Skip to content

Commit f816ab8

Browse files
cyphronixcyphronix
committed
Merge branch 'main' into terraform-stack
2 parents 908b222 + 9b0e243 commit f816ab8

File tree

31 files changed

+274
-210
lines changed

31 files changed

+274
-210
lines changed

‎.github/workflows/safety.yml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: safety - Python Dependency Check
22

33
on:
4-
pull_request:
4+
pull_request_target:
55
branches:
66
- main
77
push:
@@ -54,9 +54,11 @@ jobs:
5454
if: steps.cached-poetry-no-dev-dependencies.outputs.cache-hit != 'true'
5555
run: poetry install --only main --no-root
5656
#----------------------------------------------
57-
# Run Safety check
57+
# Run Safety scan
5858
#----------------------------------------------
59-
- name: Safety check
59+
- name: Safety scan
60+
env:
61+
API_KEY: ${{secrets.SAFETY_API_KEY}}
6062
run: |
6163
poetry run pip install safety
62-
poetry run safety check
64+
poetry run safety --key "$API_KEY" --stage cicd scan

‎CHANGELOG.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ Updated [Firewall Manager](https://github.com/aws-samples/aws-security-reference
141141

142142
### Changed<!-- omit in toc -->
143143

144-
- Updated [CfCT template](aws_sra_examples/solutions/common/common_cfct_setup/templates/customizations-for-aws-control-tower.template) to resolve issue #137.
144+
- Updated [CfCT template](aws_sra_examples/solutions/common/common_cfct_setup/templates/) to resolve issue #137.
145145

146146
## 2023-05-05
147147

@@ -171,7 +171,7 @@ Updated [Firewall Manager](https://github.com/aws-samples/aws-security-reference
171171

172172
### Changed<!-- omit in toc -->
173173

174-
- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/customizations-for-aws-control-tower.template) to the latest version v2.5.0 and added Checkov suppressions.
174+
- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/) to the latest version v2.5.0 and added Checkov suppressions.
175175

176176
## 2022-07-29
177177

@@ -198,7 +198,7 @@ Updated [Firewall Manager](https://github.com/aws-samples/aws-security-reference
198198

199199
- Added Checkov Lambda Function suppressions for CKV_AWS_115 (Reserved Concurrent Executions) and CKV_AWS_117 (Run within a VPC) to all solution templates with Lambda Function configurations.
200200
- Updated Lambda python files to fix mypy finding for log_level to always be a string value.
201-
- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/customizations-for-aws-control-tower.template) to the latest version v2.4.0 and added Checkov suppressions.
201+
- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/) to the latest version v2.4.0 and added Checkov suppressions.
202202
- Updated pyproject.toml dependencies to the latest versions.
203203
- Updated [Macie](aws_sra_examples/solutions/macie/macie_org) solution to increase retries and handle API errors when creating existing members.
204204
- Updated [EC2 Default EBS Encryption](aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption) to include default string value for the pExcludeEC2DefaultEBSEncryptionTags parameter.

‎aws_sra_examples/solutions/ami_bakery/ami_bakery_org/lambda/src/common.py

Lines changed: 5 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1+
# type: ignore
12
"""This script includes common functions.
23
34
Version: 1.0
45
56
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
67
SPDX-License-Identifier: MIT-0
78
"""
9+
810
from __future__ import annotations
911

1012
import logging
@@ -176,25 +178,9 @@ def get_enabled_regions(customer_regions: str, control_tower_regions_only: bool
176178
elif control_tower_regions_only:
177179
region_list = get_control_tower_regions()
178180
else:
179-
default_available_regions = [
180-
"ap-northeast-1",
181-
"ap-northeast-2",
182-
"ap-northeast-3",
183-
"ap-south-1",
184-
"ap-southeast-1",
185-
"ap-southeast-2",
186-
"ca-central-1",
187-
"eu-central-1",
188-
"eu-north-1",
189-
"eu-west-1",
190-
"eu-west-2",
191-
"eu-west-3",
192-
"sa-east-1",
193-
"us-east-1",
194-
"us-east-2",
195-
"us-west-1",
196-
"us-west-2",
197-
]
181+
default_available_regions = []
182+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
183+
default_available_regions.append(region["RegionName"])
198184
LOGGER.info({"Default_Available_Regions": default_available_regions})
199185
region_list = default_available_regions
200186

