【CloudFormation】Security Hubに集約した検出結果を整形して通知する仕組みを実装してみた

AWSTemplateFormatVersion: "2010-09-09"
Description: "Set security alert shaping"
Parameters:
  Prefix:
    Type: String
    Default: cm
  GuardDutySeverities:
    Type: CommaDelimitedList
    Default: "LOW,MEDIUM,HIGH,CRITICAL"
  SecurityHubSeverities:
    Type: CommaDelimitedList
    Default: "LOW,MEDIUM,HIGH,CRITICAL,INFORMATIONAL"

Resources:
  #整形用ステートマシン
  SecurityAlertShapingStateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      Definition:
        {
          "Comment": "A description of my state machine",
          "StartAt": "Choice Service",
          "States":
            {
              "Choice Service":
                {
                  "Type": "Choice",
                  "Choices":
                    [
                      {
                        "Variable": "$.detail.findings[0].ProductName",
                        "StringEquals": "GuardDuty",
                        "Next": "GuardDuty Choice Severity",
                      },
                      {
                        "Variable": "$.detail.findings[0].ProductName",
                        "StringEquals": "Security Hub",
                        "Next": "Security Hub Choice Severity",
                      },
                      {
                        "Variable": "$.detail.findings[0].ProductName",
                        "StringEquals": "IAM Access Analyzer",
                        "Next": "AccessAnalyzer Sharping",
                      },
                    ],
                  "Default": "Fail",
                },
              "Security Hub Choice Severity":
                {
                  "Type": "Choice",
                  "Choices":
                    [
                      {
                        "Or":
                          [
                            {
                              "Variable": "$.detail.findings[0].Severity.Label",
                              "StringEquals": "LOW",
                            },
                            {
                              "Variable": "$.detail.findings[0].Severity.Label",
                              "StringEquals": "INFORMATIONAL",
                            },
                          ],
                        "Next": "Security Hub Severity Low",
                      },
                      {
                        "Variable": "$.detail.findings[0].Severity.Label",
                        "StringEquals": "MEDIUM",
                        "Next": "Security Hub Severity Middle",
                      },
                      {
                        "Or":
                          [
                            {
                              "Variable": "$.detail.findings[0].Severity.Label",
                              "StringEquals": "HIGH",
                            },
                            {
                              "Variable": "$.detail.findings[0].Severity.Label",
                              "StringEquals": "CRITICAL",
                            },
                          ],
                        "Next": "Security Hub Severity High",
                      },
                    ],
                  "Default": "Security Hub Severity None",
                },
              "Security Hub Severity None":
                {
                  "Type": "Pass",
                  "Next": "Security Hub Sharping",
                  "Result": "不明",
                  "ResultPath": "$.SeverityName",
                },
              "Security Hub Severity Low":
                {
                  "Type": "Pass",
                  "Next": "Security Hub Sharping",
                  "Result": "低",
                  "ResultPath": "$.SeverityName",
                },
              "Security Hub Severity Middle":
                {
                  "Type": "Pass",
                  "Next": "Security Hub Sharping",
                  "Result": "中",
                  "ResultPath": "$.SeverityName",
                },
              "Security Hub Severity High":
                {
                  "Type": "Pass",
                  "Next": "Security Hub Sharping",
                  "Result": "高",
                  "ResultPath": "$.SeverityName",
                },
              "GuardDuty Choice Severity":
                {
                  "Type": "Choice",
                  "Choices":
                    [
                      {
                        "Or":
                          [
                            {
                              "Variable": "$.detail.findings[0].Severity.Label",
                              "StringEquals": "LOW",
                            },
                            {
                              "Variable": "$.detail.findings[0].Severity.Label",
                              "StringEquals": "INFORMATIONAL",
                            },
                          ],
                        "Next": "GuardDuty Severity Low",
                      },
                      {
                        "Variable": "$.detail.findings[0].Severity.Label",
                        "StringEquals": "MEDIUM",
                        "Next": "GuardDuty Severity Middle",
                      },
                      {
                        "Or":
                          [
                            {
                              "Variable": "$.detail.findings[0].Severity.Label",
                              "StringEquals": "HIGH",
                            },
                            {
                              "Variable": "$.detail.findings[0].Severity.Label",
                              "StringEquals": "CRITICAL",
                            },
                          ],
                        "Next": "GuardDuty Severity High",
                      },
                    ],
                  "Default": "GuardDuty Severity None",
                },
              "GuardDuty Severity None":
                {
                  "Type": "Pass",
                  "Next": "GuardDuty Sharping",
                  "Result": "不明",
                  "ResultPath": "$.SeverityName",
                },
              "GuardDuty Severity Low":
                {
                  "Type": "Pass",
                  "Next": "GuardDuty Sharping",
                  "Result": "低",
                  "ResultPath": "$.SeverityName",
                },
              "GuardDuty Severity Middle":
                {
                  "Type": "Pass",
                  "Next": "GuardDuty Sharping",
                  "Result": "中",
                  "ResultPath": "$.SeverityName",
                },
              "GuardDuty Severity High":
                {
                  "Type": "Pass",
                  "Next": "GuardDuty Sharping",
                  "Result": "高",
                  "ResultPath": "$.SeverityName",
                },
              "GuardDuty Sharping":
                {
                  "Type": "Pass",
                  "Next": "EventBridge PutEvents",
                  "Parameters":
                    {
                      "Subject.$": "States.Format('緊急度: {} GuardDutyセキュリティアラート Account: {}', $.SeverityName, $.detail.findings[0].AwsAccountId)",
                      "Message.$": "States.Format('以下の脅威を検知しました。  \n意図したものであるか確認してください。  \n検出タイプ: {}  \n詳細: {}  \nリージョン: {}  \n推奨事項URL: https://docs.aws.amazon.com/ja_jp/guardduty/latest/ug/guardduty_finding-types-active.html   \nコンソールURL: {}', $.detail.findings[0].Types[0], $.detail.findings[0].Description, $.detail.findings[0].Region, $.detail.findings[0].SourceUrl)",
                    },
                },
              "Security Hub Sharping":
                {
                  "Type": "Pass",
                  "Parameters":
                    {
                      "Subject.$": "States.Format('緊急度: {} Security Hubセキュリティアラート Account: {}', $.SeverityName, $.account)",
                      "Message.$": "States.Format('Security Hubでセキュリティ上好ましくない設定を検知しました。  \n意図したものであるか確認してください。  \n検知内容: {}  \nリソース種類: {}  \nリソースID: {}  \n詳細: {}  \nリージョン: {}  \n推奨事項URL: {}   \nコンソールURL: https://{}.console.aws.amazon.com/securityhub/home?region={}#/standards/aws-foundational-security-best-practices-1.0.0/{}', $.detail.findings[0].Title, $.detail.findings[0].Resources[0].Type, $.detail.findings[0].Resources[0].Id, $.detail.findings[0].Description,$.detail.findings[0].Region, $.detail.findings[0].ProductFields.RecommendationUrl, $.detail.findings[0].Region, $.detail.findings[0].Region, $.detail.findings[0].ProductFields.ControlId)",
                    },
                  "Next": "EventBridge PutEvents",
                },

