Update the CIS AWS guide for version 1.3.0 #392

infraredgirl · 2021-01-13T18:15:46Z

https://gruntwork.atlassian.net/browse/IAC-1605

Remaining work:

@robmorgan: 1.19 intro
@robmorgan: 1.19 deployment walkthrough
@robmorgan: 2.2.1 intro
@robmorgan: 2.2.1 deployment walkthrough
@marinalimeira: 5.1 intro
@marinalimeira: 5.1 deployment walkthrough
@infraredgirl: Make sure everything is linked up correctly in the traceability matrix

netlify · 2021-01-13T18:16:40Z

Deploy preview for keen-clarke-470db9 ready!

Built with commit 6e2d196

https://deploy-preview-392--keen-clarke-470db9.netlify.app

ina-stoyanova · 2021-01-14T16:24:54Z

Great start @infraredgirl 🎉

I've added some bits to the sections you mentioned me in for the iam_access_analyzer - these probs need reviewing if they make sense, but I hope is a good start.

infraredgirl

Awesome, thanks @ina-stoyanova. Looks great, I added a couple of comments too.

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

…ub.io into cis-guide

marinalimeira · 2021-01-15T16:22:13Z

Just pushed the 5.1 related documentation at 8dd1d15

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

Co-authored-by: Ina Stoyanova <ina@gruntwork.io>

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

rhoboat · 2021-01-19T17:13:23Z

This section is really long now: https://github.com/gruntwork-io/gruntwork-io.github.io/blob/ca410b41956807bc9f2cb1b71c9fbe2f839eb1ef/_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc#deployment-walkthrough I wonder if it would help to have a mini-TOC right here, under this header with all the subsections linked?

Also wanted to say, this is looking great!

Co-authored-by: rho <13165182+rhoboat@users.noreply.github.com>

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

robmorgan · 2021-01-25T07:52:06Z

This section is really long now: https://github.com/gruntwork-io/gruntwork-io.github.io/blob/ca410b41956807bc9f2cb1b71c9fbe2f839eb1ef/_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc#deployment-walkthrough I wonder if it would help to have a mini-TOC right here, under this header with all the subsections linked?

Also wanted to say, this is looking great!

@rhoboat Similar to my other point, do you think the left side-bar negates the need for an additional ToC?

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

robmorgan · 2021-01-25T08:32:02Z

I've added a few new comments. Aside from the feedback, it looks like the traceability matrix is the last thing to complete and then we're done.

Co-authored-by: Rob Morgan <robbym@gmail.com>

infraredgirl · 2021-01-25T12:53:49Z

I believe we are ready to open this up for approvals!

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

brikis98 · 2021-01-26T13:02:04Z

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

+link:https://github.com/gruntwork-io/terraform-aws-cis-service-catalog/tree/master/modules/vpc-app-network-acls[`vpc-app-network-acls`
+module] and your NACL Rules for the VPC-Mgmt (which is being deprecated) using the
+link:https://github.com/gruntwork-io/terraform-aws-cis-service-catalog/tree/master/modules/vpc-mgmt-network-acls[`vpc-mgmt-network-acls`
+module].


Code examples plz!

@brikis98 @marinalimeira This one is a bit tricky... For the code examples, we need to:

Possibly link to this section: https://www.gruntwork.io/guides/compliance/how-to-achieve-cis-benchmark-compliance/#wrapper_modules

Explain how we extend the vpc-app and vpc-mgmt modules by creating new ones in infrastructure-modules.

Explain how in the new vpc-app and vpc-mgmt modules we need to invoke the vpc-mgmt-network-acls module.

Explain how to create a terragrunt.hcl file that invokes our new VPC modules in infrastructure-modules.

Is there an easier way to do this? Could we just do the last step?

I think the real solution is to add a VPC service to the CIS Service Catalog, which would include vpc-app and vpc-app-network-acls, and deploy that with one terragrunt.hcl. We have the ticket for this already: https://gruntwork.atlassian.net/browse/IAC-1643... But it's not part of the CIS v1.3 project.

