ルール開発キット（rdk）を使ってAWS Configのカスタムルールを作成してみた

AWS事業本部のイシザワです。

ルール開発キット（rdk）を使ってAWS ConfigのカスタムLambdaルールを作成する手順をまとめます。

rdk とは

rdkとはAWS ConfigのカスタムLambdaルール作成のサポートをするツールです。

カスタムルールに使用するLambda関数コードの雛形を作成したり、カスタムルールを簡単にAWS環境にデプロイしたりすることができます。

今回作成するカスタムルール

VPCのCIDRが規定のCIDRに含まれているかを検査するカスタムルールを作成します。

既定のCIDRはカスタムルール作成時にパラメータとして渡せるようにします。

やってみた

まずpipを使ってrdkをインストールします。

PS C:\work> pip install rdk

rdkがインストールされたら、rdkの初期セットアップを行います。 ここでデプロイ先のAWS環境においてAWS Configの有効化とrdkで使うS3バケットの作成が行われます。

PS C:\work> rdk init
[ap-northeast-1]: Running init!
[ap-northeast-1]: Found Config Recorder: default
[ap-northeast-1]: Found Config Role: arn:aws:iam::123456789012:role/config-role
[ap-northeast-1]: Found Bucket: config-bucket-123456789012
[ap-northeast-1]: Config Service is ON
[ap-northeast-1]: Config setup complete.
[ap-northeast-1]: Creating Code bucket config-rule-code-bucket-123456789012-ap-northeast-1

rdkの初期化が完了したらカスタムルールの作成を行います。 今回はVPCの構成変更時に検査するようにしたいので--resource-typesオプションにVPCのリソースタイプを選択します。

PS C:\work> rdk create CheckVpcCidr --runtime python3.9 --resource-types AWS::EC2::VPC --input '{\"cidrBlock\":\"192.168.0.0/16\"}'
{"cidrBlock":"192.168.0.0/16"}
Running create!
Local Rule files created.

実行するとカレントディレクトリ配下にCheckVpcCidrディレクトリが作成されます。

PS C:\work> ls .\CheckVpcCidr\


    ディレクトリ: C:\work\CheckVpcCidr


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        2023/02/12     23:06          18095 CheckVpcCidr.py
-a----        2023/02/12     23:06           7462 CheckVpcCidr_test.py
-a----        2023/02/12     23:06            353 parameters.json

CheckVpcCidr.pyがLambda関数コードの雛形になります。雛形にはヘルパー関数とボイラープレートが含まれているので、開発者はロジックの実装に集中をすることができます。 基本的には以下の部分にカスタムルールのロジックを書いていきます。

##############
# Parameters #
##############

# Define the default resource to report to Config Rules
DEFAULT_RESOURCE_TYPE = "AWS::::Account"

# Set to True to get the lambda to assume the Role attached on the Config Service (useful for cross-account).
ASSUME_ROLE_MODE = False

# Other parameters (no change needed)
CONFIG_ROLE_TIMEOUT_SECONDS = 900

#############
# Main Code #
#############


def evaluate_compliance(event, configuration_item, valid_rule_parameters):
    """Form the evaluation(s) to be return to Config Rules

    Return either:
    None -- when no result needs to be displayed
    a string -- either COMPLIANT, NON_COMPLIANT or NOT_APPLICABLE
    a dictionary -- the evaluation dictionary, usually built by build_evaluation_from_config_item()
    a list of dictionary -- a list of evaluation dictionary , usually built by build_evaluation()

    Keyword arguments:
    event -- the event variable given in the lambda handler
    configuration_item -- the configurationItem dictionary in the invokingEvent
    valid_rule_parameters -- the output of the evaluate_parameters() representing validated parameters of the Config Rule

    Advanced Notes:
    1 -- if a resource is deleted and generate a configuration change with ResourceDeleted status, the Boilerplate code will put a NOT_APPLICABLE on this resource automatically.
    2 -- if a None or a list of dictionary is returned, the old evaluation(s) which are not returned in the new evaluation list are returned as NOT_APPLICABLE by the Boilerplate code
    3 -- if None or an empty string, list or dict is returned, the Boilerplate code will put a "shadow" evaluation to feedback that the evaluation took place properly
    """

    ###############################
    # Add your custom logic here. #
    ###############################

    return "NOT_APPLICABLE"


def evaluate_parameters(rule_parameters):
    """Evaluate the rule parameters dictionary validity. Raise a ValueError for invalid parameters.