              "AccessAnalyzer Sharping":
                {
                  "Type": "Pass",
                  "Parameters":
                    {
                      "Subject.$": "States.Format('IAM Access Analyzerセキュリティアラート Account: {}', $.detail.findings[0].AwsAccountId)",
                      "Message.$": "States.Format('以下リソースが外部共有されています。  \n意図した設定か確認してください。  \nリソース種類: {}  \nリソース名: {}  \nリージョン: {}  \n詳細: {}  \nコンソールURL: {}', $.detail.findings[0].Resources[0].Type, $.detail.findings[0].Resources[0].Id,$.detail.findings[0].Region,$.detail.findings[0].Description,$.detail.findings[0].SourceUrl)",
                    },
                  "Next": "EventBridge PutEvents",
                },
              "EventBridge PutEvents":
                {
                  "Type": "Task",
                  "Resource": "arn:aws:states:::events:putEvents",
                  "Parameters":
                    {
                      "Entries":
                        [
                          {
                            "Detail":
                              {
                                "Subject.$": "$.Subject",
                                "Message.$": "$.Message",
                              },
                            "DetailType": "Sharped Findings",
                            "EventBusName": !Ref SecurityAlertAggregatorBus,
                            "Source": "custom.securityalert.stepfunctions",
                          },
                        ],
                    },
                  "End": True,
                },
              "Fail": { "Type": "Fail" },
            },
        }
      RoleArn: !GetAtt SecurityAlertShapingStateMachineRole.Arn
      StateMachineName: !Sub ${Prefix}-sharping-security-alert-machine

