aws-remediate-cis-securityhub/cft/aws-cis-securityhubactions.yml [290:354]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                      DocumentVersion='1', # default
                      Parameters={
                          'TrailName': [ TrailName ],
                          'CloudTrailLogGroupArn': [ CloudTrailLogGroupArn ],
                          'CloudWatchRoleArn': [ CloudWatchRoleArn ],
                          'KMSKeyArn': [ KMSKeyArn ]
                      }
                  )

              except Exception as e:
                  print(e)
                  print("SSM automation execution error")
                  raise

  CloudTrailEncryptionEnabledLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
      - PolicyName: CloudTrailEncryptionEnabledLambdaPolicy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - cloudwatch:PutMetricData
            Resource: '*'
          - Effect: Allow
            Action:
            - ssm:StartAutomationExecution
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - logs:DescribeLogGroups
            - iam:PassRole
            Resource: '*'
          - Effect: Allow
            Action:
            - cloudtrail:UpdateTrail
            - kms:*
            - securityhub:UpdateFindings
            Resource: '*'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: { Service: lambda.amazonaws.com }
          Action:
          - sts:AssumeRole
  
# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 2.8 – Ensure rotation for customer created CMKs is enabled
# 
# Provisions a custom security hub action 
# Leverages the custom security hub action as source for CWE rule 
# Provisions a lambda as a CWE target for custom action
# Leverages custom SSM Automation document for remediation
# Repeats same pattern above for each CIS remediation
# 
# @kanishk.mahajan
# -------------------------------------------------------------------------------------------------------------------------------------------------------

  CMKBackingKeyRotationRule: 
    Type: AWS::Events::Rule
    Properties: 
      Name: CMKBackingKeyRotationRule
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-remediate-pci-securityhub/cft/aws-security-hub-pci-remediations-template2.yml [559:612]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                      DocumentVersion='1', # default
                      Parameters={
                          'TrailName': [ TrailName ],
                          'CloudTrailLogGroupArn': [ CloudTrailLogGroupArn ],
                          'CloudWatchRoleArn': [ CloudWatchRoleArn ],
                          'KMSKeyArn': [ KMSKeyArn ]
                      }
                  )

              except Exception as e:
                  print(e)
                  print("SSM automation execution error")
                  raise

  CloudTrailEncryptionEnabledLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
      - PolicyName: CloudTrailEncryptionEnabledLambdaPolicy
        PolicyDocument:
          Version: 2012-10-17
          Statement:
          - Effect: Allow
            Action:
            - cloudwatch:PutMetricData
            Resource: '*'
          - Effect: Allow
            Action:
            - ssm:StartAutomationExecution
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            - logs:DescribeLogGroups
            - iam:PassRole
            Resource: '*'
          - Effect: Allow
            Action:
            - cloudtrail:UpdateTrail
            - kms:*
            - securityhub:UpdateFindings
            Resource: '*'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
        - Effect: Allow
          Principal: { Service: lambda.amazonaws.com }
          Action:
          - sts:AssumeRole

#PCI.KMS.1
  CMKBackingKeyRotationRule: 
    Type: AWS::Events::Rule
    Properties: 
      Name: CMKBackingKeyRotationRule
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