So I guess it's a trade-off between:

Updating this guide with a bunch of steps that will take some time to put together and will be deprecated soon.

Doing the VPC service work now, and updating the guide to use that. But note that the VPC service would have to extend the existing VPC service in terraform-aws-service-catalog, and not all our CIS customers have access to that yet, so that would be yet another yak to shave.

Doing some minimal version of (1). That is, we say vaguely something like, "You should use the vpc-app-network-acls module to meet the new CIS v1.3 requirements. Check out our VPC guide for how to deploy a VPC with the vpc-app module. Once that's deployed, add the vpc-app-network-acls module as follows: . Deploy all this using Terragrunt: ."

It's not ideal, but (3) is probably the way to go, and we'll replace it fairly soon when the CIS Service Catalog work is done.

I am not sure if I am following... What is the difference between (2) and the cis-infra-live-acme + cis-infra-modules?

The old way:

Customer has an infra-modules repo with a bunch of Terraform code in it.

Customers' infra-live repo sets the source URL to their own infra-modules repo.

The new way:

Gruntwork has an service-catalog repo with a bunch of Terraform code in it.

Customers' infra-live repo sets the source URL to Gruntwork's service-catalog repo.

The CIS Service Catalog project is moving us to the new way for CIS... But we're not there yet. So we're trying to decide if we want to do the work of showing customers the "old way" for this VPC NACL stuff, only to throw it away a little later (option 1)... Or if we can go straight to the new way (option 2). Or some minimal version of the old way, as a placeholder until we finish the Service Catalog stuff (option 3).

I'd vouch with respect for time and simplicity, that we go with the old way. And then as part of CIS Service Catalog work, we come back here to update this.

I went to the Updating this guide with a bunch of steps that will take some time to put together and will be deprecated soon. direction!

Co-authored-by: Yevgeniy Brikman <brikis98@users.noreply.github.com>

- Use NOTE block to point to the upgrade guide - Link to appropriate deployment walkthrough sections instead of private repos - Add link to the s3-bucket service as usage example of private-s3-bucket module

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

brikis98

OK, some minor wording / typo issues to fix, and this is good to go!

brikis98 · 2021-02-03T10:50:42Z

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

+To enable IAM Access Analyzer in your AWS Account or Organization, you need to do it separately for every region.
+
+To enable this for your AWS account:
+* use the examples provided as part of `learning-and-testing/landingzone`:


NIT: This * is not rendering as a bullet point: https://deploy-preview-392--keen-clarke-470db9.netlify.app/guides/compliance/how-to-achieve-cis-benchmark-compliance/#iam_access_analyzer_deployment

Actually, this whole sentence should be removed, as CIS customers should NOT be using the acccount-baseline modules, as those don't take into account CIS requirements. Instead, they should solely use the iam-access-analyzer module as shown below.

ahaa! noted!

removed :) good shout!

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

brikis98

Ship it!

ina-stoyanova · 2021-02-03T13:27:32Z

Thanks Jim!

[WIP] Update the CIS AWS guide for version 1.3.0

87139d0

infraredgirl requested review from eak12913, josh-padnick, oredavids and tsmit291 as code owners January 13, 2021 18:15

Adding IAM access analyzer notes to the guide

a56ab10

infraredgirl commented Jan 14, 2021

View reviewed changes

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc Show resolved Hide resolved

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc Outdated Show resolved Hide resolved

Add Storage section and more TODOs

a2388f5

infraredgirl removed request for eak12913, josh-padnick, oredavids and tsmit291 January 14, 2021 17:29

Ina Stoyanova and others added 3 commits January 14, 2021 20:31

Fix link to section & a few bits of info

8ca0539

Merge branch 'cis-guide' of github.com:gruntwork-io/gruntwork-io.gith…

560d768

…ub.io into cis-guide

Add the 5.1 recommendation to the Guide

8dd1d15

ina-stoyanova reviewed Jan 18, 2021

View reviewed changes

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc Outdated Show resolved Hide resolved

ina-stoyanova reviewed Jan 18, 2021

View reviewed changes

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc Outdated Show resolved Hide resolved

