Automated Forensics Orchestrator for Amazon EC2 is a self-service AWS Solution implementation that enterprise customers can deploy to quickly set up and configure an automated orchestration workflow that enables their Security Operations Centre (SOC) to capture and examine data from EC2 instances and attached volumes as evidence for forensic analysis, in the event of a potential security breach. It will orchestrate the forensics process from the point at which a threat is first detected, enable isolation of the affected EC2 instances and data volumes, capture memory and disk images to secure storage, and trigger automated actions or tools for investigation and analysis of such artefacts. All the while, the solution will notify and report on its progress, status, and findings. It will enable SOC to continuously discover and analyze patterns of fraudulent activities across multi-account and multi-region environments. The solution will leverage native AWS services and be underpinned by a highly available, resilient, and serverless architecture, security, and operational monitoring features. Digital forensics is a 4 step process of triaging, acquisition, analysis and reporting. Automated Forensics framework provides capability to enterprise to act on security event by imaging or acquisition of breached resource for examination and generate forensic report about the security breach. In the event of a security breach, it will enable customers to easily to capture and examine required targeted data for forsensic’s storage and analysis. This solution framework enables security operations centre to discover and analyse patterns of fraudulent activities. The automated forensics solution will provide a multi-account and a multi-region [“solution”] built using native AWS services.
To Reproduce
The cdk synth command that we are executing is : (Sensitive info has been redacted)
cdk synth -c account= -c sechubaccount= -c region=eu-west-2 -c STACK_BUILD_TARGET_ACCT=forensicAccount
Node Version used :
Have tried with both v20.13.1 and v16.20.2
CDK version used:
2.141.0 (build 3d1c06e)
The error received on the console is as follows (Sensitive info has been redacted)
~/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/aws-cdk-lib/core/lib/asset-staging.js:1
"use strict";var _a;Object.defineProperty(exports,"__esModule",{value:!0}),exports.AssetStaging=void 0;const jsiiDeprecationWarnings=require("../../.warnings.jsii.js"),JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti"),crypto=require("crypto"),path=require("path"),constructs_1=require("constructs"),fs=require("fs-extra"),assets_1=require("./assets"),bundling_1=require("./bundling"),fs_1=require("./fs"),fingerprint_1=require("./fs/fingerprint"),names_1=require("./names"),asset_staging_1=require("./private/asset-staging"),cache_1=require("./private/cache"),stack_1=require("./stack"),stage_1=require("./stage"),cxapi=require("../../cx-api"),ARCHIVE_EXTENSIONS=[".tar.gz",".zip",".jar",".tar",".tgz"],ASSET_SALT_CONTEXT_KEY="@aws-cdk/core:assetHashSalt";class AssetStaging extends constructs_1.Construct{static clearAssetHashCache(){this.assetCache.clear(),(0,fingerprint_1.clearLargeFileFingerprintCache)()}constructor(scope,id,props){super(scope,id);try{jsiiDeprecationWarnings.aws_cdk_lib_AssetStagingProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,AssetStaging),error}const salt=this.node.tryGetContext(ASSET_SALT_CONTEXT_KEY);if(this.sourcePath=path.resolve(props.sourcePath),this.fingerprintOptions={...props,extraHash:props.extraHash||salt?${props.extraHash??""}${salt??""