Skip to content

Commit 1ab2f0f

Browse files
Brian969Brian969
authored
Clarify v1.2.4 upgrade requirements, prettier SCP files (#628)
* Clarify v1.2.4 upgrade requirements, prettier SCP files * tweak alarm (reduce noise)
1 parent d4a9f3e commit 1ab2f0f

11 files changed

+102
-170
lines changed

‎docs/installation/installation.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -261,11 +261,12 @@ If deploying to an internal AWS employee account, to successfully install the so
261261

262262
Current Issues:
263263

264-
- Releases prior to v1.2.5 - Occassionally during new installs the state machine is failing due to a `File not found` error in the `VerifyFiles` step. Simply rerun the state machine. This is resolved in v1.2.5.
265-
- Releases prior to v1.2.5 - Occassionally during new installs the perimeter firewall fails to load the provided prescriptive firewall configuration. Edit your config file changing `"firewalls":` to `"xxfirewalls":`, and rerun the state machine to remove the firewall deployment, then change your config file back to `"firewalls":` and again rerun your state machine to redeploy the firewalls. This is resolved in v1.2.5.
264+
- Occassionally CloudFormation fails to return a completion signal. After the credentials eventually fail (1 hr), the state machine fails. Simply rerun the state machine.
266265

267266
Issues in Older Releases:
268267

268+
- Releases prior to v1.2.5 - Occassionally during new installs the state machine is failing due to a `File not found` error in the `VerifyFiles` step. Simply rerun the state machine. This is resolved in v1.2.5.
269+
- Releases prior to v1.2.5 - Occassionally during new installs the perimeter firewall fails to load the provided prescriptive firewall configuration. Edit your config file changing `"firewalls":` to `"xxfirewalls":`, and rerun the state machine to remove the firewall deployment, then change your config file back to `"firewalls":` and again rerun your state machine to redeploy the firewalls. This is resolved in v1.2.5.
269270
- Releases prior to v1.2.4 will fail to deploy due to a change in an unpinned 3rd party dependency. This is resolved in v1.2.4 (all dependencies were pinned in v1.2.5).
270271
- Releases prior to v1.2.4 - During Guardduty deployment, occassionally CloudFormation fails to return a completion signal. After the credentials eventually fail (1 hr), the state machine fails. As the credentials timed out, we cannot properly cleanup the failed stack. You need to manually find the failed stack in the specific account/region, delete it, and then rerun the state machine. It appears the API has been fixed.
271272
- Releases prior to v1.2.3 using a YAML config file - we are seeing the OUValidation Lambda randomly timeout. Simply rerun the state machine. This is resolved in v1.2.3.
@@ -328,6 +329,9 @@ Issues in Older Releases:
328329
- Wait for operation to complete (refresh the browser several times)
329330
- Select Actions, Delete StackSet, click Delete StackSet
330331
- Wait for the operation to complete
332+
- Upgrades to `v1.2.4 and above` from `v1.2.3 and below` - Ensure you apply the config file changes described in the release notes
333+
- failure to set `"central-endpoint": true` directly on the endpoint VPC (instead of in global-options), will result in the removal of your VPC endpoints
334+
- failure to move your zone definitions to the endpoint VPC, will result in the removal of you Public and Private hosted zones
331335
- Upgrades to `v1.2.1 and above` from `v1.2.0 and below` - if more than 5 VPC endpoints are deployed in any account (i.e. endpoint VPC in the shared network account), before upgrade, they must be removed from the config file and state machine executed to de-provision them. Up to approximately 50 endpoints can be re-deployed during the upgrade state machine execution. Skipping this step will result in an upgrade failure due to throttling issues. Simply rerun the state machine.
332336

333337
## 3.2. Summary of Upgrade Steps (all versions)

‎reference-artifacts/SAMPLE_CONFIGS/config.example.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,7 @@
277277
"accounts": ["master"],
278278
"regions": ["${HOME_REGION}"],
279279
"loggroup-name": "/PBMMAccel/CloudTrail",
280-
"filter-pattern": "{ ($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode =\"AccessDenied*\") }",
280+
"filter-pattern": "{ (($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode =\"AccessDenied*\") && ($.userIdentity.principalId != \"*AWSConfig-BucketConfigCheck\")) }",
281281
"metric-namespace": "CloudTrailMetrics",
282282
"metric-name": "AuthorizationFailureCount",
283283
"metric-value": "1"