Fix typo

ca410b4

Co-authored-by: Ina Stoyanova <ina@gruntwork.io>

rhoboat reviewed Jan 19, 2021

View reviewed changes

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc Show resolved Hide resolved

rhoboat reviewed Jan 19, 2021

View reviewed changes

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc Outdated Show resolved Hide resolved

robmorgan and others added 3 commits January 20, 2021 14:47

add expired certs section in prod grade design

567a1d6

Update _posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc

7879af9

Co-authored-by: rho <13165182+rhoboat@users.noreply.github.com>

add cleanup-expired-certs deploy instructions

5343894

robmorgan reviewed Jan 20, 2021

View reviewed changes

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc Show resolved Hide resolved

robmorgan added 2 commits January 20, 2021 15:54

break storage deployment out into two sections

d3ef163

reduce verbosity

1e494be

add matrix links

5ad0c2f

robmorgan reviewed Jan 25, 2021

View reviewed changes

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc Outdated Show resolved Hide resolved

robmorgan reviewed Jan 25, 2021

View reviewed changes

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc Outdated Show resolved Hide resolved

infraredgirl and others added 3 commits January 25, 2021 12:42

Update wording

8fc3a4d

Co-authored-by: Rob Morgan <robbym@gmail.com>

Finish the traceability matrix

eea7589

Use new repo names

b26530a

infraredgirl changed the title ~~[WIP] Update the CIS AWS guide for version 1.3.0~~ Update the CIS AWS guide for version 1.3.0 Jan 25, 2021

Update wording around |v|version

7815752

brikis98 reviewed Jan 26, 2021

View reviewed changes

infraredgirl and others added 5 commits January 26, 2021 16:22

Improve wording

fd4980d

Co-authored-by: Yevgeniy Brikman <brikis98@users.noreply.github.com>

Address review comments

5cd3f1c

- Use NOTE block to point to the upgrade guide - Link to appropriate deployment walkthrough sections instead of private repos - Add link to the s3-bucket service as usage example of private-s3-bucket module

Adding example for IAM access analyzer

c5934c9

Updating example to be of the whole module usage

94b5952

Adding EBS example module usage

b1041b2

robmorgan reviewed Jan 29, 2021

View reviewed changes

_posts/2019-10-17-how-to-achieve-cis-benchmark-compliance.adoc Outdated Show resolved Hide resolved

robmorgan and others added 4 commits January 29, 2021 15:26

add cleanup-expired-certs terragrunt example

0f38ebc

rework ebs encryption example for terragrunt

a3fdf58

Feedback for IAM access analyzer

d014b4d

Add code example for the nacl

02abd20

brikis98 previously approved these changes Feb 3, 2021

View reviewed changes

PR NITS -- wording improvements

3b0fc10

marinalimeira dismissed brikis98’s stale review via 3b0fc10 February 3, 2021 11:26

PR feedback - removing obsolete blocka

6e2d196

brikis98 approved these changes Feb 3, 2021

View reviewed changes

ina-stoyanova merged commit 43975fd into master Feb 3, 2021

ina-stoyanova deleted the cis-guide branch February 3, 2021 13:29

Uh oh!

Update the CIS AWS guide for version 1.3.0 #392

Update the CIS AWS guide for version 1.3.0 #392

Uh oh!

Conversation

infraredgirl commented Jan 13, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Jan 13, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ina-stoyanova commented Jan 14, 2021

Uh oh!

infraredgirl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

marinalimeira commented Jan 15, 2021

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rhoboat commented Jan 19, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

robmorgan commented Jan 25, 2021

Uh oh!

Uh oh!

Uh oh!

robmorgan commented Jan 25, 2021

Uh oh!

infraredgirl commented Jan 25, 2021

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marinalimeira Feb 2, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

brikis98 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

brikis98 left a comment

infraredgirl commented Jan 13, 2021 •

edited

Loading

netlify bot commented Jan 13, 2021 •

edited

Loading

rhoboat commented Jan 19, 2021 •

edited

Loading

marinalimeira Feb 2, 2021 •

edited

Loading