}:void 0},!fs.existsSync(this.sourcePath))throw new Error(Cannot find asset at ${this.sourcePath});this.sourceStats=fs.statSync(this.sourcePath);const outdir=stage_1.Stage.of(this)?.assetOutdir;if(!outdir)throw new Error('unable to determine cloud assembly asset output directory. Assets must be defined indirectly within a "Stage" or an "App" scope');this.assetOutdir=outdir,this.customSourceFingerprint=props.assetHash,this.hashType=determineHashType(props.assetHashType,this.customSourceFingerprint);let stageThisAsset,skip=!1;if(props.bundling){skip=!stack_1.Stack.of(this).bundlingRequired;const bundling=props.bundling;stageThisAsset=()=>this.stageByBundling(bundling,skip)}else stageThisAsset=()=>this.stageByCopying();this.cacheKey=calculateCacheKey({outdir:this.assetOutdir,sourcePath:path.resolve(props.sourcePath),bundling:props.bundling,assetHashType:this.hashType,customFingerprint:this.customSourceFingerprint,extraHash:props.extraHash,exclude:props.exclude,ignoreMode:props.ignoreMode,skip});const staged=AssetStaging.assetCache.obtain(this.cacheKey,stageThisAsset);this.stagedPath=staged.stagedPath,this.absoluteStagedPath=staged.stagedPath,this.assetHash=staged.assetHash,this.packaging=staged.packaging,this.isArchive=staged.isArchive}get sourceHash(){return this.assetHash}relativeStagedPath(stack){try{jsiiDeprecationWarnings.aws_cdk_lib_Stack(stack)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.relativeStagedPath),error}const asmManifestDir=stage_1.Stage.of(stack)?.outdir;return asmManifestDir?path.relative(this.assetOutdir,this.stagedPath).startsWith("..")||this.stagingDisabled?this.stagedPath:path.relative(asmManifestDir,this.stagedPath):this.stagedPath}stageByCopying(){const assetHash=this.calculateHash(this.hashType),stagedPath=this.stagingDisabled?this.sourcePath:path.resolve(this.assetOutdir,renderAssetFilename(assetHash,getExtension(this.sourcePath)));if(!this.sourceStats.isDirectory()&&!this.sourceStats.isFile())throw new Error(Asset ${this.sourcePath} is expected to be either a directory or a regular file);return this.stageAsset(this.sourcePath,stagedPath,"copy"),{assetHash,stagedPath,packaging:this.sourceStats.isDirectory()?assets_1.FileAssetPackaging.ZIP_DIRECTORY:assets_1.FileAssetPackaging.FILE,isArchive:this.sourceStats.isDirectory()||ARCHIVE_EXTENSIONS.includes(getExtension(this.sourcePath).toLowerCase())}}stageByBundling(bundling,skip){if(!this.sourceStats.isDirectory())throw new Error(Asset ${this.sourcePath} is expected to be a directory when bundling);if(skip){let hashType=this.hashType;return(hashType===assets_1.AssetHashType.OUTPUT||hashType===assets_1.AssetHashType.BUNDLE)&&(this.customSourceFingerprint=names_1.Names.uniqueId(this),hashType=assets_1.AssetHashType.CUSTOM),{assetHash:this.calculateHash(hashType,bundling),stagedPath:this.sourcePath,packaging:assets_1.FileAssetPackaging.ZIP_DIRECTORY,isArchive:!0}}let assetHash=this.hashType===assets_1.AssetHashType.SOURCE||this.hashType===assets_1.AssetHashType.CUSTOM?this.calculateHash(this.hashType,bundling):void 0;const bundleDir=this.determineBundleDir(this.assetOutdir,assetHash);this.bundle(bundling,bundleDir);const bundlingOutputType=bundling.outputType??bundling_1.BundlingOutput.AUTO_DISCOVER,bundledAsset=determineBundledAsset(bundleDir,bundlingOutputType);assetHash=assetHash??this.calculateHash(this.hashType,bundling,bundledAsset.path);const stagedPath=path.resolve(this.assetOutdir,renderAssetFilename(assetHash,bundledAsset.extension));return this.stageAsset(bundledAsset.path,stagedPath,"move"),bundledAsset.packaging===assets_1.FileAssetPackaging.FILE&&fs.closeSync(fs.openSync(bundledAsset.path,"w")),{assetHash,stagedPath,packaging:bundledAsset.packaging,isArchive:!0}}get stagingDisabled(){return!!this.node.tryGetContext(cxapi.DISABLE_ASSET_STAGING_CONTEXT)}stageAsset(sourcePath,targetPath,style){if(fs.existsSync(targetPath)){style==="move"&&sourcePath!==targetPath&&fs.removeSync(sourcePath);return}if(style=="move"){fs.renameSync(sourcePath,targetPath);return}if(this.sourceStats.isFile())fs.copyFileSync(sourcePath,targetPath);else if(this.sourceStats.isDirectory())fs.mkdirSync(targetPath),fs_1.FileSystem.copyDirectory(sourcePath,targetPath,this.fingerprintOptions);else throw new Error(Unknown file type: ${sourcePath})}determineBundleDir(outdir,sourceHash){return sourceHash?path.resolve(outdir,renderAssetFilename(sourceHash)):path.resolve(outdir,bundling-temp-${this.cacheKey})}bundle(options,bundleDir){if(fs.existsSync(bundleDir))return;fs.ensureDirSync(bundleDir),fs.chmodSync(bundleDir,511);let localBundling;try{if(process.stderr.write(`Bundling asset ${this.node.path}...