‎reference-artifacts/SAMPLE_CONFIGS/config.lite-example.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,7 @@
277277
"accounts": ["master"],
278278
"regions": ["${HOME_REGION}"],
279279
"loggroup-name": "/PBMMAccel/CloudTrail",
280-
"filter-pattern": "{ ($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode =\"AccessDenied*\") }",
280+
"filter-pattern": "{ (($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode =\"AccessDenied*\") && ($.userIdentity.principalId != \"*AWSConfig-BucketConfigCheck\")) }",
281281
"metric-namespace": "CloudTrailMetrics",
282282
"metric-name": "AuthorizationFailureCount",
283283
"metric-value": "1"

‎reference-artifacts/SAMPLE_CONFIGS/config.multi-region-example.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@
281281
"accounts": ["master"],
282282
"regions": ["${HOME_REGION}"],
283283
"loggroup-name": "/PBMMAccel/CloudTrail",
284-
"filter-pattern": "{ ($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode =\"AccessDenied*\") }",
284+
"filter-pattern": "{ (($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode =\"AccessDenied*\") && ($.userIdentity.principalId != \"*AWSConfig-BucketConfigCheck\")) }",
285285
"metric-namespace": "CloudTrailMetrics",
286286
"metric-name": "AuthorizationFailureCount",
287287
"metric-value": "1"

‎reference-artifacts/SAMPLE_CONFIGS/config.ultralite-example.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -252,7 +252,7 @@
252252
"accounts": ["master"],
253253
"regions": ["${HOME_REGION}"],
254254
"loggroup-name": "/PBMMAccel/CloudTrail",
255-
"filter-pattern": "{ ($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode =\"AccessDenied*\") }",
255+
"filter-pattern": "{ (($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode =\"AccessDenied*\") && ($.userIdentity.principalId != \"*AWSConfig-BucketConfigCheck\")) }",
256256
"metric-namespace": "CloudTrailMetrics",
257257
"metric-name": "AuthorizationFailureCount",
258258
"metric-value": "1"

