如何使用 Terraform 为 Amazon GuardDuty 发现配置自动事件响应

git clone https://github.com/build-on-aws/automating-amazon-guardduty-with-iac.git

variable "vpc_id" {

}

# GET CURRENT AWS ACCOUNT NUMBER
 
data "aws_caller_identity" "current" {}

# CREATE TWO S3 BUCKETS

resource "aws_s3_bucket" "bucket" {
 bucket = "guardduty-example-${data.aws_caller_identity.current.account_id}-us-east-1"
 force_destroy = true
}

resource "aws_s3_bucket" "flow-log-bucket" {
 bucket = "vpc-flow-logs-${data.aws_caller_identity.current.account_id}-us-east-1"
 force_destroy = true
}

# VPC FLOW LOGS
 resource "aws_flow_log" "flow_log_example" {
 log_destination = aws_s3_bucket.flow-log-bucket.arn
 log_destination_type = "s3"
 traffic_type = "ALL"
 vpc_id = var.vpc_id
 }

# S3 Bucket id
 output "bucket_id" {
 value = aws_s3_bucket.bucket.id
 description = "Output of s3 bucket id."
 }

 # S3 Bucket arn
 output "bucket_arn" {
 value = aws_s3_bucket.bucket.arn
 description = "Output of s3 bucket arn."
 }

# CREATES S3 BUCKET
module "s3_bucket" {
 source = "./modules/s3"
 vpc_id = module.iac_vpc.vpc_attributes.id
}

variable "bucket" {

}

variable "malicious_ip" {

}

# ENABLE THE DETECTOR
resource "aws_guardduty_detector" "gd-tutorial" {
 enable = true
 finding_publishing_frequency = "FIFTEEN_MINUTES"
}

# ADD THE EIP/MALICIOUS IP TO THE BUCKET AS A TEXT FILE.
resource "aws_s3_object" "MyThreatIntelSet" {
 content = var.malicious_ip
 bucket = var.bucket
 key = "MyThreatIntelSet"
}

# HAVE GUARDDUTY LOOK AT THE TEXT FILE IN S3
resource "aws_guardduty_threatintelset" "Example-Threat-List" {
 activate = true
 detector_id = aws_guardduty_detector.gd-tutorial.id
 format = "TXT"
 location = "https://s3.amazonaws.com/${aws_s3_object.MyThreatIntelSet.bucket}/${aws_s3_object.MyThreatIntelSet.key}"
 name = "MyThreatIntelSet"
}

# Enable GuardDuty
module "guardduty" {
 source = "./modules/guardduty"
 bucket = module.s3_bucket.bucket_id
 malicious_ip = module.compute.malicious_ip
}

variable "sns_name" {
 description = "Name of the SNS Topic to be created"
 default = "GuardDuty-Example"
}

variable "email" {
 description = "Email address for SNS"
}

# Create the SNS topic
 
 resource "aws_sns_topic" "gd_sns_topic" {
 name = var.sns_name
 }

resource "aws_sns_topic_policy" "gd_sns_topic_policy" {
 arn = aws_sns_topic.gd_sns_topic.arn
 policy = jsonencode(
 {
 Id = "ID-GD-Topic-Policy"
 Statement = [
 {
 Action = "sns:Publish"
 Effect = "Allow"
 Principal = {
 Service = "events.amazonaws.com"
 }
 Resource = aws_sns_topic.gd_sns_topic.arn
 Sid = "SID-GD-Example"
 },
 ]
 Version = "2012-10-17"
 }
 )
 }

# Create the topic subscription
 
 resource "aws_sns_topic_subscription" "user_updates_sqs_target" {
 topic_arn = aws_sns_topic.gd_sns_topic.arn
 protocol = "email"
 endpoint = var.email
 endpoint_auto_confirms = false
 }

output "sns_topic_arn" {
 value = aws_sns_topic.gd_sns_topic.arn
 description = "Output of ARN to call in the eventbridge rule."
}