^
Error: Cannot find asset at ~/automated-forensic-orchestrator-for-amazon-ec2/source/lib/lambda/dist/lambda
at new AssetStaging (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/aws-cdk-lib/core/lib/asset-staging.js:1:1402)
at new Asset (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/aws-cdk-lib/aws-s3-assets/lib/asset.js:1:736)
at AssetCode.bind (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/aws-cdk-lib/aws-lambda/lib/code.js:1:4628)
at new Function (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/aws-cdk-lib/aws-lambda/lib/function.js:1:7479)
at new SolutionMetricsCollectorConstruct (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/lib/infra-utils/solution-metrics-collector.ts:42:40)
at new ForensicsSolutionsConstructsStack (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/lib/forensic-solution-builder-stack.ts:727:9)
at Object. (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/bin/forensic-cdk-solution.ts:57:37)
at Module._compile (node:internal/modules/cjs/loader:1198:14)
at Module.m._compile (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/ts-node/src/index.ts:1597:23)
at Module._extensions..js (node:internal/modules/cjs/loader:1252:10)
Expected behavior
The cdk synth command should complete successfully.
Please complete the following information about the solution:
[ ] Version: [e.g. v1.0.0] - N/A as the solution is failing on the cdk synth step.
To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0191) - Automated Forensics for Amazon EC2. Version v5.0.0". If the description does not contain the version information, you can look at the mappings section of the template:
abewub
commented
1 month ago
To Reproduce The cdk synth command that we are executing is : (Sensitive info has been redacted) cdk synth -c account= -c sechubaccount= -c region=eu-west-2 -c STACK_BUILD_TARGET_ACCT=forensicAccount
Node Version used : Have tried with both v20.13.1 and v16.20.2 CDK version used: 2.141.0 (build 3d1c06e)
The error received on the console is as follows (Sensitive info has been redacted)
~/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/aws-cdk-lib/core/lib/asset-staging.js:1 "use strict";var _a;Object.defineProperty(exports,"__esModule",{value:!0}),exports.AssetStaging=void 0;const jsiiDeprecationWarnings=require("../../.warnings.jsii.js"),JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti"),crypto=require("crypto"),path=require("path"),constructs_1=require("constructs"),fs=require("fs-extra"),assets_1=require("./assets"),bundling_1=require("./bundling"),fs_1=require("./fs"),fingerprint_1=require("./fs/fingerprint"),names_1=require("./names"),asset_staging_1=require("./private/asset-staging"),cache_1=require("./private/cache"),stack_1=require("./stack"),stage_1=require("./stage"),cxapi=require("../../cx-api"),ARCHIVE_EXTENSIONS=[".tar.gz",".zip",".jar",".tar",".tgz"],ASSET_SALT_CONTEXT_KEY="@aws-cdk/core:assetHashSalt";class AssetStaging extends constructs_1.Construct{static clearAssetHashCache(){this.assetCache.clear(),(0,fingerprint_1.clearLargeFileFingerprintCache)()}constructor(scope,id,props){super(scope,id);try{jsiiDeprecationWarnings.aws_cdk_lib_AssetStagingProps(props)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,AssetStaging),error}const salt=this.node.tryGetContext(ASSET_SALT_CONTEXT_KEY);if(this.sourcePath=path.resolve(props.sourcePath),this.fingerprintOptions={...props,extraHash:props.extraHash||salt?
