Draft for checking listener ssl policy on ALB #100

takahashi9854 · 2018-09-11T04:54:55Z

I confirm these files are made available under CC0 1.0 Universal (https://creativecommons.org/publicdomain/zero/1.0/legalcode)

Issue #, if available:

Description of changes:

python/alb_ssl_policy.py

jongogogo · 2018-09-11T06:42:47Z

python/alb_ssl_policy.py

+	listeners = alb_client.describe_listeners( LoadBalancerArns = [alb_arn,], )
+
+	for l in listeners['Listeners']:
+		if ( 'SslPolicy' in l.keys()):


external parenthesis can be removed

removed parenthesis.

jongogogo · 2018-09-11T06:42:59Z

python/alb_ssl_policy.py

+	alb_arn = configuration_item['arn']
+	alb_client = get_client('elbv2',event);
+
+	listeners = alb_client.describe_listeners( LoadBalancerArns = [alb_arn,], )


Remove comma at the end

removed comma.

jongogogo · 2018-09-11T06:43:07Z

python/alb_ssl_policy.py

+    ###############################
+
+	alb_arn = configuration_item['arn']
+	alb_client = get_client('elbv2',event);


Remove ; at the end

space between comma and variable

removed comma and add space between comma and variable.

jongogogo · 2018-09-11T06:44:42Z

python/alb_ssl_policy.py

+
+	for l in listeners['Listeners']:
+		if ( 'SslPolicy' in l.keys()):
+			if(l['SslPolicy'] not in COMPLIANT_POLICY):


should be

if l['SslPolicy'] not in validated_rule_parameters['ValidPolicies']:

jongogogo · 2018-09-11T06:48:43Z

python/alb_ssl_policy.py

+Feature:
+  In order to: apply ssl policy to listers
+  As: a Security Officer
+  I want: to chaging configuration of applicatio loac balancer.


several typo in this sections

jongogogo · 2018-09-11T06:48:56Z

python/alb_ssl_policy.py

+     Then: Return COMPLIANT
+  Scenario 2:
+    Given: SslPolicy is not in COMPLIANT_POLICY
+     THEN: RETURN NON_COMPLIANT


return NON_COMPLAINT

jongogogo · 2018-09-11T06:49:22Z

python/alb_ssl_policy.py

+  As: a Security Officer
+  I want: to chaging configuration of applicatio loac balancer.
+Scenarios:
+  Scenario 1:


Add a scenario if no CompliantPolicies

jongogogo · 2018-09-11T06:49:52Z

python/alb_ssl_policy.py

+
+	listeners = alb_client.describe_listeners( LoadBalancerArns = [alb_arn,], )
+
+	for l in listeners['Listeners']:


What if no listeners?

python/alb_ssl_policy.py

jongogogo

Change the name of the parameter

jongogogo · 2018-09-11T09:41:09Z

python/alb_ssl_policy.py

+     Then: Return NON_COMPLIANT
+  Scenario 3:
+    Given: CompliantPolicies has not been defined.
+     Then: Return NOT_APPLICABLE


No, this should be COMPLIANT is only you have SSL enabled.

jongogogo · 2018-09-11T09:41:20Z

python/alb_ssl_policy.py

+    Given: CompliantPolicies has not been defined.
+     Then: Return NOT_APPLICABLE
+  Scenario 4:
+    Given: Listner has not been used in a application load balancer.


return NON_COMPLIANT

jongogogo · 2018-09-11T09:41:57Z

python/alb_ssl_policy.py

@@ -48,6 +55,8 @@
 DEFAULT_RESOURCE_TYPE = ['AWS::LoadBalancingV2::LoadBalancer']
 # Pre defined policy name
 COMPLIANT_POLICY = ['ELBSecurityPolicy-2016-08','ELBSecurityPolicy-FS-2018-06']
+# for Assume Role parametor
+ASSUME_ROLE_MODE = ''


Need to be

False

jongogogo · 2018-09-11T09:42:02Z

python/alb_ssl_policy.py

@@ -48,6 +55,8 @@
 DEFAULT_RESOURCE_TYPE = ['AWS::LoadBalancingV2::LoadBalancer']
 # Pre defined policy name
 COMPLIANT_POLICY = ['ELBSecurityPolicy-2016-08','ELBSecurityPolicy-FS-2018-06']
+# for Assume Role parametor


jongogogo · 2018-09-11T09:42:14Z

python/alb_ssl_policy.py

@@ -48,6 +55,8 @@
 DEFAULT_RESOURCE_TYPE = ['AWS::LoadBalancingV2::LoadBalancer']
 # Pre defined policy name
 COMPLIANT_POLICY = ['ELBSecurityPolicy-2016-08','ELBSecurityPolicy-FS-2018-06']


Remove this line

jongogogo · 2018-09-11T09:42:42Z

python/alb_ssl_policy.py

@@ -78,14 +87,20 @@ def evaluate_compliance(event, configuration_item, valid_rule_parameters):
    ###############################

 	alb_arn = configuration_item['arn']
-	alb_client = get_client('elbv2',event);
+	alb_client = get_client('elbv2' , event)


space only after the comma

jongogogo · 2018-09-11T09:43:17Z

python/alb_ssl_policy.py

-		if ( 'SslPolicy' in l.keys()):
-			if(l['SslPolicy'] not in COMPLIANT_POLICY):
-				return 'NON_COMPLIANT'
+	if len(COMPLIANT_POLICY) == 0:


