def test_get_all_regions_succces_case_session_is_none_filter_describe_regions_and_all_regions_is_not_none( self): # create data mock ec2_client_connect = boto3.client('ec2', region_name) response = ec2_client_connect.describe_regions( Filters=filter_describe_regions, AllRegions=True) expected_regions = response['Regions'] # Call function test actual_regions = aws_common.get_regions(trace_id) self.assertListEqual(expected_regions, actual_regions)
def test_get_regions_error(self): # create data mock expected_error_response = copy.deepcopy(DataCommon.ERROR_RESPONSE) expected_operation_name = copy.deepcopy(DataCommon.OPERATION_NAME) ec2_client_connect = ec2_utils_mock.client_connect() with patch.object(ec2_client_connect, 'describe_regions') as mock_method: mock_method.side_effect = ClientError( error_response=expected_error_response, operation_name=expected_operation_name) with self.assertRaises(PmError) as exception: # Call function test aws_common.get_regions(trace_id) # check error actual_cause_error = exception.exception.cause_error self.assertEqual(expected_error_response['Error'], actual_cause_error.response['Error']) self.assertEqual(expected_operation_name, actual_cause_error.operation_name)
def test_get_regions_enable_succces_case_session_is_not_none_all_regions_is_not_none( self): # create data mock ec2_client_connect = session.client('ec2') response = ec2_client_connect.describe_regions(AllRegions=True) expected_regions = response['Regions'] # Call function test actual_regions = aws_common.get_regions(trace_id, session=session, filter_describe_regions=None) self.assertListEqual(expected_regions, actual_regions)
def check_asc_item_07_01(trace_id, check_history_id, organization_id, project_id, aws_account, session, result_json_path): cw_logger = common_utils.begin_cw_logger(trace_id, __name__, inspect.currentframe()) check_results = [] try: regions = aws_common.get_regions(trace_id, session, is_cw_logger=True) except PmError as e: cw_logger.error("Regionの情報の取得に失敗しました。") raise common_utils.write_log_pm_error(e, cw_logger) for region in regions: region_name = region["RegionName"] if region_name in REGION_IGNORE: continue ec2_client = Ec2Utils.get_ec2_client(trace_id, session, region_name, aws_account, is_cw_logger=True) try: # EBS情報を取得する。 ebs_volumes = Ec2Utils.describe_volumes(trace_id, aws_account, ec2_client, region_name, is_cw_logger=True) except PmError as e: return CheckResult.Error # 取得件数が0件の場合、ログを出力し、次のリージョンの処理に進みます。 if (len(ebs_volumes) == 0): cw_logger.info("[%s/%s] EBSボリューム情報の取得件数が0でした。", aws_account, region_name) continue try: # 取得したEBS情報をS3に保存する(EBS情報ファイル)。 s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, aws_account, "ASC/EBS_Volumes_" + region_name + ".json") FileUtils.upload_s3(trace_id, ebs_volumes, s3_file_name, True, is_cw_logger=True) except PmError as e: cw_logger.error("[%s/%s] EBSボリューム情報情報のS3保存に失敗しました。", aws_account, region_name) return CheckResult.Error # チェックルール try: for ebs_volume in ebs_volumes: if (ebs_volume['Encrypted'] is False): check_result = get_check_asc_item_07_01_result( ebs_volume, region_name) check_results.append(check_result) except PmError as e: cw_logger.error("[%s/%s] チェック処理中にエラーが発生しました。", aws_account, region_name) return CheckResult.Error # Export File ASC/CHECK_ ASC_ITEM_07_01.json try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_acs_item_7_01 = { 'AWSAccount': aws_account, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_acs_item_7_01, result_json_path, format_json=True, is_cw_logger=True) except Exception as e: cw_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", aws_account) return CheckResult.Error # チェック結果 if len(check_results) > 0: return CheckResult.CriticalDefect return CheckResult.Normal
