No results for cloudtrail config rules check

[lorengordon]

Was just trying out the config-rules.template and am seeing that the rule check-whether-cloudtrail-is-enabled does not appear to be working. Config Rules reports "No results available". Looking at the cloudwatch logs for the lambda function, it is reporting a syntax error:

SyntaxError: Unexpected token u
at Object.parse (native)
at exports.handler (/var/task/index.js:24:31)

[mlepriberluti]

Got the issue and solved it in my templates.

1. You need to select AWS::CloudTrail::Trail as Resource to be evaluated and not AWS::EC2::Instance ```
   ComplianceResourceTypes:
   - AWS::EC2::Instance
2. You need to remove the ruleParameter evaluation in Lambda as it would be passed as "undefined", which is not a JSON parsable string. this is why you see Unexpected token "u" which is the 1st letter.

Lines:

• var ruleParameters = JSON.parse(event.ruleParameters);
• function evaluateCompliance(configurationItem, ruleParameters, context) {
• compliance = evaluateCompliance(invokingEvent.configurationItem, ruleParameters, context); // Invoke the compliance checking function.

Hope this helps

Mattia

[lorengordon]

@mlepriberluti Are you opening a pull request with the fix?

[mlepriberluti]

I'm not a developer, shame on me but I just subscribed to GitHub to reply to you and I don't know how to open a pull request :)

[lorengordon]

A pull request is very easy...

1. Find the template here, https://github.com/aws-quickstart/quickstart-compliance-common/tree/master/templates.
2. Open it, and click the little "pencil" icon in the upper right.
3. Modify the file, and at the bottom give the edit a title and optional description, then click "Propose File Change".
4. On the following page, click "Create Pull Request"

That should be it, I think...

[jonmelia]

      var aws = require('aws-sdk');
      var config = new aws.ConfigService();

      // Custom rule for evaluating CloudTrail configuration compliance
      // 3 config parameters for Trail must be true: Multi-Region, Global Services Events, and Log File Validation
      function evaluateCompliance(configurationItem, ruleParameters, context) {
          if(configurationItem.resourceType !== 'AWS::CloudTrail::Trail')
              return 'NOT_APPLICABLE';

          if((configurationItem.configuration.logFileValidationEnabled) && (configurationItem.configuration.includeGlobalServiceEvents) && (configurationItem.configuration.isMultiRegionTrail)) {
              return 'COMPLIANT';
          }
          else return 'NON_COMPLIANT';
      }

      function isApplicable(configurationItem, event) {
          var status = configurationItem.configurationItemStatus;
          var eventLeftScope = event.eventLeftScope;
          return (status === 'OK' || status === 'ResourceDiscovered') && eventLeftScope === false;
      }

      exports.handler = function(event, context) {
          var invokingEvent = JSON.parse(event.invokingEvent);
          var ruleParameters = JSON.parse(event.ruleParameters);
          var compliance = 'NOT_APPLICABLE';

          if (isApplicable(invokingEvent.configurationItem, event))
              compliance = evaluateCompliance(invokingEvent.configurationItem, ruleParameters, context); // Invoke the compliance checking function.

          var putEvaluationsRequest = {
              Evaluations: [
                  {
                      ComplianceResourceType: invokingEvent.configurationItem.resourceType,
                      ComplianceResourceId: invokingEvent.configurationItem.resourceId,
                      ComplianceType: compliance,
                      OrderingTimestamp: invokingEvent.configurationItem.configurationItemCaptureTime
                  }
              ],
              ResultToken: event.resultToken
          };
          config.putEvaluations(putEvaluationsRequest, function (err, data) {
              if (err) {
                  context.fail(err);
              } else {
                  context.succeed(data);
              }
          });
      };

Receiving undefined as below:
SyntaxError: Unexpected token u
at Object.parse (native)
at exports.handler (/var/task/index.js:23:40)

Seems to be similar to above mention error, but on invoking event...
var invokingEvent = JSON.parse(event.invokingEvent)

Any ideas?