‎aws_sra_examples/solutions/ami_bakery/ami_bakery_org/templates/sra-ami-bakery-org-configuration.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -447,6 +447,17 @@ Resources:
447447
Effect: Allow
448448
Action: sqs:SendMessage
449449
Resource: !GetAtt rAMIBakeryOrgDLQ.Arn
450+
451+
- PolicyName: sra-ami-bakery-org-policy-acct
452+
PolicyDocument:
453+
Version: 2012-10-17
454+
Statement:
455+
- Sid: AcctListRegions
456+
Effect: Allow
457+
Action:
458+
- account:ListRegions
459+
Resource: '*'
460+
450461
Tags:
451462
- Key: sra-solution
452463
Value: !Ref pSRASolutionName

‎aws_sra_examples/solutions/config/config_conformance_pack_org/scripts/list_config_recorder_status.py

Lines changed: 5 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# type: ignore
12
"""Get a list of accounts that do not have AWS Config enabled.
23
34
The purpose of this script is to check if AWS Config is enabled in each AWS account and region within an AWS Control
@@ -12,6 +13,7 @@
1213
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
1314
SPDX-License-Identifier: MIT-0
1415
"""
16+
1517
from __future__ import annotations
1618

1719
import logging
@@ -125,25 +127,9 @@ def get_enabled_regions(control_tower_regions_only: bool = False) -> list: # no
125127
if control_tower_regions_only:
126128
region_list = get_control_tower_regions()
127129
else:
128-
default_available_regions = [
129-
"ap-northeast-1",
130-
"ap-northeast-2",
131-
"ap-northeast-3",
132-
"ap-south-1",
133-
"ap-southeast-1",
134-
"ap-southeast-2",
135-
"ca-central-1",
136-
"eu-central-1",
137-
"eu-north-1",
138-
"eu-west-1",
139-
"eu-west-2",
140-
"eu-west-3",
141-
"sa-east-1",
142-
"us-east-1",
143-
"us-east-2",
144-
"us-west-1",
145-
"us-west-2",
146-
]
130+
default_available_regions = []
131+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
132+
default_available_regions.append(region["RegionName"])
147133
LOGGER.info({"Default_Available_Regions": default_available_regions})
148134
region_list = default_available_regions
149135

‎aws_sra_examples/solutions/config/config_org/lambda/src/common.py

Lines changed: 5 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1+
# type: ignore
12
"""This script includes common functions.
23
34
Version: 1.0
45
56
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
67
SPDX-License-Identifier: MIT-0
78
"""
9+
810
from __future__ import annotations
911

1012
import logging
@@ -129,25 +131,9 @@ def get_enabled_regions(customer_regions: str, control_tower_regions_only: bool
129131
elif control_tower_regions_only:
130132
region_list = get_control_tower_regions()
131133
else:
132-
default_available_regions = [
133-
"ap-northeast-1",
134-
"ap-northeast-2",
135-
"ap-northeast-3",
136-
"ap-south-1",
137-
"ap-southeast-1",
138-
"ap-southeast-2",
139-
"ca-central-1",
140-
"eu-central-1",
141-
"eu-north-1",
142-
"eu-west-1",
143-
"eu-west-2",
144-
"eu-west-3",
145-
"sa-east-1",
146-
"us-east-1",
147-
"us-east-2",
148-
"us-west-1",
149-
"us-west-2",
150-
]
134+
default_available_regions = []
135+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
136+
default_available_regions.append(region["RegionName"])
151137
LOGGER.info({"Default_Available_Regions": default_available_regions})
152138
region_list = default_available_regions
153139

‎aws_sra_examples/solutions/config/config_org/templates/sra-config-org-configuration.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -474,6 +474,17 @@ Resources:
474474
Effect: Allow
475475
Action: sqs:SendMessage
476476
Resource: !GetAtt rConfigOrgDLQ.Arn
477+
478+
- PolicyName: sra-config-org-policy-acct
479+
PolicyDocument:
480+
Version: 2012-10-17
481+
Statement:
482+
- Sid: AcctListRegions
483+
Effect: Allow
484+
Action:
485+
- account:ListRegions
486+
Resource: '*'
487+
477488
Tags:
478489
- Key: sra-solution
479490
Value: !Ref pSRASolutionName

‎aws_sra_examples/solutions/detective/detective_org/lambda/src/common.py

Lines changed: 5 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
1+
# type: ignore
12
"""This script includes common functions.
23
34
Version: 1.0
45
56
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
67
SPDX-License-Identifier: MIT-0
78
"""
9+
810
from __future__ import annotations
911

