This PR aims to enhance the capabilities of the reporting command.
Sets a new MINIMUM_REPORT_SEVERITY that complements the slack MINIMUM_ALERT_SEVERITY variable. This variable is defined in cdk_app.yaml and defaults to INFO. This is useful for accounts with a large number of INFO-level findings. (ex: IAM_LINTER)
Enables detailed error reporting in Slack. Currently, non-blocking API errors will appear in collect logs and in Cloudwatch. This change allows per-account error counts to be presented. If no errors are detected, previous output message behavior is maintained.
Suppresses the 1000's of cloudwatch log lines that come from the upload/sync actions from ECS to S3.
Fixes the counts-of-findings-by-account graph in report.html
Clarifies (but does not alter) the existing default minimum severity filter for the report command.
Updates KNOWN_BAD_POLICIES to reference the new, safe V3 policy for AmazonMachineLearningRoleforRedshiftDataSourceV3
audit_s3_block_policy() will emit account_name in Finding() to quickly root cause the offending account.
EC2_IMDSV2_NOT_ENFORCED now provides the current MetaData Options to measure against. Also provides the ssh_key and instance ID, to assist with finding resources and determining risk.
SG_CIDR_OVERLAPS and SG_LARGE_CIDR attempt to provide Security Group descriptive information.
This PR aims to enhance the capabilities of the reporting command.
MINIMUM_REPORT_SEVERITY
that complements the slackMINIMUM_ALERT_SEVERITY
variable. This variable is defined incdk_app.yaml
and defaults to INFO. This is useful for accounts with a large number of INFO-level findings. (ex:IAM_LINTER
)counts-of-findings-by-account
graph inreport.html
report
command.KNOWN_BAD_POLICIES
to reference the new, safe V3 policy forAmazonMachineLearningRoleforRedshiftDataSourceV3
audit_s3_block_policy()
will emitaccount_name
inFinding()
to quickly root cause the offending account.EC2_IMDSV2_NOT_ENFORCED
now provides the current MetaData Options to measure against. Also provides the ssh_key and instance ID, to assist with finding resources and determining risk.SG_CIDR_OVERLAPS
andSG_LARGE_CIDR
attempt to provide Security Group descriptive information.