def check_cis_metric(trace_id, check_history_id, organization_id, project_id, awsaccount, session, result_json_path, check_item_code, level_code, check_result): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) check_results = [] is_all_region_enable = False is_check5_successful = False # Get all region try: regions = aws_common.get_regions(trace_id, session) except PmError as e: pm_logger.error("Regionの情報の取得に失敗しました。") e.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(e, pm_logger) for region in regions: try: region_name = region["RegionName"] if region_name in REGION_IGNORE: continue # Default value check is_region_error = True try: cloud_trails = cis_item_common_logic.get_cloud_trails( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, session) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) logs_client = LogsUtils.get_logs_client(trace_id, session, region_name, awsaccount) cloudwatch_client = CloudWatchlUtils.get_cloudwatch_client( trace_id, session, region_name, awsaccount) sns_client = SNSUtils.get_sns_client(trace_id, session, region_name, awsaccount) trail_client = CloudTrailUtils.get_trail_client( trace_id, session, region_name, awsaccount) for cloud_trail in cloud_trails: try: # Check-0. マルチリージョン設定されたCloudTrailが存在するか。 trail_status = cis_item_common_logic.get_trails_status( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, trail_client, cloud_trail) if (len(trail_status) == 0): continue event_selectors = cis_item_common_logic.get_trail_event_selectors( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, trail_client, cloud_trail) # 全リージョンに対し有効なCloudTrailが存在するか # ロギングが有効か if (is_all_region_enable is False and cloud_trail['IsMultiRegionTrail'] is True and trail_status['IsLogging'] is True): # すべての管理操作の書き込みが有効か for event_selector in event_selectors: if (event_selector['IncludeManagementEvents'] is True and event_selector['ReadWriteType'] == CommonConst.EVENT_SELECTOR_READ_WRITE_TYPE_ALL): is_all_region_enable = True break if (is_all_region_enable is False): continue # Check-1. CloudTrailのロググループに対してメトリクスは設定されているか。 if common_utils.check_key( 'CloudWatchLogsLogGroupArn', cloud_trail ) is False or not cloud_trail['CloudWatchLogsLogGroupArn']: continue # Check-2. 許可されていないAPIコールに対するメトリクスは設定されているか。 metric_filters = describe_metric_filters( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, logs_client, cloud_trail['CloudWatchLogsLogGroupArn'].split(":")[6]) list_filter_pattern_result = get_list_filter_pattern_match_result( trace_id, check_item_code, metric_filters) if (not list_filter_pattern_result): continue # Check-3. メトリクスに対しアラームは設定されているか。 metric_alarms = describe_alarms( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, cloudwatch_client) metric_names = [] for filter_pattern_result in list_filter_pattern_result: metric_names.extend( jmespath.search( 'metricTransformations[*].metricName', filter_pattern_result)) metric_alarms_matching = [] for metric_alarm in metric_alarms: pm_logger.info( "アラーム名=%s", common_utils.get_value("AlarmName", metric_alarm)) if (common_utils.check_key('MetricName', metric_alarm) is True and metric_alarm['MetricName'] in metric_names): metric_alarms_matching.append(metric_alarm) if not metric_alarms_matching: continue # Check-4. アラームからキックされたSNSに対し通知先は設定されているか。 for metric_alarm in metric_alarms_matching: for alarm_action in metric_alarm['AlarmActions']: if alarm_action.startswith(CommonConst.ARN_SNS): subscriptions = list_subscriptions_by_topic( trace_id, check_history_id, organization_id, project_id, awsaccount, region_name, sns_client, alarm_action) if len(subscriptions) > 0: is_region_error = False break # Check-5. 設定されたCloudTrailは全Region有効なTrailか。 if (is_region_error is False and is_all_region_enable is True): is_check5_successful = True break except Exception as e: pm_logger.error("[%s/%s] チェック処理中にエラーが発生しました。", awsaccount, region_name) raise common_utils.write_log_exception(e, pm_logger) if is_check5_successful is True: check_results = [] break if (is_region_error is True): result = {'Region': region_name, 'Level': level_code} check_results.append(result) except Exception as e: pm_error = common_utils.write_log_exception(e, pm_logger) if not pm_error.pm_notification_error: pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, region=region_name, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) else: pm_error.pm_notification_error.check_item_code = check_item_code pm_error.pm_notification_error.aws_account = awsaccount pm_error.pm_notification_error.region = region_name raise common_utils.write_log_pm_error(pm_error, pm_logger) # 検出結果を1つのチェック結果JSONファイルに保存する。 try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_cis_item_3 = { 'AWSAccount': awsaccount, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_cis_item_3, result_json_path, True) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", awsaccount) pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) if len(check_results) > 0: return check_result return CheckResult.Normal
