5.2

5.2 Run an AWS Config Rule auto remediation routine from AWS Console

Review and ensure that you have setup your development environment before going through the steps below.

Autoremediate from the AWS Console

Create a Config Rule for eip-attached

1. Go to the AWS Config console.
2. Click the Add Rule button.
3. Type eip in the textbox and select eip-attached from the managed Config Rules.
4. Click Save.
5. Once saved, click the role and copy the Config rule ARN for later.

Create unattached Elastic IP Addresses

1. Go to the Elastic IPs within the EC2 console.
2. Click Allocate new address (and create a few of these).
3. Choose from the Amazon pool and click Allocate.

View AWS Config Rules Dashboard

Config Console

Create an IAM Role with SSM Permissions

1. Go to AWS IAM.
2. Click on Roles.
3. Click Create role.
4. Select EC2 and click Next: Permissions.
5. Type SSM and choose the checkbox next to AmazonSSMAutomationRole and click Next: Tags.
6. Click Next: Review.
7. Type ccoa-5-ssm-role for the Role name and click Create role.

Edit the Trust Relationship

1. From the AWS IAM console, select Roles
2. Select the ccoa-5-ssm-role IAM Role you just created.
3. Click the Trust relationships tab.
4. Click the Edit Trust Relationship button
5. Paste the contents from below into the text area to add events and ssm as trusted entities.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "ssm.amazonaws.com",
          "ec2.amazonaws.com",
          "events.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

1. Click the Update Trust Policy button.
2. Click on the Permissions tab.
3. Click on the Add inline policy link.
4. Click on the JSON tab and replace the text area with the contents below (replacing ACCOUNTID with your AWS Account Id).

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::ACCOUNTID:role/ccoa-mon-role",
            "Effect": "Allow"
        }
    ]
}

1. Click the Review Policy button.
2. Enter the name passAutomationRole and click the Save changes* button.
3. Click on the Permissions tab again.
4. Click on the Add inline policy link.
5. Click on the JSON tab and replace the text area with the contents below (replacing ACCOUNTID with your AWS Account Id).

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "ec2:ReleaseAddress",
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "ReleaseElasticIPPermissions"
        }
    ]
}

1. Click the Review Policy* button.
2. Enter the name ReleaseElasticIPPermissions and click the Save changes* button.
3. Select the role and copy the Role ARN to use later.

Event Pattern

Create a CloudWatch Event Rule

1. Go to Amazon CloudWatch.
2. Click on Rules.
3. Click the Create Rule button.
4. With the Event Pattern radio button selected, click on the Edit link.
5. Paste the contents below replacing the value of configRuleARN with the Config Rule ARN you saved when creating your Config Rule. If you do not recall the name, go back to AWS Config, select Rules, select the rule you created, and copy the value for Config rule ARN.

{
  "detail-type": [
    "Config Rules Compliance Change"
  ],
  "source": [
    "aws.config"
  ],
  "detail": {
    "configRuleARN": [
      "arn:aws:config:us-east-1:ACCOUNTID:config-rule/config-rule-abcdef"
    ],
    "newEvaluationResult": {
      "complianceType": [
        "NON_COMPLIANT"
      ]
    }
  }
}

1. In the Targets area, choose SSM Automation.
2. For the Document, choose AWS-ReleaseElasticIP.
3. Choose Input Transformer and paste the following in the first text field:

{"eipalloc":"$.detail.resourceId"}

4. Then, paste the following in the next text field (replacing with your ACCOUNTID):

{"AllocationId":[<eipalloc>],"AutomationAssumeRole":["arn:aws:iam::ACCOUNTID:role/ccoa-5-ssm-role"]}

5. Enter ccoa-6-cwe-eip-rule for your CloudWatch Event Rule and click Save

Additional Resources

Command to get SSM Documentation Information to use in CWE Targets

aws ssm describe-document --name "AWS-ReleaseElasticIP"

Cleanup

Go to Cleanup to remove any resources you created in this sublesson.