1012
import logging
@@ -129,25 +131,9 @@ def get_enabled_regions(customer_regions: str, control_tower_regions_only: bool
129131
elif control_tower_regions_only:
130132
region_list = get_control_tower_regions()
131133
else:
132-
default_available_regions = [
133-
"ap-northeast-1",
134-
"ap-northeast-2",
135-
"ap-northeast-3",
136-
"ap-south-1",
137-
"ap-southeast-1",
138-
"ap-southeast-2",
139-
"ca-central-1",
140-
"eu-central-1",
141-
"eu-north-1",
142-
"eu-west-1",
143-
"eu-west-2",
144-
"eu-west-3",
145-
"sa-east-1",
146-
"us-east-1",
147-
"us-east-2",
148-
"us-west-1",
149-
"us-west-2",
150-
]
134+
default_available_regions = []
135+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
136+
default_available_regions.append(region["RegionName"])
151137
LOGGER.info({"Default_Available_Regions": default_available_regions})
152138
region_list = default_available_regions
153139

‎aws_sra_examples/solutions/detective/detective_org/templates/sra-detective-org-configuration.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -379,6 +379,17 @@ Resources:
379379
Effect: Allow
380380
Action: sqs:SendMessage
381381
Resource: !GetAtt rDetectiveOrgDLQ.Arn
382+
383+
- PolicyName: sra-detective-org-policy-acct
384+
PolicyDocument:
385+
Version: 2012-10-17
386+
Statement:
387+
- Sid: AcctListRegions
388+
Effect: Allow
389+
Action:
390+
- account:ListRegions
391+
Resource: '*'
392+
382393
Tags:
383394
- Key: sra-solution
384395
Value: !Ref pSRASolutionName

‎aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption/lambda/src/app.py

Lines changed: 6 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# type: ignore
12
"""The purpose of this script is to configure the EC2 EBS default encryption within each account and region.
23
34
Version: 1.1
@@ -7,6 +8,7 @@
78
Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
89
SPDX-License-Identifier: MIT-0
910
"""
11+
1012
from __future__ import annotations
1113

1214
import json
@@ -121,25 +123,9 @@ def get_enabled_regions(customer_regions: str = None, control_tower_regions_only
121123
elif control_tower_regions_only:
122124
region_list = get_control_tower_regions()
123125
else:
124-
default_available_regions = [
125-
"ap-northeast-1",
126-
"ap-northeast-2",
127-
"ap-northeast-3",
128-
"ap-south-1",
129-
"ap-southeast-1",
130-
"ap-southeast-2",
131-
"ca-central-1",
132-
"eu-central-1",
133-
"eu-north-1",
134-
"eu-west-1",
135-
"eu-west-2",
136-
"eu-west-3",
137-
"sa-east-1",
138-
"us-east-1",
139-
"us-east-2",
140-
"us-west-1",
141-
"us-west-2",
142-
]
126+
default_available_regions = []
127+
for region in boto3.client("account").list_regions(RegionOptStatusContains=["ENABLED", "ENABLED_BY_DEFAULT"])["Regions"]:
128+
default_available_regions.append(region["RegionName"])
143129
LOGGER.info({"Default_Available_Regions": default_available_regions})
144130
region_list = default_available_regions
145131

@@ -321,7 +307,7 @@ def process_accounts(event: Union[CloudFormationCustomResourceEvent, dict], para
321307
if is_account_with_exclude_tags(account, params):
322308
continue
323309

324-
if event.get("local_testing") == "true" or event.get("ResourceProperties", {}).get("local_testing") == "true": # type: ignore
310+
if event.get("local_testing") == "true" or event.get("ResourceProperties", {}).get("local_testing") == "true":
325311
local_testing(account, params)
326312
else:
327313
sns_message = {"Action": params["action"], "AccountId": account["Id"]}

‎aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption/templates/sra-ec2-default-ebs-encryption.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -397,6 +397,17 @@ Resources:
397397
Action: sqs:SendMessage
398398
Resource: !GetAtt rEC2DefaultEBSEncryptionDLQ.Arn
399399

400+
- PolicyName: sra-ec2-default-ebs-encryption-policy-acct
401+
PolicyDocument:
402+
Version: 2012-10-17
403+
Statement:
404+
- Sid: AcctListRegions
405+
Effect: Allow
406+
Action:
407+
- account:ListRegions
408+
Resource: '*'
409+
410+
400411
Tags:
401412
- Key: sra-solution
402413
Value: !Ref pSRASolutionName

0 commit comments

Comments
 (0)