aws-servicecatalog-prescriptivecompliance/cft/aws-servicecatalog-configremediations-v2.yml [1:105]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
AWSTemplateFormatVersion: 2010-09-09
Description: Service Catalog Compliance Remediations


# -------------------------------------------------------------------------------------------------------------------------------------------------------
#  
# Reinforce 21 - Prescriptive Compliance
# To be deployed by a Team Member in their Team Account
# Provides automated detection and remediation for misconfigured resources
# ---Integrates AWS Config Managed Rules with Custom AWS System Manager Automation Documents
# 
# 
# @kmmahaj
# -------------------------------------------------------------------------------------------------------------------------------------------------------

Resources:
  
# -------------------------------------------------------------------------------------------------------------------------------------------------------
# PCI.KMS.1 – Ensure rotation for customer created CMKs is enabled
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  
  CMKBackingKeyRotation:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: cmk-backing-key-rotation-enabled
      Description: >-
        PCI.KMS.1 – Ensure rotation for customer created CMKs is enabled
      Scope:
        ComplianceResourceTypes:
        - "AWS::KMS::Key"
      Source:
        Owner: AWS
        SourceIdentifier: CMK_BACKING_KEY_ROTATION_ENABLED
      MaximumExecutionFrequency: One_Hour
  CMKBackingKeyRotationRemediation:
    DependsOn: CMKBackingKeyRotation
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: cmk-backing-key-rotation-enabled
      ResourceType: "AWS::KMS::Key"
      TargetId: "Custom-SCCMKBackingKeyRotationCF"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !ImportValue SCAutomationAssumeRoleArn
        KMSKeyArn:
          ResourceValue:
            Value: "RESOURCE_ID"
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60

    
# -------------------------------------------------------------------------------------------------------------------------------------------------------
# PCI.EC2.2 VPC default security group should prohibit inbound and outbound traffic
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  RestrictDefaultSecurityGroup:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: RestrictDefaultSecurityGroup
      Description: >-
        PCI.EC2.2 VPC default security group should prohibit inbound and outbound traffic
      Scope:
        ComplianceResourceTypes:
        - "AWS::EC2::SecurityGroup"
      Source:
        Owner: AWS
        SourceIdentifier: VPC_DEFAULT_SECURITY_GROUP_CLOSED
  RestrictDefaultSecurityGroupRemediation:
    DependsOn: RestrictDefaultSecurityGroup
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: RestrictDefaultSecurityGroup
      ResourceType: "AWS::EC2::SecurityGroup"
      TargetId: "Custom-SCRestrictSecurityGroup"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !ImportValue SCAutomationAssumeRoleArn
        IpAddressToBlock:
          StaticValue:
            Values:
              - '0.0.0.0/0'
        groupId:
          ResourceValue:
            Value: "RESOURCE_ID"
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-servicecatalog-prescriptivecompliance/cft/aws-servicecatalog-configremediations.yml [1:105]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
AWSTemplateFormatVersion: 2010-09-09
Description: Service Catalog Compliance Remediations


# -------------------------------------------------------------------------------------------------------------------------------------------------------
#  
# Reinvent 21 - Prescriptive Compliance
# To be deployed by a Team Member in their Team Account
# Provides automated detection and remediation for misconfigured resources
# ---Integrates AWS Config Managed Rules with Custom AWS System Manager Automation Documents
# 
# 
# @kmmahaj
# -------------------------------------------------------------------------------------------------------------------------------------------------------

Resources:
  
# -------------------------------------------------------------------------------------------------------------------------------------------------------
# PCI.KMS.1 – Ensure rotation for customer created CMKs is enabled
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  
  CMKBackingKeyRotation:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: cmk-backing-key-rotation-enabled
      Description: >-
        PCI.KMS.1 – Ensure rotation for customer created CMKs is enabled
      Scope:
        ComplianceResourceTypes:
        - "AWS::KMS::Key"
      Source:
        Owner: AWS
        SourceIdentifier: CMK_BACKING_KEY_ROTATION_ENABLED
      MaximumExecutionFrequency: One_Hour
  CMKBackingKeyRotationRemediation:
    DependsOn: CMKBackingKeyRotation
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: cmk-backing-key-rotation-enabled
      ResourceType: "AWS::KMS::Key"
      TargetId: "Custom-SCCMKBackingKeyRotationCF"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !ImportValue SCAutomationAssumeRoleArn
        KMSKeyArn:
          ResourceValue:
            Value: "RESOURCE_ID"
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60

    
# -------------------------------------------------------------------------------------------------------------------------------------------------------
# PCI.EC2.2 VPC default security group should prohibit inbound and outbound traffic
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  RestrictDefaultSecurityGroup:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: RestrictDefaultSecurityGroup
      Description: >-
        PCI.EC2.2 VPC default security group should prohibit inbound and outbound traffic
      Scope:
        ComplianceResourceTypes:
        - "AWS::EC2::SecurityGroup"
      Source:
        Owner: AWS
        SourceIdentifier: VPC_DEFAULT_SECURITY_GROUP_CLOSED
  RestrictDefaultSecurityGroupRemediation:
    DependsOn: RestrictDefaultSecurityGroup
    Type: 'AWS::Config::RemediationConfiguration'
    Properties:
      ConfigRuleName: RestrictDefaultSecurityGroup
      ResourceType: "AWS::EC2::SecurityGroup"
      TargetId: "Custom-SCRestrictSecurityGroup"
      TargetType: "SSM_DOCUMENT"
      TargetVersion: "1"
      Parameters:
        AutomationAssumeRole:
          StaticValue:
            Values:
              - !ImportValue SCAutomationAssumeRoleArn
        IpAddressToBlock:
          StaticValue:
            Values:
              - '0.0.0.0/0'
        groupId:
          ResourceValue:
            Value: "RESOURCE_ID"
      ExecutionControls:
        SsmControls:
          ConcurrentExecutionRatePercentage: 10
          ErrorPercentage: 10
      Automatic: True
      MaximumAutomaticAttempts: 5
      RetryAttemptSeconds: 60
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