    Return:
    anything suitable for the evaluate_compliance()

    Keyword arguments:
    rule_parameters -- the Key/Value dictionary of the Config Rules parameters
    """
    valid_rule_parameters = rule_parameters
    return valid_rule_parameters

以下のコマンドでカスタムルールのトリガー時（VPCの構成変更時）にconfiguration_itemに入る値のサンプルが見れます。実装する際の参考にしましょう。

PS C:\work> rdk sample-ci AWS::EC2::VPC
{
    "version": "1.2",
    "accountId": "264683526309",
    "configurationItemCaptureTime": "2016-10-29T19:52:09.494Z",
    "configurationItemStatus": "OK",
    "configurationStateId": "1477770729494",
    "configurationItemMD5Hash": "81e6fc8379f93bd68526f8a6769776b9",
    "arn": "arn:aws:ec2:us-east-1:264683526309:vpc/vpc-0990dc6d",
    "resourceType": "AWS::EC2::VPC",
    "resourceId": "vpc-0990dc6d",
    "awsRegion": "us-east-1",
    "availabilityZone": "Multiple Availability Zones",
    "tags": {},
    "relatedEvents": [
        "ca566c16-81b7-48cf-8573-241ab67880e7"
    ],
    "relationships": [
        {
            "resourceType": "AWS::EC2::NetworkAcl",
            "resourceId": "acl-b48fd1d0",
            "relationshipName": "Contains NetworkAcl"
        },
        {
            "resourceType": "AWS::EC2::NetworkInterface",
            "resourceId": "eni-49ec78b5",
            "relationshipName": "Contains NetworkInterface"
        },
        {
            "resourceType": "AWS::EC2::NetworkInterface",
            "resourceId": "eni-67e4348d",
            "relationshipName": "Contains NetworkInterface"
        },
        {
            "resourceType": "AWS::EC2::NetworkInterface",
            "resourceId": "eni-70a4b7bf",
            "relationshipName": "Contains NetworkInterface"
        },
        {
            "resourceType": "AWS::EC2::NetworkInterface",
            "resourceId": "eni-c09a049e",
            "relationshipName": "Contains NetworkInterface"
        },
        {
            "resourceType": "AWS::EC2::Instance",
            "resourceId": "i-29e75b19",
            "relationshipName": "Contains Instance"
        },
        {
            "resourceType": "AWS::EC2::Instance",
            "resourceId": "i-ebf3e058",
            "relationshipName": "Contains Instance"
        },
        {
            "resourceType": "AWS::EC2::InternetGateway",
            "resourceId": "igw-a5f227c1",
            "relationshipName": "Is attached to InternetGateway"
        },
        {
            "resourceType": "AWS::EC2::RouteTable",
            "resourceId": "rtb-50b9b034",
            "relationshipName": "Contains RouteTable"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-0d46b170",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-1d56fc66",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-2b353152",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-2ed0d557",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-4161cb3a",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-48b41e33",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-4f49e334",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-62bba619",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-649a301f",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-7d7cd606",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-96b471ec",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-b854bbc5",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-e627199e",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-e868d092",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::SecurityGroup",
            "resourceId": "sg-f693878d",
            "relationshipName": "Contains SecurityGroup"
        },
        {
            "resourceType": "AWS::EC2::Subnet",
            "resourceId": "subnet-29428871",
            "relationshipName": "Contains Subnet"
        },
        {
            "resourceType": "AWS::EC2::Subnet",
            "resourceId": "subnet-32e85b44",
            "relationshipName": "Contains Subnet"
        },
        {
            "resourceType": "AWS::EC2::Subnet",
            "resourceId": "subnet-38c20312",
            "relationshipName": "Contains Subnet"
        },
        {
            "resourceType": "AWS::EC2::Subnet",
            "resourceId": "subnet-e83ba2d5",
            "relationshipName": "Contains Subnet"
        }
    ],
    "configuration": {
        "vpcId": "vpc-0990dc6d",
        "state": "available",
        "cidrBlock": "172.31.0.0/16",
        "dhcpOptionsId": "dopt-3a32ab5f",
        "tags": [],
        "instanceTenancy": "default",
        "isDefault": true
    },
    "supplementaryConfiguration": {}
}
For more info, try checking: https://github.com/awslabs/aws-config-resource-schema/blob/master/config/properties/resource-types/