# Creates an SNS Topic

 module "guardduty_sns_topic" {
 source = "./modules/sns"
 email = "youremailaddress@domain.com"
 }

variable "sns_topic_arn" {

}

# EVENT RULE RESOURCE
resource "aws_cloudwatch_event_rule" "GuardDuty-Event-EC2-MaliciousIPCaller" {
 name = "GuardDuty-Event-EC2-MaliciousIPCaller"
 description = "GuardDuty Event: UnauthorizedAccess:EC2/MaliciousIPCaller.Custom"

 event_pattern = <<EOF
{
 "source": ["aws.guardduty"],
 "detail": {
 "type": ["UnauthorizedAccess:EC2/MaliciousIPCaller.Custom"]
 }
}
 EOF
}

# EVENT TARGET RESOURCE FOR SNS NOTIFICATIONS
 resource "aws_cloudwatch_event_target" "sns" {

 rule = aws_cloudwatch_event_rule.GuardDuty-Event-EC2-MaliciousIPCaller.name
 target_id = "GuardDuty-Example"
 arn = var.sns_topic_arn

 input_transformer {
 input_paths = {
 gdid = "$.detail.id",
 region = "$.detail.region",
 instanceid = "$.detail.resource.instanceDetails.instanceId"
 }
 input_template = "\"First GuardDuty Finding for the GuardDuty-IAC tutorial. | ID:<gdid> | The EC2 instance: <instanceid>, may be compromised and should be investigated. Go to https://console.aws.amazon.com/guardduty/home?region=<region>#/findings?macros=current&fId=<gdid>\""
 }
 }

# EVENT RULE RESOURCE
 resource "aws_cloudwatch_event_rule" "GuardDuty-Event-IAMUser-MaliciousIPCaller" {
 name = "GuardDuty-Event-IAMUser-MaliciousIPCaller"
 description = "GuardDuty Event: UnauthorizedAccess:IAMUser/MaliciousIPCaller.Custom"
 event_pattern = <<EOF
 {
 "source": ["aws.guardduty"],
 "detail": {
 "type": ["UnauthorizedAccess:IAMUser/MaliciousIPCaller.Custom", "Discovery:S3/MaliciousIPCaller.Custom"]
 }
 }
 EOF
 }

 #EVENT TARGET RESOURCE FOR SNS NOTIFICATIONS
 resource "aws_cloudwatch_event_target" "iam-sns" {

 rule = aws_cloudwatch_event_rule.GuardDuty-Event-IAMUser-MaliciousIPCaller.name
 target_id = "GuardDuty-Example"
 arn = var.sns_topic_arn

 input_transformer {
 input_paths = {
 gdid = "$.detail.id",
 region = "$.detail.region",
 userName = "$.detail.resource.accessKeyDetails.userName"
 } 
 input_template = "\"Second GuardDuty Finding for the GuardDuty-IAC tutorial. | ID:<gdid> | AWS Region:<region>. An AWS API operation was invoked (userName: <userName>) from an IP address that is included on your threat list and should be investigated.Go to https://console.aws.amazon.com/guardduty/home?region=<region>#/findings?macros=current&fId=<gdid>\""
 }
 }

# Create the EventBridge rule

module "guardduty_eventbridge_rule" {
 source = "./modules/eventbridge"
 sns_topic_arn = module.guardduty_sns_topic.sns_topic_arn
}

data "aws_iam_policy_document" "GD-EC2MaliciousIPCaller-policy-document" {
 statement {
 effect = "Allow"
 actions = ["sts:AssumeRole"]
 principals {
 type = "Service"
 identifiers = ["lambda.amazonaws.com"]
 }
 }
}

resource "aws_iam_role_policy" "GD-EC2MaliciousIPCaller-inline-role-policy" {
 name = "GD-EC2MaliciousIPCaller-inline-role-policy"
 role = aws_iam_role.GD-Lambda-EC2MaliciousIPCaller-role.id

