search

aws-solutions / automated-security-response-on-aws

Automated Security Response on AWS is an add-on solution that works with AWS Security Hub to provide a ready-to-deploy architecture and a library of automated playbooks. The solution makes it easier for AWS Security Hub customers to resolve common security findings and to improve their security posture in AWS.
https://aws.amazon.com/solutions/implementations/aws-security-hub-automated-response-and-remediation/
Apache License 2.0
359 stars 102 forks source link

Remediation runbook missing for EC2.13 #196

Closed skl718 closed 1 month ago

skl718 commented 1 month ago

Describe the bug

EC2.13 points to a remediation runbook called "DisablePublicAccessForSecurityGroup" that doesn't seem to exist.

To Reproduce

Attempt to remediate finding for EC2.13 in Security Hub.

Expected behavior

Security group that failed the check will be remediated

Please complete the following information about the solution:

Screenshots If applicable, add screenshots to help explain your problem (please DO NOT include sensitive information). ASR1 ASR2 ASR3

Additional context Add any other context about the problem here.

AaronSchuetter commented 1 month ago

The runbook for this remediation is generated with the code in your screenshot and does not require a runbook in remediation_runbooks.

You will find a SSM automation document called ASR-NIST80053R5_5.0.0_EC2.13. Looking at this document shows that this remediation uses the AWS managed SSM document, AWS-DisablePublicAccessForSecurityGroup, to perform the remediation. This requires no custom scripts in remediation_runbooks/scripts.

I have tested this remediation in us-gov-west-1 and was able to successfully remediate the finding with ASR.

This remediation may be failing for another reason in your account. You can check the SO0111-SHARR-Orchestrator Step Function execution for an error message to further debug.