${props.extraHash??""}${salt??""}:void 0},!fs.existsSync(this.sourcePath))throw new Error(Cannot find asset at ${this.sourcePath});this.sourceStats=fs.statSync(this.sourcePath);const outdir=stage_1.Stage.of(this)?.assetOutdir;if(!outdir)throw new Error('unable to determine cloud assembly asset output directory. Assets must be defined indirectly within a "Stage" or an "App" scope');this.assetOutdir=outdir,this.customSourceFingerprint=props.assetHash,this.hashType=determineHashType(props.assetHashType,this.customSourceFingerprint);let stageThisAsset,skip=!1;if(props.bundling){skip=!stack_1.Stack.of(this).bundlingRequired;const bundling=props.bundling;stageThisAsset=()=>this.stageByBundling(bundling,skip)}else stageThisAsset=()=>this.stageByCopying();this.cacheKey=calculateCacheKey({outdir:this.assetOutdir,sourcePath:path.resolve(props.sourcePath),bundling:props.bundling,assetHashType:this.hashType,customFingerprint:this.customSourceFingerprint,extraHash:props.extraHash,exclude:props.exclude,ignoreMode:props.ignoreMode,skip});const staged=AssetStaging.assetCache.obtain(this.cacheKey,stageThisAsset);this.stagedPath=staged.stagedPath,this.absoluteStagedPath=staged.stagedPath,this.assetHash=staged.assetHash,this.packaging=staged.packaging,this.isArchive=staged.isArchive}get sourceHash(){return this.assetHash}relativeStagedPath(stack){try{jsiiDeprecationWarnings.aws_cdk_lib_Stack(stack)}catch(error){throw process.env.JSII_DEBUG!=="1"&&error.name==="DeprecationError"&&Error.captureStackTrace(error,this.relativeStagedPath),error}const asmManifestDir=stage_1.Stage.of(stack)?.outdir;return asmManifestDir?path.relative(this.assetOutdir,this.stagedPath).startsWith("..")||this.stagingDisabled?this.stagedPath:path.relative(asmManifestDir,this.stagedPath):this.stagedPath}stageByCopying(){const assetHash=this.calculateHash(this.hashType),stagedPath=this.stagingDisabled?this.sourcePath:path.resolve(this.assetOutdir,renderAssetFilename(assetHash,getExtension(this.sourcePath)));if(!this.sourceStats.isDirectory()&&!this.sourceStats.isFile())throw new Error(Asset ${this.sourcePath} is expected to be either a directory or a regular file);return this.stageAsset(this.sourcePath,stagedPath,"copy"),{assetHash,stagedPath,packaging:this.sourceStats.isDirectory()?assets_1.FileAssetPackaging.ZIP_DIRECTORY:assets_1.FileAssetPackaging.FILE,isArchive:this.sourceStats.isDirectory()||ARCHIVE_EXTENSIONS.includes(getExtension(this.sourcePath).toLowerCase())}}stageByBundling(bundling,skip){if(!this.sourceStats.isDirectory())throw new Error(Asset ${this.sourcePath} is expected to be a directory when bundling);if(skip){let hashType=this.hashType;return(hashType===assets_1.AssetHashType.OUTPUT||hashType===assets_1.AssetHashType.BUNDLE)&&(this.customSourceFingerprint=names_1.Names.uniqueId(this),hashType=assets_1.AssetHashType.CUSTOM),{assetHash:this.calculateHash(hashType,bundling),stagedPath:this.sourcePath,packaging:assets_1.FileAssetPackaging.ZIP_DIRECTORY,isArchive:!0}}let assetHash=this.hashType===assets_1.AssetHashType.SOURCE||this.hashType===assets_1.AssetHashType.CUSTOM?this.calculateHash(this.hashType,bundling):void 0;const bundleDir=this.determineBundleDir(this.assetOutdir,assetHash);this.bundle(bundling,bundleDir);const bundlingOutputType=bundling.outputType??bundling_1.BundlingOutput.AUTO_DISCOVER,bundledAsset=determineBundledAsset(bundleDir,bundlingOutputType);assetHash=assetHash??this.calculateHash(this.hashType,bundling,bundledAsset.path);const stagedPath=path.resolve(this.assetOutdir,renderAssetFilename(assetHash,bundledAsset.extension));return this.stageAsset(bundledAsset.path,stagedPath,"move"),bundledAsset.packaging===assets_1.FileAssetPackaging.FILE&&fs.closeSync(fs.openSync(bundledAsset.path,"w")),{assetHash,stagedPath,packaging:bundledAsset.packaging,isArchive:!0}}get stagingDisabled(){return!!this.node.tryGetContext(cxapi.DISABLE_ASSET_STAGING_CONTEXT)}stageAsset(sourcePath,targetPath,style){if(fs.existsSync(targetPath)){style==="move"&&sourcePath!