  #整形用ステートマシン用ロール
  SecurityAlertShapingStateMachineRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement":
            [
              {
                "Effect": "Allow",
                "Principal": { "Service": "states.amazonaws.com" },
                "Action": "sts:AssumeRole",
              },
            ],
        }
      Policies:
        - PolicyName: !Sub ${Prefix}-shaping-statemachine-role-policy
          PolicyDocument:
            {
              "Version": "2012-10-17",
              "Statement":
                [
                  {
                    "Effect": "Allow",
                    "Action": ["events:PutEvents"],
                    "Resource": !GetAtt SecurityAlertAggregatorBus.Arn,
                  },
                ],
            }
      RoleName: !Sub ${Prefix}-shaping-statemachine-role

  #整形後の送信先イベントバス
  SecurityAlertAggregatorBus:
    Type: AWS::Events::EventBus
    Properties:
      Name: !Sub ${Prefix}-security-alert-aggregator-bus

  GuardDutyEventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub ${Prefix}-security-alert-guardduty-finding-rule
      EventPattern:
        source: ["aws.securityhub"]
        detail-type: ["Security Hub Findings - Imported"]
        detail:
          findings:
            ProductName: ["GuardDuty"]
            Severity:
              Label: !Ref GuardDutySeverities
            RecordState:
              - "ACTIVE"
            Workflow:
              Status:
                - "NEW"
      Targets:
        - Arn: !GetAtt SecurityAlertShapingStateMachine.Arn
          Id: !Sub ${Prefix}-security-alert-guardduty-finding-rule
          RoleArn: !GetAtt SecurityAlertEventRuleRole.Arn

  SecurityHubEventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub ${Prefix}-security-alert-securityhub-finding-rule
      EventPattern:
        source:
          - "aws.securityhub"
        detail-type:
          - "Security Hub Findings - Imported"
        detail:
          findings:
            Compliance:
              Status:
                - "FAILED"
                - "WARNING"
                - "NOT_AVAILABLE"
            RecordState:
              - "ACTIVE"
            Workflow:
              Status:
                - "NEW"
            ProductFields:
              StandardsArn:
                - "arn:aws:securityhub:::standards/aws-foundational-security-best-practices/v/1.0.0"
            Severity:
              Label: !Ref SecurityHubSeverities
      Targets:
        - Arn: !GetAtt SecurityAlertShapingStateMachine.Arn
          Id: !Sub ${Prefix}-security-alert-securityhub-finding-rule
          RoleArn: !GetAtt SecurityAlertEventRuleRole.Arn

  AccessAnalyzerEventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub ${Prefix}-security-alert-access-analyzer-finding-rule
      EventPattern:
        source: ["aws.securityhub"]
        detail-type: ["Security Hub Findings - Imported"]
        detail:
          findings:
            ProductName: ["IAM Access Analyzer"]
            RecordState:
              - "ACTIVE"
            Workflow:
              Status:
                - "NEW"

      Targets:
        - Arn: !GetAtt SecurityAlertShapingStateMachine.Arn
          Id: !Sub ${Prefix}-security-alert-access-analyzer-finding-rule
          RoleArn: !GetAtt SecurityAlertEventRuleRole.Arn

  #Eventルール用ロール
  SecurityAlertEventRuleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        {
          "Version": "2012-10-17",
          "Statement":
            [
              {
                "Effect": "Allow",
                "Principal": { "Service": "events.amazonaws.com" },
                "Action": "sts:AssumeRole",
              },
            ],
        }
      Policies:
        - PolicyName: !Sub ${Prefix}-security-alert-eventrule-role-policy
          PolicyDocument:
            {
              "Version": "2012-10-17",
              "Statement":
                [
                  {
                    "Effect": "Allow",
                    "Action": ["states:StartExecution"],
                    "Resource": [!GetAtt SecurityAlertShapingStateMachine.Arn],
                  },
                ],
            }
      RoleName: !Sub ${Prefix}-security-alert-eventrule-role-policy

