Cloud Conformity Auto Remediation

Disclaimer

This early "Auto Remediation" is subject to change. Cloud Conformity will use commercially reasonable efforts to support the previous version of the project. This project is provided on an ‘AS IS’ and ‘WHEN AVAILABLE’ basis. Cloud Conformity has no liability to user as a result of any changes made to their AWS infrastructure by installing this project.

Auto Remediation is an MIT open-source project, actively maintained by Cloud Conformity team.

How it works

The following image shows how Cloud Conformity Auto Remediation works:

Here's an example:

1. A user makes an S3 bucket publicly readable via S3 Access Control Lists (ACLs)
2. Cloud Conformity identifies the risk in real-time
3. Cloud Conformity publishes a message to the specified SNS Topic
4. SNS topic triggers the Orchestrator lambda function which in turns calls S3 bucket auto-remediate function
5. S3 BucketPublicReadAccess Auto Remediate Function (AutoRemediateS3-001) updates the S3 bucket ACL and closes the security gap

Prerequisites

1. Install Node.js v16 or later.

Installation

Note that you need to follow the Deleting a stack on the AWS CloudFormation console to delete the current stack if you plan to update to the latest version.

1. Create a working copy of "Cloud Conformity Auto Remediation" repository by running the following command:

   git clone https://github.com/cloudconformity/auto-remediate.git

2. Change directory to auto-remediation:

cd auto-remediate

3. IMPORTANT Update functions/config.json with required configurations. Please note that all the rules in config file are disabled by default to prevent unwanted changes. User needs to enable the ones they need manually.
4. IMPORTANT Make any other necessary adjustments before deployment.
5. Run npm install before deploying so that the node_modules folder would be available to AWS

npm install

6. Finally deploy

npx serverless deploy --region us-west-2

Message Format

The table below gives more information about SNS Message format:

Auto Remediate Functions

The table below lists the supported auto auto-remediate functions:

For more information about Rule Id, please refer to Cloud Conformity Services Endpoint

Note: if you want to exclude auto-remediate resources for certain rules, you can use Conformity Profile, for example, exclude-rules.json. The example profile provides a list of rules to exlude low risk rules or rules that require extra resources or configurations.

How to contribute

You are welcome to contribute to "Cloud Conformity Auto Remediation"

1. Fork the project
2. Make a well commented and clean commit to the repository
3. Create a pull request

Styleguide

The styleguide used for this project is Standard forced by eslint. To run eslint, you only need to run npm run lint [filename] or to run for the whole project, run npm run lint '**/*.js'. Refer to package.json for more info.

The main rules are as follows:

• 2 spaces – for indentation
• Single quotes for strings – except to avoid escaping
• No unused variables – this one catches tons of bugs!
• No semicolons – It's fine. Really!
• Never start a line with (, [, or `
• Space after keywords if (condition) { ... }
• Space after function name function name (arg) { ... }
• Always use === instead of == – but obj == null is allowed to check null || undefined.
• Always handle the node.js err function parameter
• Always prefix browser globals with window – except document and navigator are okay

About

Protect, Detect, Correct. The most complete solution to avoid critical threats and vulnerabilities in your AWS environments. Awarded both AWS Cloud Management Tools Competency and Security Partner Competency, Cloud Conformity’s security and optimization platform delivers continuous assurance that your infrastructure is risk-free and compliant as your cloud presence grows.