-
Notifications
You must be signed in to change notification settings - Fork 69
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(HIPAA Security): ELB checks (#349)
Closes #158 Closes #159 Closes #253 Closes #254 Closes #255 Closes #256 Closes #257 Closes #258 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
- Loading branch information
Showing
19 changed files
with
974 additions
and
17 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
30 changes: 30 additions & 0 deletions
30
src/HIPAA-Security/rules/elb/hipaaSecurityALBHttpDropInvalidHeaderEnabled.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| /* | ||
| Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| import { CfnLoadBalancer } from '@aws-cdk/aws-elasticloadbalancingv2'; | ||
| import { IConstruct, Stack } from '@aws-cdk/core'; | ||
|
|
||
| /** | ||
| * Application Load Balancers are enabled to drop invalid headers - (Control IDs: 164.312(a)(2)(iv), 164.312(e)(1), 164.312(e)(2)(i), 164.312(e)(2)(ii)) | ||
| * @param node the CfnResource to check | ||
| */ | ||
| export default function (node: IConstruct): boolean { | ||
| if (node instanceof CfnLoadBalancer) { | ||
| const type = Stack.of(node).resolve(node.type); | ||
| if (type == undefined || type == 'application') { | ||
| const attributes = Stack.of(node).resolve(node.loadBalancerAttributes); | ||
| if (attributes != undefined) { | ||
| const reg = | ||
| /"routing\.http\.drop_invalid_header_fields\.enabled","value":"true"/gm; | ||
| if (JSON.stringify(attributes).search(reg) == -1) { | ||
| return false; | ||
| } | ||
| } else { | ||
| return false; | ||
| } | ||
| } | ||
| } | ||
| return true; | ||
| } |
33 changes: 33 additions & 0 deletions
33
src/HIPAA-Security/rules/elb/hipaaSecurityALBHttpToHttpsRedirection.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| /* | ||
| Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| import { CfnListener } from '@aws-cdk/aws-elasticloadbalancingv2'; | ||
| import { IConstruct, Stack } from '@aws-cdk/core'; | ||
|
|
||
| /** | ||
| * ALB HTTP listeners are configured to redirect to HTTPS - (Control IDs: 164.312(a)(2)(iv), 164.312(e)(1), 164.312(e)(2)(i), 164.312(e)(2)(ii)) | ||
| * @param node the CfnResource to check | ||
| */ | ||
| export default function (node: IConstruct): boolean { | ||
| if (node instanceof CfnListener) { | ||
| let found = false; | ||
| const protocol = Stack.of(node).resolve(node.protocol); | ||
| const actions = Stack.of(node).resolve(node.defaultActions); | ||
|
|
||
| if (protocol == 'HTTP') { | ||
| for (const action of actions) { | ||
| if ( | ||
| action.type == 'redirect' && | ||
| action.redirectConfig.protocol == 'HTTPS' | ||
| ) { | ||
| found = true; | ||
| } | ||
| } | ||
| if (!found) return false; | ||
| } | ||
| } | ||
|
|
||
| return true; | ||
| } |
35 changes: 35 additions & 0 deletions
35
src/HIPAA-Security/rules/elb/hipaaSecurityELBACMCertificateRequired.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| /* | ||
| Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| import { CfnLoadBalancer } from '@aws-cdk/aws-elasticloadbalancing'; | ||
| import { IConstruct, Stack } from '@aws-cdk/core'; | ||
|
|
||
| /** | ||
| * CLBs use ACM-managed certificates - (Control IDs: 164.312(a)(2)(iv), 164.312(e)(1), 164.312(e)(2)(i), 164.312(e)(2)(ii)) | ||
| * @param node the CfnResource to check | ||
| */ | ||
| export default function (node: IConstruct): boolean { | ||
| if (node instanceof CfnLoadBalancer) { | ||
| //For each listener, ensure that it's utilizing an ACM SSL/HTTPS cert | ||
| const listeners = Stack.of(node).resolve(node.listeners); | ||
| if (listeners != undefined) { | ||
| //Iterate through listeners, checking if secured ACM certs are used | ||
| for (const listener of listeners) { | ||
| const resolvedListener = Stack.of(node).resolve(listener); | ||
| const listenerARN = resolvedListener.sslCertificateId; | ||
| //Use the ARN to check if this is an ACM managed cert | ||
| if (listenerARN == undefined) { | ||
| return false; | ||
| } else { | ||
| const acmRegex = /^arn:[^:]+:acm:.+$/; | ||
| if (!acmRegex.test(listenerARN)) { | ||
| return false; | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
| return true; | ||
| } |
34 changes: 34 additions & 0 deletions
34
src/HIPAA-Security/rules/elb/hipaaSecurityELBCrossZoneBalancingEnabled.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| /* | ||
| Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| import { CfnLoadBalancer } from '@aws-cdk/aws-elasticloadbalancing'; | ||
| import { IConstruct, Stack } from '@aws-cdk/core'; | ||
|
|
||
| /** | ||
| * CLBs use at least two AZs with the Cross-Zone Load Balancing feature enabled - (Control IDs: 164.308(a)(7)(i), 164.308(a)(7)(ii)(C)) | ||
| * @param node the CfnResource to check | ||
| */ | ||
| export default function (node: IConstruct): boolean { | ||
| if (node instanceof CfnLoadBalancer) { | ||
| if (node.crossZone == undefined) { | ||
| return false; | ||
| } | ||
| if (node.subnets == undefined) { | ||
| if ( | ||
| node.availabilityZones == undefined || | ||
| node.availabilityZones.length < 2 | ||
| ) { | ||
| return false; | ||
| } | ||
| } else if (node.subnets.length < 2) { | ||
| return false; | ||
| } | ||
| const crossZone = Stack.of(node).resolve(node.crossZone); | ||
| if (crossZone != true) { | ||
| return false; | ||
| } | ||
| } | ||
| return true; | ||
| } |
37 changes: 37 additions & 0 deletions
37
src/HIPAA-Security/rules/elb/hipaaSecurityELBDeletionProtectionEnabled.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| /* | ||
| Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
| SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
|
|
||
| import { CfnLoadBalancer } from '@aws-cdk/aws-elasticloadbalancingv2'; | ||
| import { IConstruct, Stack } from '@aws-cdk/core'; | ||
|
|
||
| /** | ||
| * ALBs, NLBs, and GLBs have deletion protection enabled - (Control IDs: 164.308(a)(7)(i), 164.308(a)(7)(ii)(C)) | ||
| * @param node the CfnResource to check | ||
| */ | ||
| export default function (node: IConstruct): boolean { | ||
| if (node instanceof CfnLoadBalancer) { | ||
| const attributes = Stack.of(node).resolve(node.loadBalancerAttributes); | ||
| if (attributes != undefined) { | ||
| var deletionProtectionEnabled = false; | ||
| for (const attr of attributes) { | ||
| const resolvedAttr = Stack.of(node).resolve(attr); | ||
| if ( | ||
| resolvedAttr.key != undefined && | ||
| resolvedAttr.key == 'deletion_protection.enabled' | ||
| ) { | ||
| if (resolvedAttr.value == 'true') { | ||
| deletionProtectionEnabled = true; | ||
| } | ||
| } | ||
| } | ||
| if (!deletionProtectionEnabled) { | ||
| return false; | ||
| } | ||
| } else { | ||
| return false; | ||
| } | ||
| } | ||
| return true; | ||
| } |
Oops, something went wrong.