-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #60 from vmware-samples/release/v1.5.0
Release/v1.5.0
- Loading branch information
Showing
29 changed files
with
1,349 additions
and
24 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
68 changes: 68 additions & 0 deletions
68
remediation_worker/jobs/aws_cloudtrail_logs_encrypted/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| # Enable encryption for Cloudtrail logs | ||
|
|
||
| This job encrypts Cloudtrail logs by creating an AWS Symmetric Customer Master Key (CMK) in the same region as that of the S3 Bucket that stores Cloudtrail log files. | ||
|
|
||
| ### Applicable Rule | ||
|
|
||
| ##### Rule ID: | ||
| 5c8c25e47a550e1fb6560bac | ||
|
|
||
| ##### Rule Name: | ||
| CloudTrail logs should be encrypted | ||
|
|
||
| ## Getting Started | ||
|
|
||
| ### Prerequisites | ||
|
|
||
| The provided AWS credential must have access to `kms:CreateKey`, `kms:TagResource`, `kms:EnableKeyRotation`, `kms:PutKeyPolicy`, `cloudtrail:GetTrail`, `cloudtrail:UpdateTrail` and `s3:GetBucketLocation`. | ||
|
|
||
| You may find the latest example policy file [here](minimum_policy.json) | ||
|
|
||
| ### Running the script | ||
|
|
||
| You may run this script using following commands: | ||
| ```shell script | ||
| pip install -r ../../requirements.txt | ||
| python3 aws_cloudtrail_logs_encrypted.py | ||
| ``` | ||
|
|
||
| ## Running the tests | ||
| You may run test using following command under vss-remediation-worker-job-code-python directory: | ||
| ```shell script | ||
| python3 -m pytest test | ||
| ``` | ||
|
|
||
| ## Deployment | ||
| 1. Provision a Virtual Machine | ||
| Create an EC2 instance to use for the worker. The minimum required specifications are 128 MB memory and 1/2 Core CPU. | ||
| 2. Setup Docker | ||
| Install Docker on the newly provisioned EC2 instance. You can refer to the [docs here](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/docker-basics.html) for more information. | ||
| 3. Deploy the worker image | ||
| SSH into the EC2 instance and run the command below to deploy the worker image: | ||
| ```shell script | ||
| docker run --rm -it --name worker \ | ||
| -e VSS_CLIENT_ID={ENTER CLIENT ID} | ||
| -e VSS_CLIENT_SECRET={ENTER CLIENT SECRET} \ | ||
| vmware/vss-remediation-worker:latest-python | ||
| ``` | ||
|
|
||
|
|
||
| ## Contributing | ||
| The Secure State team welcomes welcomes contributions from the community. If you wish to contribute code and you have not signed our contributor license agreement (CLA), our bot will update the issue when you open a Pull Request. For any questions about the CLA process, please refer to our [FAQ](https://cla.vmware.com/faq). | ||
| All contributions to this repository must be signed as described on that page. Your signature certifies that you wrote the patch or have the right to pass it on as an open-source patch. | ||
|
|
||
| For more detailed information, refer to [CONTRIBUTING.md](../../../CONTRIBUTING.md). | ||
|
|
||
| ## Versioning | ||
|
|
||
| We use [SemVer](http://semver.org/) for versioning. For the versions available, see the [tags on this repository](https://github.com/vmware-samples/secure-state-remediation-jobs/tags). | ||
|
|
||
| ## Authors | ||
|
|
||
| * **VMware Secure State** - *Initial work* | ||
|
|
||
| See also the list of [contributors](https://github.com/vmware-samples/secure-state-remediation-jobs/contributors) who participated in this project. | ||
|
|
||
| ## License | ||
|
|
||
| This project is licensed under the Apache License - see the [LICENSE](https://github.com/vmware-samples/secure-state-remediation-jobs/blob/master/LICENSE.txt) file for details |
Empty file.
Oops, something went wrong.