Outputs:
  SecurityAlertAggregatorBus:
    Value: !Ref SecurityAlertAggregatorBus
    Export:
      Name: security-alert-aggregator-bus

AWSTemplateFormatVersion: 2010-09-09
Description: "Set security alert mail"
Parameters:
  Prefix:
    Type: String
    Default: cm
  MailAddress:
    Description: Enter email address to send alert.
    Type: String
Resources:
  AlertEventRuleRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub ${Prefix}-security-alert-mail-eventrule-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "events.amazonaws.com"
            Action:
              - "sts:AssumeRole"
  AlertEventRulePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${Prefix}-security-alert-mail-eventrule-policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - "states:StartExecution"
            Resource: !Ref SendAlertMailMachine
      Roles:
        - !Ref AlertEventRuleRole
  AlertStateMachineRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub ${Prefix}-security-alert-mail-statemachine-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "states.amazonaws.com"
            Action:
              - "sts:AssumeRole"
  AlertStateMachinePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${Prefix}-security-alert-mail-statemachine-policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - "sns:Publish"
            Resource: !Ref SNSTopic
      Roles:
        - !Ref AlertStateMachineRole
  EventRule:
    Type: "AWS::Events::Rule"
    Properties:
      Name: !Sub ${Prefix}-security-alert-mail-rule
      EventBusName: !ImportValue security-alert-aggregator-bus
      Description: "Security alert"
      EventPattern: { "source": ["custom.securityalert.stepfunctions"] }
      Targets:
        - Arn: !Ref SendAlertMailMachine
          Id: IdSendAlertMailMachine
          RoleArn: !GetAtt AlertEventRuleRole.Arn
  SendAlertMailMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: !Sub ${Prefix}-security-alert-mail-machine
      Definition:
        Comment: "Send Security alert mail machine"
        StartAt: SNSPublish
        States:
          SNSPublish:
            Type: Task
            Resource: "arn:aws:states:::sns:publish"
            Parameters:
              TopicArn: !Ref SNSTopic
              Subject.$: "$.detail.Subject"
              Message.$: "$.detail.Message"
            End: true
      RoleArn: !GetAtt AlertStateMachineRole.Arn
  SNSTopic:
    Type: "AWS::SNS::Topic"
    Properties:
      TopicName: !Sub ${Prefix}-security-alert-mail-topic
      KmsMasterKeyId: alias/aws/sns
  SNSSubscription:
    Type: "AWS::SNS::Subscription"
    Properties:
      Endpoint: !Ref MailAddress
      Protocol: email
      TopicArn: !Ref SNSTopic
  SNSTopicPolicy:
    Type: "AWS::SNS::TopicPolicy"
    Properties:
      PolicyDocument:
        Id: default_policy_ID
        Version: "2012-10-17"
        Statement:
          - Sid: default_statement_ID
            Effect: Allow
            Principal:
              AWS: "*"
            Action:
              - "SNS:GetTopicAttributes"
              - "SNS:SetTopicAttributes"
              - "SNS:AddPermission"
              - "SNS:RemovePermission"
              - "SNS:DeleteTopic"
              - "SNS:Subscribe"
              - "SNS:ListSubscriptionsByTopic"
              - "SNS:Publish"
              - "SNS:Receive"
            Resource: !Ref SNSTopic
            Condition:
              StringEquals:
                "AWS:SourceOwner": !Ref "AWS::AccountId"
          - Sid: AllowPublishFromStepFunctions
            Effect: Allow
            Principal:
              AWS: !GetAtt AlertStateMachineRole.Arn
            Action: "sns:Publish"
            Resource: !Ref SNSTopic
      Topics:
        - !Ref SNSTopic

