountId>,
                "🌐 EventSourceIp": <EventSourceIp>,
                "🌏 EventRegion": <EventRegion>,
                "👨‍🏭 EventBlame": <EventBlame>,
                "📃 EventBlameDetails": <EventBlameDetails>
              }
      EventPattern:
        detail-type:
          - "AWS API Call via CloudTrail"
        detail:
          eventSource:
            - "iam.amazonaws.com"
          eventName:
            - "CreateVirtualMFADevice"
            - "DeactivateMFADevice"
            - "DeleteVirtualMFADevice"
            - "EnableMFADevice"
            - "ResyncMFADevice"

  EventRuleAdminPolicyAttachment:
    Type: "AWS::Events::Rule"
    Properties:
      Name: !Sub "${Project}-detect-admin-policy-attachment"
      Description: !Sub "[${Project}] Monitor AdministratorAccess policy attachments to roles, users, and groups"
      State: "ENABLED"
      Targets:
        - Arn:
            Ref: CtAlertingTopic
          Id: CtAlertingTopic
          InputTransformer:
            InputPathsMap:
              EventId: "$.id"
              EventTime: "$.detail.eventTime"
              EventName: "$.detail.eventName"
              EventAccountId: "$.account"
              EventSourceIp: "$.detail.sourceIPAddress"
              EventRegion: "$.region"
              EventBlame: "$.detail.userIdentity.principalId"
              EventBlameDetails: "$.detail.userIdentity.sessionContext.sessionIssuer.userName"
              PolicyArn: "$.detail.requestParameters.policyArn"
              RoleName: "$.detail.requestParameters.roleName"
              UserName: "$.detail.requestParameters.userName"
              GroupName: "$.detail.requestParameters.groupName"
            InputTemplate: |
              {
                "🆔 EventId": <EventId>,
                "🕑 EventTime": <EventTime>,
                "👉 EventName": <EventName>,
                "🧾 EventAccountId": <EventAccountId>,
                "🌐 EventSourceIp": <EventSourceIp>,
                "🌏 EventRegion": <EventRegion>,
                "👨‍🏭 EventBlame": <EventBlame>,
                "📃 EventBlameDetails": <EventBlameDetails>,
                "📜 PolicyArn": <PolicyArn>,
                "👤 Principal (Role)": <RoleName>,
                "👤 Principal (User)": <UserName>,
                "👤 Principal (Group)": <GroupName>
              }
      EventPattern:
        detail-type:
          - "AWS API Call via CloudTrail"
        detail:
          eventSource:
            - "iam.amazonaws.com"
          eventName:
            - "AttachRolePolicy"
            - "AttachUserPolicy"
            - "AttachGroupPolicy"
          requestParameters:
            policyArn:
              - "arn:aws:iam::aws:policy/AdministratorAccess"

  CtAlertingTopic:
    # https://aws.amazon.com/premiumsupport/knowledge-center/cloudwatch-receive-sns-for-alarm-trigger/
    Type: "AWS::SNS::Topic"
    Properties:
      DisplayName: !Sub "[${AWS::AccountId}] Security Alarm"
      TopicName: !Sub "${Project}-alarm-topic-${AWS::Region}-global"
      Subscription:
        - Protocol: email
          Endpoint: !Ref AlarmRecipient
      Tags:
        - Key: "Project"
          Value: !Ref Project

  SnsTopicPolicy:
    Type: "AWS::SNS::TopicPolicy"
    Properties:
      PolicyDocument:
        Statement:
          - Sid: "__default_statement_ID"
            Effect: "Allow"
            Principal:
              AWS: "*"
            Action:
              - "sns:GetTopicAttributes"
              - "sns:SetTopicAttributes"
              - "sns:AddPermission"
              - "sns:RemovePermission"
              - "sns:DeleteTopic"
              - "sns:Subscribe"
              - "sns:ListSubscriptionsByTopic"
              - "sns:Publish"
              - "sns:Receive"
            Resource:
              Ref: CtAlertingTopic
            Condition:
              StringEquals:
                AWS:SourceOwner:
                  Ref: "AWS::AccountId"
          - Sid: "CWEvents"
            Effect: "Allow"
            Principal:
              Service: "events.amazonaws.com"
            Action: "sns:Publish"
            Resource:
              Ref: CtAlertingTopic
      Topics:
        - Ref: CtAlertingTopic

  Dashboard:
    Type: AWS::CloudWatch::Dashboard
    Properties:
      DashboardName: !Sub "AWS-Security-Survival-Kit-Dashboard-Global"
      DashboardBody: !Sub |
        {
          "widgets": [
            {
              "height": 6,
              "width": 24,
              "y": 0,
              "x": 0,
              "type": "metric",
              "properties": {
                "metrics": [
                  [ { "expression": "SEARCH('{AWS/Events,RuleName} MetricName=\"Invocations\"', 'Sum', 300)", "label": "EventBridge Rules Invocations", "id": "e1" } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "us-east-1",
                "title": "Security Events Overview",
                "period": 300,
                "stat": "Sum"
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 6,
              "x": 0,
              "type": "metric",
              "properties": {
                "metrics": [
                  [ "AWS/Events", "Invocations", "RuleName", "${AWS::StackName}-RootActivityRule", { "stat": "Sum", "period": 300 } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "us-east-1",
                "title": "Root Account Activity",
                "period": 300
              }
            },
            {
              "height": 6,
              "width": 12,
              "y": 6,
              "x": 12,
              "type": "metric",
              "properties": {
                "metrics": [
                  [ "AWS/Events", "Invocations", "RuleName", "${Project}-detect-iam-user-changes", { "stat": "Sum", "period": 300 } ],
                  [ "AWS/Events", "Invocations", "RuleName", "${Project}-detect-iam-mfa-changes", { "stat": "Sum", "period": 300 } ],
                  [ "AWS/Events", "Invocations", "RuleName", "${Project}-detect-admin-policy-attachment", { "stat": "Sum", "period": 300 } ]
                ],
                "view": "timeSeries",
                "stacked": false,
                "region": "us-east-1",
                "title": "IAM Changes",
                "period": 300
              }
            }
          ]
        }