 policy = jsonencode({
 "Version" : "2012-10-17",
 "Statement" : [
 {
 "Action" : [
 "ssm:PutParameter",
 "ec2:AuthorizeSecurityGroupEgress",
 "ec2:AuthorizeSecurityGroupIngress",
 "ec2:CreateSecurityGroup",
 "ec2:DescribeSecurityGroups",
 "ec2:RevokeSecurityGroupEgress",
 "ec2:RevokeSecurityGroupIngress",
 "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
 "ec2:UpdateSecurityGroupRuleDescriptionsIngress",
 "ec2:DescribeInstances",
 "ec2:UpdateSecurityGroupRuleDescriptionsIngress",
 "ec2:DescribeVpcs",
 "ec2:ModifyInstanceAttribute",
 "lambda:InvokeFunction",
 "cloudwatch:PutMetricData",
 "xray:PutTraceSegments",
 "xray:PutTelemetryRecords"
 ],
 "Resource" : "*",
 "Effect" : "Allow"
 },
 {
 "Action" : [
 "logs:*"
 ],
 "Resource" : "arn:aws:logs:*:*:*",
 "Effect" : "Allow"
 },
 {
 "Action" : [
 "sns:Publish"
 ],
 "Resource" : var.sns_topic_arn,
 "Effect" : "Allow"
 } 
 ]
 })
}

resource "aws_iam_role" "GD-Lambda-EC2MaliciousIPCaller-role" {
 name = "GD-Lambda-EC2MaliciousIPCaller-role1"
 assume_role_policy = data.aws_iam_policy_document.GD-EC2MaliciousIPCaller-policy-document.json
}

data "archive_file" "python_lambda_package" {
 type = "zip"
 source_file = "${path.module}/code/index.py"
 output_path = "index.zip"
}

resource "aws_lambda_permission" "GuardDuty-Hands-On-RemediationLambda" {
 statement_id = "GuardDutyTerraformRemediationLambdaEC2InvokePermissions"
 action = "lambda:InvokeFunction"
 function_name = aws_lambda_function.GuardDuty-Example-Remediation-EC2MaliciousIPCaller.function_name
 principal = "events.amazonaws.com"
}

variable "sns_topic_arn" {

}

variable "compromised_instance_id" {

}

variable "forensic_sg_id" {

}

# Create the Lambda function Resource

resource "aws_lambda_function" "GuardDuty-Example-Remediation-EC2MaliciousIPCaller" {
 function_name = "GuardDuty-Example-Remediation-EC2MaliciousIPCaller"
 filename = "index.zip"
 source_code_hash = data.archive_file.python_lambda_package.output_base64sha256
 role = aws_iam_role.GD-Lambda-EC2MaliciousIPCaller-role.arn
 runtime = "python3.9"
 handler = "index.handler"
 timeout = 10
 environment {
 variables = {
 INSTANCE_ID = var.compromised_instance_id
 FORENSICS_SG = var.forensic_sg_id
 TOPIC_ARN = var.sns_topic_arn
 }
 }
}

# CREATE THE LAMBDA FUNCTION
module "lambda" {
 source = "./modules/lambda"
 sns_topic_arn = module.guardduty_sns_topic.sns_topic_arn
 compromised_instance_id = module.compute.compromised_instance_id
 forensic_sg_id = module.forensic-security-group.security_group_id
}

# CREATES THE FORENSICS_SG SECURITY GROUP
module "forensic-security-group" {
 source = "terraform-aws-modules/security-group/aws"
 version = "4.17.1"

 name = "FORENSIC_SG"
 description = "Forensic Security group "
 vpc_id = module.iac_vpc.vpc_attributes.id
}

output "forensic_sg_id" {
 value = module.forensic-security-group.security_group_id
 description = "Output of forensic sg id created - to place the EC2 instance(s)."
 }

#EVENT TARGET RESOURCE FOR LAMBDA REMEDIATION FUNCTION

resource "aws_cloudwatch_event_target" "lambda_function" {

 rule = aws_cloudwatch_event_rule.GuardDuty-Event-EC2-MaliciousIPCaller.name
 target_id = "GuardDuty-Example-Remediation"
 arn = var.lambda_remediation_function_arn
}

output "lambda_remediation_function_arn" {
 value = aws_lambda_function.GuardDuty-Example-Remediation-EC2MaliciousIPCaller.arn
}

variable "lambda_remediation_function_arn" {

}

module "guardduty_eventbridge_rule" {
 source = "./modules/eventbridge"
 sns_topic_arn = module.guardduty_sns_topic.sns_topic_arn
 lambda_remediation_function_arn = module.lambda.lambda_remediation_function_arn
}