def execute_security_group_port(trace_id, check_history_id, organization_id, project_id, awsaccount, session, result_json_path, port, check_item_code, excluded_resources): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) check_results = [] # Export File VPC_SecurityGroups_{region}.json try: regions = aws_common.get_regions(trace_id, session) except PmError as e: pm_logger.error("Regionの情報の取得に失敗しました。") e.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(e, pm_logger) for region in regions: region_name = region["RegionName"] try: if region_name in REGION_IGNORE: continue ec2_client = Ec2Utils.get_ec2_client(trace_id, session, region_name, awsaccount) s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, awsaccount, "VPC_SecurityGroups_" + region_name + ".json") if (aws_common.check_exists_file_s3(trace_id, "S3_CHECK_BUCKET", s3_file_name)) is True: try: security_groups = FileUtils.read_json( trace_id, "S3_CHECK_BUCKET", s3_file_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) else: try: security_groups = Ec2Utils.describe_security_groups( trace_id, awsaccount, ec2_client, region_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) if (len(security_groups) == 0): pm_logger.info("[%s/%s] セキュリティグループ情報の取得件数が0でした。", awsaccount, region_name) continue try: FileUtils.upload_s3(trace_id, security_groups, s3_file_name, True) except PmError as e: pm_logger.error("[%s/%s] セキュリティグループ情報のS3保存に失敗しました。", awsaccount, region_name) raise common_utils.write_log_pm_error(e, pm_logger) try: for security_group in security_groups: # check excluded resources resource_name = security_group['GroupId'] if common_utils.check_excluded_resources( check_item_code, region_name, ResourceType.GroupId, resource_name, excluded_resources): continue for ip_permission in security_group['IpPermissions']: if ip_permission['IpProtocol'] != '-1': if ip_permission['IpProtocol'] != CommonConst.TCP: continue if common_utils.check_key( 'FromPort', ip_permission ) is False or ip_permission['FromPort'] > port: continue if common_utils.check_key( 'ToPort', ip_permission ) is False or ip_permission['ToPort'] < port: continue for ip_range in ip_permission['IpRanges']: if common_utils.check_key('CidrIp', ip_range): if (CommonConst.CIDR_IP_NOT_SECURITY == ip_range['CidrIp']): check_result = get_check_result( security_group, ip_permission, ip_range, region_name) check_results.append(check_result) break except Exception as e: pm_logger.error("[%s/%s] チェック処理中にエラーが発生しました。", awsaccount, region_name) raise common_utils.write_log_pm_error(e, pm_logger) except Exception as e: pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, region=region_name, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) result_security_group = CheckResult.Normal if (len(check_results) > 0): result_security_group = CheckResult.CriticalDefect # 検出結果を1つのチェック結果JSONファイルに保存する。 try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_rule_security_group = { 'AWSAccount': awsaccount, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_rule_security_group, result_json_path, True) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", awsaccount) pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) return result_security_group
def check_cis_item_4_03(trace_id, check_history_id, organization_id, project_id, awsaccount, session, result_json_path, check_item_code, excluded_resources): pm_logger = common_utils.begin_logger(trace_id, __name__, inspect.currentframe()) check_results = [] try: regions = aws_common.get_regions(trace_id, session) except PmError as e: pm_logger.error("Regionの情報の取得に失敗しました。") e.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(e, pm_logger) for region in regions: region_name = region["RegionName"] try: if region_name in REGION_IGNORE: continue ec2_client = Ec2Utils.get_ec2_client(trace_id, session, region_name, awsaccount) # 対象のAWSアカウントのリージョンごと(GovCloud、北京を除く)にセキュリティグループ情報を取得する。 