AWSTemplateFormatVersion: 2010-09-09
Description: "Set security alert slack"
Parameters:
  Prefix:
    Type: String
    Default: cm
  SlackChannelId:
    Description: Enter Slack Channel to send alert.
    Type: String
  BotUserOAuthToken:
    Description: Enter token for bot authentication.
    Type: String
Resources:
  AlertEventRuleRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub ${Prefix}-security-alert-slack-eventrule-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "events.amazonaws.com"
            Action:
              - "sts:AssumeRole"
  AlertEventRulePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${Prefix}-security-alert-slack-eventrule-policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - "events:InvokeApiDestination"
            Resource: !GetAtt EventApiDestination.Arn
      Roles:
        - !Ref AlertEventRuleRole
  EventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub ${Prefix}-security-alert-slack-rule
      EventBusName: !ImportValue security-alert-aggregator-bus
      Description: "Security alert"
      EventPattern: { "source": ["custom.securityalert.stepfunctions"] }
      Targets:
        - Arn: !GetAtt EventApiDestination.Arn
          Id: IdSendAlertSlackApi
          RoleArn: !GetAtt AlertEventRuleRole.Arn
          InputTransformer:
            InputPathsMap:
              Message: "$.detail.Message"
              Subject: "$.detail.Subject"
            InputTemplate: !Sub '{"channel":"${SlackChannelId}","text":"<Subject>","blocks":[{"type":"header","text":{"type":"plain_text","text":"<Subject>"}},{"type":"divider"},{"type":"section","text":{"type":"mrkdwn","text":"<Message>"}}]}'
  EventApiDestination:
    Type: AWS::Events::ApiDestination
    Properties:
      Description: "Security alert ApiDestination"
      ConnectionArn: !GetAtt EventConnection.Arn
      HttpMethod: POST
      InvocationEndpoint: "https://slack.com/api/chat.postMessage"
      InvocationRateLimitPerSecond: 300
      Name: !Sub ${Prefix}-security-alert-slack-apidestination
  EventConnection:
    Type: AWS::Events::Connection
    Properties:
      AuthorizationType: API_KEY
      Description: "Security alert Connection"
      Name: !Sub ${Prefix}-security-alert-slack-connection
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: Authorization
          ApiKeyValue: !Sub Bearer ${BotUserOAuthToken}

AWSTemplateFormatVersion: 2010-09-09
Description: "Set security alert teams"
Parameters:
  Prefix:
    Type: String
    Default: cm
  TeamsWebhookUrl:
    Description: Enter Teams Channel to send alert.
    Type: String
Resources:
  AlertEventRuleRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: !Sub ${Prefix}-security-alert-teams-eventrule-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "events.amazonaws.com"
            Action:
              - "sts:AssumeRole"
  AlertEventRulePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub ${Prefix}-security-alert-teams-eventrule-policy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - "events:InvokeApiDestination"
            Resource: !GetAtt EventApiDestination.Arn
      Roles:
        - !Ref AlertEventRuleRole
  EventRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub ${Prefix}-security-alert-teams-rule
      EventBusName: !ImportValue security-alert-aggregator-bus
      Description: "Security alert"
      EventPattern: { "source": ["custom.securityalert.stepfunctions"] }
      Targets:
        - Arn: !GetAtt EventApiDestination.Arn
          Id: IdSendAlertSlackApi
          RoleArn: !GetAtt AlertEventRuleRole.Arn
          InputTransformer:
            InputPathsMap:
              Message: "$.detail.Message"
              Subject: "$.detail.Subject"
            InputTemplate: !Sub '{"title": "<Subject>","text": "<Message>"}'
  EventApiDestination:
    Type: AWS::Events::ApiDestination
    Properties:
      Description: "Security alert ApiDestination"
      ConnectionArn: !GetAtt EventConnection.Arn
      HttpMethod: POST
      InvocationEndpoint: !Ref TeamsWebhookUrl
      InvocationRateLimitPerSecond: 300
      Name: !Sub ${Prefix}-security-alert-teams-apidestination
  EventConnection:
    Type: AWS::Events::Connection
    Properties:
      AuthorizationType: API_KEY
      Description: "Security alert Connection"
      Name: !Sub ${Prefix}-security-alert-teams-connection
      AuthParameters:
        # 本来は必要ないが、必須項目のためダミーの値を入力
        ApiKeyAuthParameters:
          ApiKeyName: key
          ApiKeyValue: value