No, this is a parameter, change the function evaluate_parameter()

jongogogo

Getting better, keep iterating. Review the gherkin first, please send it to me via chime

jongogogo · 2018-09-12T01:42:50Z

python/alb_ssl_policy.py

+  I want: to chase configuration of listener ssl policy of an application load balancer.
+Scenarios:
+  Scenario 1:
+    Given: SslPolicy is in COMPLIANT_POLICY 


update the entire gherkin with the new name of the parameter

jongogogo · 2018-09-12T01:43:03Z

python/alb_ssl_policy.py

+  | ---------------------- | --------- | -------------------------------------------------------------------------------------- |
+  | Parameter Name         | Type      | Description                                                                            |
+  | ---------------------- | --------- | -------------------------------------------------------------------------------------- |
+  | ValidPolicies          | Constant  | The list of ssl policy name which check whether lister configred with comma separated  |


Type is "Optional"

jongogogo · 2018-09-12T01:43:30Z

python/alb_ssl_policy.py

+    Given: CompliantPolicies has not been defined.
+     Then: Return NON_COMPLIANT
+  Scenario 4:
+    Given: Listner has not been used in a application load balancer.


jongogogo · 2018-09-12T01:45:37Z

python/alb_ssl_policy.py

+     Then: Return COMPLIANT
+  Scenario 3:
+    Given: CompliantPolicies has not been defined.
+     Then: Return NON_COMPLIANT


This need to return compliant. if and only if, there is a SSL listener. The goal is to ensure that SSL is enabled on the ALB.

jongogogo · 2018-09-12T01:46:52Z

python/alb_ssl_policy.py

+        for l in listeners['Listeners']:
+            if 'SslPolicy' in l.keys():
+                if l['SslPolicy'] not in valid_rule_parameters['ValidPolicies']:
+                    return 'NON_COMPLIANT'


Use build_evaluation_from_config_item() to add an annotation to the NON_COMPLIANT to explain why to the customer

jongogogo · 2018-09-12T01:49:28Z

python/alb_ssl_policy.py

+
+# for Assume Role parameter
+ASSUME_ROLE_MODE = False
+DEFAULT_RESOURCE_TYPE = ''


DEFAULT_RESOURCE_TYPE = 'AWS::LoadBalancingV2::LoadBalancer'

jongogogo

Few changes to do, almost there!

jongogogo · 2018-09-12T23:35:01Z

python/alb_ssl_policy.py

+  In order to: apply ssl policy to listers
+  As: a Security Officer
+  I want: to chase configuration of listener ssl policy of an application load balancer.
+Scenarios:


Add carriage return before

jongogogo · 2018-09-12T23:35:31Z

python/alb_ssl_policy.py

+  | ---------------------- | --------- | -------------------------------------------------------------------------------------- |
+
+Feature:
+  In order to: apply ssl policy to listers


In order to: ensure that the traffic is encrypted in transit with the proper method

jongogogo · 2018-09-12T23:36:01Z

python/alb_ssl_policy.py

+Feature:
+  In order to: apply ssl policy to listers
+  As: a Security Officer
+  I want: to chase configuration of listener ssl policy of an application load balancer.


I want: to verify that the configuration of listener ssl policy of an application load balancer is correct.

jongogogo · 2018-09-12T23:37:29Z

python/alb_ssl_policy.py

+        return valid_rule_parameters
+
+    param_list = rule_parameters['ValidPolicies']
+    param_list = param_list.split(',')


merge this line with 138.

param_list = rule_parameters['ValidPolicies'].split(',')

jongogogo · 2018-09-12T23:38:58Z

python/alb_ssl_policy.py

+#####################################
+Rule Name:
+  alb_ssl_policy_check
+Description:


Add carriage return before

jongogogo · 2018-09-12T23:39:05Z

python/alb_ssl_policy.py

+  alb_ssl_policy_check
+Description:
+  Checks that listener of Application Load Balancer has configured applicable SSL policy.
+Trigger:


Add carriage return before

jongogogo · 2018-09-12T23:39:12Z

python/alb_ssl_policy.py

+  Checks that listener of Application Load Balancer has configured applicable SSL policy.
+Trigger:
+  Configuration change on AWS::LoadBalancingV2::LoadBalancer.
+Resource Type to report on:


Add carriage return before

jongogogo · 2018-09-12T23:39:17Z

python/alb_ssl_policy.py

+  Configuration change on AWS::LoadBalancingV2::LoadBalancer.
+Resource Type to report on:
+  AWS::LoadBalancingV2::LoadBalancer
+Rule Parameters:


Add carriage return before

Yuki Takahashi added 2 commits September 11, 2018 13:54

Draft for checking listener ssl policy on ALB

960b726

Modified file which use rdk template

83be2c8

jongogogo suggested changes Sep 11, 2018

View reviewed changes

Modifi and correct based on review comments.

654850e

jongogogo suggested changes Sep 11, 2018

View reviewed changes

finalize my draft code.

4adf153

jongogogo suggested changes Sep 12, 2018

View reviewed changes

refactering code with Jonathan.

3063ce7

jongogogo suggested changes Sep 12, 2018

View reviewed changes

Code analyzed by pylint.

6a02251

takahashi9854 closed this Sep 13, 2018

takahashi9854 deleted the alb_ssl_policy branch September 13, 2018 00:23


		listeners = alb_client.describe_listeners( LoadBalancerArns = [alb_arn,], )

		for l in listeners['Listeners']:

Draft for checking listener ssl policy on ALB #100

Draft for checking listener ssl policy on ALB #100

Conversation

takahashi9854 commented Sep 11, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jongogogo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jongogogo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jongogogo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment