HIPAA Security - Implement cloudwatch-alarm-action-check config rule

[dontirun]

Summary

As a developer

I would like to implement the cloudwatch-alarm-action-check config rule

So that I can check if qualified resources in my CDK app conforms to the following HIPAA Security control(s): 164.312(b)

Details

ruleId: HIPAA.Security-CloudWatchAlarmAction

info: The CloudWatch Alarm does not have at least one alarm action, one INSUFFICIENT_DATA action, or one OK action enabled - (Control IDs: 164.312(b))

Given Reason: Amazon CloudWatch alarms alert when a metric breaches the threshold for a specified number of evaluation periods. The alarm performs one or more actions based on the value of the metric or expression relative to a threshold over a number of time periods. This rule requires a value for alarmActionRequired (Config Default: True), insufficientDataActionRequired (Config Default: True), okActionRequired (Config Default: False). The actual value should reflect the alarm actions for your environment.

Acceptance Criteria

If the rule can be implemented

Given a CDK app with a non-compliant resource

• When HIPAA Security Pack is enabled
• Then the CDK stack does not deploy and the user receives an ERROR with relevant Control ID information about the non compliant resource

Given a CDK app with a compliant resource

• When HIPAA Security Pack is enabled
• Then the CDK stack deploys and the user does not receive an ERROR about the compliant resource

Given the cdk-nag RULES file

• When the HIPAA.Security-CloudWatchAlarmAction rule is added to the rule pack
• Then the HIPAA Security Errors section is updated with the rule information

If the rule cannot be implemented

Given the cdk-nag RULES file

• When the cloudwatch-alarm-action-check check is not added to the rule pack
• Then the HIPAA Security Excluded Rules section is updated with the check information