s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, awsaccount, "VPC_SecurityGroups_" + region_name + ".json") if (aws_common.check_exists_file_s3(trace_id, "S3_CHECK_BUCKET", s3_file_name)) is True: try: security_groups = FileUtils.read_json( trace_id, "S3_CHECK_BUCKET", s3_file_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) else: try: security_groups = Ec2Utils.describe_security_groups( trace_id, awsaccount, ec2_client, region_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) if (len(security_groups) == 0): pm_logger.info("[%s/%s] セキュリティグループ情報の取得件数が0でした。", awsaccount, region_name) try: if (len(security_groups) > 0): FileUtils.upload_s3(trace_id, security_groups, s3_file_name, True) except PmError as e: pm_logger.error("[%s/%s] セキュリティグループ情報のS3保存に失敗しました。", awsaccount, region_name) raise common_utils.write_log_pm_error(e, pm_logger) # 対象のAWSアカウントのリージョンごと(GovCloud、北京を除く)にEC2インスタンス情報を取得する。 s3_file_name_iam_instances = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, awsaccount, "IAM_Instances_" + region_name + ".json") if (aws_common.check_exists_file_s3( trace_id, "S3_CHECK_BUCKET", s3_file_name_iam_instances)) is True: try: reservation_instances = FileUtils.read_json( trace_id, "S3_CHECK_BUCKET", s3_file_name_iam_instances) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) else: try: reservation_instances = Ec2Utils.describe_instances( trace_id, awsaccount, ec2_client, region_name) except PmError as e: raise common_utils.write_log_pm_error(e, pm_logger) if (len(reservation_instances) == 0): pm_logger.info("[%s/%s] EC2インスタンス情報の取得件数が0でした。", awsaccount, region_name) try: if (len(reservation_instances) > 0): s3_file_name = CommonConst.PATH_CHECK_RAW.format( check_history_id, organization_id, project_id, awsaccount, "VPC_SG_Instances_" + region_name + ".json") FileUtils.upload_s3(trace_id, reservation_instances, s3_file_name, True) except PmError as e: pm_logger.error("[%s/%s] EC2インスタンス情報のS3保存に失敗しました。", awsaccount, region_name) raise common_utils.write_log_pm_error(e, pm_logger) check1 = [] check2 = [] try: # リソース情報ファイルのセキュリティグループ情報から、インバウンドルール、アウトバウンドルールを設定しているdefaultセキュリティグループを検出する。 for security_group in security_groups: # check excluded resources resource_name = security_group['GroupId'] if common_utils.check_excluded_resources( check_item_code, region_name, ResourceType.GroupId, resource_name, excluded_resources): continue if (security_group['GroupName'] == CommonConst.DEFAULT and len(security_group['IpPermissions']) > 0 and len(security_group['IpPermissionsEgress']) > 0): check1.append(security_group['GroupId']) # リソース情報ファイルのEC2インスタンス情報から、defaultセキュリティグループをアタッチしたEC2インスタンスを検出する、。 for reservation_instance in reservation_instances: for instance in reservation_instance['Instances']: for security_group in instance['SecurityGroups']: if security_group[ 'GroupName'] == CommonConst.DEFAULT: if common_utils.check_key('Tags', instance) is True: name_tag = next( filter( lambda tag: tag['Key'] == 'Name', instance['Tags']), None) instance[ 'InstanceName'] = None if name_tag is None else name_tag[ 'Value'] check2.append(instance) if (len(check1) > 0 or len(check2) > 0): check_results.append( get_check_cis_item_4_03_result(check1, check2, region_name)) except Exception as e: pm_logger.error("[%s/%s] チェック処理中にエラーが発生しました。", awsaccount, region_name) raise common_utils.write_log_pm_error(e, pm_logger) except Exception as e: pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, region=region_name, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) # Export File CHECK_CIS12_ITEM_4_03.json try: current_date = date_utils.get_current_date_by_format( date_utils.PATTERN_YYYYMMDDHHMMSS) check_cis_item_4_03 = { 'AWSAccount': awsaccount, 'CheckResults': check_results, 'DateTime': current_date } FileUtils.upload_s3(trace_id, check_cis_item_4_03, result_json_path, True) except Exception as e: pm_logger.error("[%s] チェック結果JSONファイルの保存に失敗しました。", awsaccount) pm_error = common_utils.write_log_exception(e, pm_logger) pm_error.pm_notification_error = PmNotificationError( check_item_code=check_item_code, code_error=CommonConst.KEY_CODE_ERROR_DEFAULT) raise common_utils.write_log_pm_error(pm_error, pm_logger) # チェック結果 if len(check_results) > 0: return CheckResult.MinorInadequacies return CheckResult.Normal