他にも実装する際の参考としてAWS Configルールリポジトリを挙げておきます。

以下が今回作成するカスタムルールの実装となります。ロジックの内容は本記事の主眼でないため説明は省略します。

##############
# Parameters #
##############

# Define the default resource to report to Config Rules
DEFAULT_RESOURCE_TYPE = "AWS::EC2::VPC"

# Set to True to get the lambda to assume the Role attached on the Config Service (useful for cross-account).
ASSUME_ROLE_MODE = False

# Other parameters (no change needed)
CONFIG_ROLE_TIMEOUT_SECONDS = 900

#############
# Main Code #
#############


def evaluate_compliance(event, configuration_item, valid_rule_parameters):
    ip_address, subnet_mask = get_ip_address_and_subnet_mask(configuration_item["configuration"]["cidrBlock"])
    expected_ip_address, expected_subnet_mask = get_ip_address_and_subnet_mask(valid_rule_parameters["cidrBlock"])

    if subnet_mask >= expected_subnet_mask and \
       ip_address & expected_subnet_mask == expected_ip_address & expected_subnet_mask:
        return build_evaluation_from_config_item(configuration_item, "COMPLIANT")

    return build_evaluation_from_config_item(configuration_item, "NON_COMPLIANT")

def get_ip_address_and_subnet_mask(s):
    m = re.match(r'(\d+)\.(\d+)\.(\d+)\.(\d+)/(\d+)', s)

    ip_address = 0
    for i in range(1, 5):
        part = int(m.group(i))
        ip_address <<= 8
        ip_address += part

    prefix_length = int(m.group(5))
    subnet_mask = ((1 << 32) - 1) - ((1 << (32 - prefix_length)) - 1)

    return ip_address, subnet_mask

def evaluate_parameters(rule_parameters):
    m = re.match(r'(\d+)\.(\d+)\.(\d+)\.(\d+)/(\d+)', rule_parameters["cidrBlock"])
    if not m:
        raise ValueError("The parameter is not valid.")
    
    for i in range(1, 5):
        part = int(m.group(i))
        if not (0 <= part and part <= 255):
            raise ValueError("The parameter is not valid.")

    prefix_length = int(m.group(5))
    if not (0 <= prefix_length and prefix_length <= 32):
        raise ValueError("The parameter is not valid.")

    valid_rule_parameters = rule_parameters
    return valid_rule_parameters

CheckVpcCidr_test.pyに簡単なテストコードを作成します。このファイルにはテスト用のヘルパー関数が含まれています。

##############
# Parameters #
##############

# Define the default resource to report to Config Rules
DEFAULT_RESOURCE_TYPE = "AWS::EC2::VPC"

#############
# Main Code #
#############

CONFIG_CLIENT_MOCK = MagicMock()
STS_CLIENT_MOCK = MagicMock()


class Boto3Mock:
    @staticmethod
    def client(client_name, *args, **kwargs):
        if client_name == "config":
            return CONFIG_CLIENT_MOCK
        if client_name == "sts":
            return STS_CLIENT_MOCK
        raise Exception("Attempting to create an unknown client")


sys.modules["boto3"] = Boto3Mock()