==targetPath&&fs.removeSync(sourcePath);return}if(style=="move"){fs.renameSync(sourcePath,targetPath);return}if(this.sourceStats.isFile())fs.copyFileSync(sourcePath,targetPath);else if(this.sourceStats.isDirectory())fs.mkdirSync(targetPath),fs_1.FileSystem.copyDirectory(sourcePath,targetPath,this.fingerprintOptions);else throw new Error(Unknown file type: ${sourcePath})}determineBundleDir(outdir,sourceHash){return sourceHash?path.resolve(outdir,renderAssetFilename(sourceHash)):path.resolve(outdir,bundling-temp-${this.cacheKey})}bundle(options,bundleDir){if(fs.existsSync(bundleDir))return;fs.ensureDirSync(bundleDir),fs.chmodSync(bundleDir,511);let localBundling;try{if(process.stderr.write(`Bundling asset ${this.node.path}...Error: Cannot find asset at ~/automated-forensic-orchestrator-for-amazon-ec2/source/lib/lambda/dist/lambda at new AssetStaging (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/aws-cdk-lib/core/lib/asset-staging.js:1:1402) at new Asset (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/aws-cdk-lib/aws-s3-assets/lib/asset.js:1:736) at AssetCode.bind (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/aws-cdk-lib/aws-lambda/lib/code.js:1:4628) at new Function (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/aws-cdk-lib/aws-lambda/lib/function.js:1:7479) at new SolutionMetricsCollectorConstruct (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/lib/infra-utils/solution-metrics-collector.ts:42:40) at new ForensicsSolutionsConstructsStack (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/lib/forensic-solution-builder-stack.ts:727:9) at Object. (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/bin/forensic-cdk-solution.ts:57:37)
at Module._compile (node:internal/modules/cjs/loader:1198:14)
at Module.m._compile (/mnt/c/Users/608224303/Gitcheckouts/APP14965/aws/miscellaneous/automated-forensic-orchestrator-for-amazon-ec2/source/node_modules/ts-node/src/index.ts:1597:23)
at Module._extensions..js (node:internal/modules/cjs/loader:1252:10)
==============================================================================================================================================================
Expected behavior The cdk synth command should complete successfully.
Please complete the following information about the solution:
To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0191) - Automated Forensics for Amazon EC2. Version v5.0.0". If the description does not contain the version information, you can look at the mappings section of the template:
[ ] Was the solution modified from the version published on this repository?
These are the changes that were done post checkout. (Sensitive info has been redacted)
source/cdk.json - The vpcConfigDetails block was modified to use an existing VPC "vpcConfigDetails": { "isExistingVPC": true, "vpcID": "",
"enableVPCEndpoints": false,
"enableVpcFlowLog": false
}
}
}
The Forensics AMI for eu-west-2 was added to the toolsAMI block
"toolsAMI": {
"ap-southeast-2": { "amiID": "ami-07620139298af599e" },
"ap-southeast-1": { "amiID": "ami-0c802847a7dd848c0" },
"us-east-1": { "amiID": "ami-0cff7528ff583bf9a" },
"us-east-2": { "amiID": "ami-02d1e544b84bf7502" },
"us-west-1": { "amiID": "ami-0d9858aa3c6322f73" },
"us-west-2": { "amiID": "ami-098e42ae54c764c35" },
"ca-central-1": { "amiID": "ami-00f881f027a6d74a0" },
"ap-northeast-1": { "amiID": "ami-0b7546e839d7ace12" },
"ap-northeast-2": { "amiID": "ami-0fd0765afb77bcca7" },
"eu-west-2": { "amiID": "ami-078a289ddf4b09ae0" }
}
The wrapt module was upgraded to the latest version to solve some issues with the npm build stage. source/lambda/requirements.txt wrapt==1.16.0
via
=====================================================================================================================
Screenshots If applicable, add screenshots to help explain your problem (please DO NOT include sensitive information).
Additional context Add any other context about the problem here.