5.2

5.2 Run an AWS Config Rule auto remediation routine from AWS Console

@todo: FIX THIS

Review and ensure that you have setup your development environment before going through the steps below.

Autoremediate from the AWS Console

Create a Config Rule for eip-attached

1. Go to the AWS Config console.
2. Click the Add Rule button.
3. Type eip in the textbox and select eip-attached from the managed Config Rules.
4. Click Save.
5. Once saved, click the role and copy the Config rule ARN for later.

Create unattached Elastic IP Addresses

1. Go to the Elastic IPs within the EC2 console.
2. Click Allocate new address (and create a few of theses).
3. Choose from the Amazon pool and click Allocate.

View AWS Config Rules Dashboard

Config Console

Create an IAM Role with SSM Permissions

1. Go to AWS IAM.
2. Click on Roles.
3. Click Create role.
4. Select EC2 and click Next: Permissions.
5. Type SSM and choose the checkbox next to AmazonSSMAutomationRole and click Next: Tags.
6. Click Next: Review.
7. Type ccoa-ssm-role for the Role name and click Create role.
8. Select the role and copy the Role ARN to use later.
9. Add two inline policies:

ReleaseElasticIPPermissions

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "ec2:ReleaseAddress",
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "ReleaseElasticIPPermissions"
        }
    ]
}

passRole

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::ACCOUNTID:role/ccoa-ssm-role",
            "Effect": "Allow"
        }
    ]
}

Event Pattern

Create a CloudWatch Event Rule

1. Go to Amazon CloudWatch.
2. Click on Rules.
3. Click on Add Rule.

Event Pattern

{
  "detail-type": [
    "Config Rules Compliance Change"
  ],
  "source": [
    "aws.config"
  ],
  "detail": {
    "configRuleARN": [
      "arn:aws:config:us-east-1:ACCOUNTID:config-rule/config-rule-abcdef"
    ],
    "newEvaluationResult": {
      "complianceType": [
        "NON_COMPLIANT"
      ]
    }
  }
}

Targets

1. SSM Automation
2. AWS-ReleaseElasticIP
3. Input Transformer

{"eip_allocid":"$.detail.resourceId"}

{"AllocationId":[<eip_allocid>],"AutomationAssumeRole":["arn:aws:iam::ACCOUNTID:role/ccoa-ssm-role"]}

4. Use existing role (and use the role you created).
5. ccoa-cwe-eip-rule

Cleanup

Go to Cleanup to remove any resources you created in this sublesson.