RULE = __import__("CheckVpcCidr")


class ComplianceTest(unittest.TestCase):
    def test_cidr_is_valid(self):
        invoking_event = '{"configurationItem":{"configuration":{"cidrBlock":"172.31.0.0/16"}, "relationships":[], "configurationItemStatus":"OK", "resourceType":"AWS::EC2::VPC", "configurationItemCaptureTime":"2019-04-28T07:49:40.797Z", "resourceId": "vpc-0990dc6d"}, "messageType":"ConfigurationItemChangeNotification"}'
        rule_parameters = '{"cidrBlock":"172.16.0.0/12"}'
        response = RULE.lambda_handler(build_lambda_configurationchange_event(invoking_event, rule_parameters), {})
        resp_expected = []
        resp_expected.append(build_expected_response("COMPLIANT", "vpc-0990dc6d"))
        assert_successful_evaluation(self, response, resp_expected)

    def test_cidr_is_not_valid(self):
        invoking_event = '{"configurationItem":{"configuration":{"cidrBlock":"172.31.0.0/16"}, "relationships":[], "configurationItemStatus":"OK", "resourceType":"AWS::EC2::VPC", "configurationItemCaptureTime":"2019-04-28T07:49:40.797Z", "resourceId": "vpc-0990dc6d"}, "messageType":"ConfigurationItemChangeNotification"}'
        rule_parameters = '{"cidrBlock":"10.0.0.0/8"}'
        response = RULE.lambda_handler(build_lambda_configurationchange_event(invoking_event, rule_parameters), {})
        resp_expected = []
        resp_expected.append(build_expected_response("NON_COMPLIANT", "vpc-0990dc6d"))
        assert_successful_evaluation(self, response, resp_expected)

以下のコマンドを実行することでローカルでテストを実行できます。

PS C:\work> rdk test-local CheckVpcCidr
Running local test!
Testing CheckVpcCidr
Looking for tests in C:\work\CheckVpcCidr
CheckVpcCidr_test.py
Debug!
<unittest.suite.TestSuite tests=[<unittest.suite.TestSuite tests=[<CheckVpcCidr_test.ComplianceTest testMethod=test_cidr_is_not_valid>, <CheckVpcCidr_test.ComplianceTest testMethod=test_cidr_is_valid>]>, <unittest.suite.TestSuite tests=[<CheckVpcCidr_test.TestStsErrors testMethod=test_sts_access_denied>, <CheckVpcCtest_cidr_is_not_valid (CheckVpcCidr_test.ComplianceTest.test_cidr_is_not_valid) ... ok
test_cidr_is_valid (CheckVpcCidr_test.ComplianceTest.test_cidr_is_valid) ... ok
test_sts_access_denied (CheckVpcCidr_test.TestStsErrors.test_sts_access_denied) ... ok
test_sts_unknown_error (CheckVpcCidr_test.TestStsErrors.test_sts_unknown_error) ... ok

----------------------------------------------------------------------
Ran 4 tests in 0.005s

OK
<unittest.runner.TextTestResult run=4 errors=0 failures=0>

以下のコマンドでAWS環境へのデプロイができます。

PS C:\work> rdk deploy CheckVpcCidr
[ap-northeast-1]: Running deploy!
[ap-northeast-1]: Found Custom Rule.
[ap-northeast-1]: Zipping CheckVpcCidr
[ap-northeast-1]: Uploading CheckVpcCidr
[ap-northeast-1]: Upload complete.
[ap-northeast-1]: Creating CloudFormation Stack for CheckVpcCidr
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: Waiting for CloudFormation stack operation to complete...
[ap-northeast-1]: CloudFormation stack operation complete.
[ap-northeast-1]: Config deploy complete.

AWSのコンソールにてカスタムルールがデプロイされたことを確認できます。パラメータの値はparameters.jsonで指定できるので、編集して再デプロイすることで変更することができます。

試しにルールに準拠するVPCと準拠しないVPCを作成します。

再度カスタムルールの詳細情報ページに移動すると、カスタムルールでVPCが検査されていることを確認できます。

まとめ

rdkを使ってカスタムLambdaルールを作成し、AWS環境にデプロイするまでの手順をまとめました。 rdkのサポートを借りることでルールのロジックに集中することができるので、効率的に実装を進めることができました。

記事執筆時点ではまだオープンベータです。今後の発展に期待します。