‎reference-artifacts/SCPs/ASEA-Guardrails-Part0.json‎

Lines changed: 53 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -1,74 +1,57 @@
11
{
2-
"Version":"2012-10-17",
3-
"Statement":[
2+
"Version": "2012-10-17",
3+
"Statement": [
44
{
5-
"Condition":{
6-
"ArnNotLike":{
7-
"aws:PrincipalARN":[
8-
"arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"
9-
]
5+
"Condition": {
6+
"ArnNotLike": {
7+
"aws:PrincipalARN": ["arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"]
108
}
119
},
12-
"Action":[
13-
"sns:Subscribe",
14-
"sns:Unsubscribe"
15-
],
16-
"Resource":[
17-
"arn:aws:sns:*:*:${ACCELERATOR_PREFIX}*"
18-
],
19-
"Effect":"Deny",
20-
"Sid":"GRSNSSUBSCRIPTIONPOLICY"
10+
"Action": ["sns:Subscribe", "sns:Unsubscribe"],
11+
"Resource": ["arn:aws:sns:*:*:${ACCELERATOR_PREFIX}*"],
12+
"Effect": "Deny",
13+
"Sid": "GRSNSSUBSCRIPTIONPOLICY"
2114
},
2215
{
23-
"Condition":{
24-
"ArnNotLike":{
25-
"aws:PrincipalARN":[
26-
"arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"
27-
]
16+
"Condition": {
17+
"ArnNotLike": {
18+
"aws:PrincipalARN": ["arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"]
2819
}
2920
},
30-
"Action":[
21+
"Action": [
3122
"cloudtrail:DeleteTrail",
3223
"cloudtrail:PutEventSelectors",
3324
"cloudtrail:StopLogging",
3425
"cloudtrail:UpdateTrail"
3526
],
36-
"Resource":[
37-
"arn:aws:cloudtrail:*:*:trail/${ACCELERATOR_PREFIX}*"
38-
],
39-
"Effect":"Deny",
40-
"Sid":"GRCLOUDTRAILENABLED"
27+
"Resource": ["arn:aws:cloudtrail:*:*:trail/${ACCELERATOR_PREFIX}*"],
28+
"Effect": "Deny",
29+
"Sid": "GRCLOUDTRAILENABLED"
4130
},
4231
{
43-
"Condition":{
44-
"ArnNotLike":{
45-
"aws:PrincipalARN":[
46-
"arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"
47-
]
32+
"Condition": {
33+
"ArnNotLike": {
34+
"aws:PrincipalARN": ["arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"]
4835
}
4936
},
50-
"Action":[
37+
"Action": [
5138
"sns:AddPermission",
5239
"sns:CreateTopic",
5340
"sns:DeleteTopic",
5441
"sns:RemovePermission",
5542
"sns:SetTopicAttributes"
5643
],
57-
"Resource":[
58-
"arn:aws:sns:*:*:${ACCELERATOR_PREFIX}*"
59-
],
60-
"Effect":"Deny",
61-
"Sid":"GRSNSTOPICPOLICY"
44+
"Resource": ["arn:aws:sns:*:*:${ACCELERATOR_PREFIX}*"],
45+
"Effect": "Deny",
46+
"Sid": "GRSNSTOPICPOLICY"
6247
},
6348
{
64-
"Condition":{
65-
"ArnNotLike":{
66-
"aws:PrincipalARN":[
67-
"arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"
68-
]
49+
"Condition": {
50+
"ArnNotLike": {
51+
"aws:PrincipalARN": ["arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"]
6952
}
7053
},
71-
"Action":[
54+
"Action": [
7255
"config:DeleteConfigurationRecorder",
7356
"config:DeleteDeliveryChannel",
7457
"config:DeleteRetentionConfiguration",
@@ -77,79 +60,59 @@
7760
"config:PutRetentionConfiguration",
7861
"config:StopConfigurationRecorder"
7962
],
80-
"Resource":[
81-
"*"
82-
],
83-
"Effect":"Deny",
84-
"Sid":"GRCONFIGENABLED"
63+
"Resource": ["*"],
64+
"Effect": "Deny",
65+
"Sid": "GRCONFIGENABLED"
8566
},
8667
{
87-
"Condition":{
88-
"ArnNotLike":{
89-
"aws:PrincipalARN":[
90-
"arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"
91-
]
68+
"Condition": {
69+
"ArnNotLike": {
70+
"aws:PrincipalARN": ["arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"]
9271
}
9372
},
94-
"Action":[
73+
"Action": [
9574
"events:PutRule",
9675
"events:PutTargets",
9776
"events:RemoveTargets",
9877
"events:DisableRule",
9978
"events:DeleteRule"
10079
],
101-
"Resource":[
102-
"arn:aws:events:*:*:rule/${ACCELERATOR_PREFIX}*"
103-
],
104-
"Effect":"Deny",
105-
"Sid":"GRCLOUDWATCHEVENTPOLICY"
80+
"Resource": ["arn:aws:events:*:*:rule/${ACCELERATOR_PREFIX}*"],
81+
"Effect": "Deny",
82+
"Sid": "GRCLOUDWATCHEVENTPOLICY"
10683
},
10784
{
108-
"Condition":{
109-
"ArnNotLike":{
110-
"aws:PrincipalARN":[
111-
"arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"
112-
]
85+
"Condition": {
86+
"ArnNotLike": {
87+
"aws:PrincipalARN": ["arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"]
11388
}
11489
},
115-
"Action":[
116-
"config:TagResource",
117-
"config:UntagResource"
118-
],
119-
"Resource":[
120-
"*"
121-
],
122-
"Effect":"Deny",
123-
"Sid":"GRCONFIGRULETAGSPOLICY"
90+
"Action": ["config:TagResource", "config:UntagResource"],
91+
"Resource": ["*"],
92+
"Effect": "Deny",
93+
"Sid": "GRCONFIGRULETAGSPOLICY"
12494
},
12595
{
126-
"Condition":{
127-
"ArnNotLike":{
128-
"aws:PrincipalARN":[
129-
"arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"
130-
]
96+
"Condition": {
97+
"ArnNotLike": {
98+
"aws:PrincipalARN": ["arn:aws:iam::*:role/${ACCELERATOR_PREFIX}*"]
13199
}
132100
},
133-
"Action":[
101+
"Action": [
134102
"config:PutConfigRule",
135103
"config:DeleteConfigRule",
136104
"config:DeleteEvaluationResults",
137105
"config:DeleteConfigurationAggregator",
138106
"config:PutConfigurationAggregator"
139107
],
140-
"Resource":[
141-
"arn:aws:config:*:*:config-rule/${ACCELERATOR_PREFIX}*"
142-
],
143-
"Effect":"Deny",
144-
"Sid":"GRCONFIGRULEPOLICY"
108+
"Resource": ["arn:aws:config:*:*:config-rule/${ACCELERATOR_PREFIX}*"],
109+
"Effect": "Deny",
110+
"Sid": "GRCONFIGRULEPOLICY"
145111
},
146112
{
147113
"Sid": "DenyPass",
148114
"Effect": "Deny",
149-
"Action": [
150-
"iam:DeleteAccountPasswordPolicy",
151-
"iam:UpdateAccountPasswordPolicy"
152-
],
115+
"Action": ["iam:DeleteAccountPasswordPolicy", "iam:UpdateAccountPasswordPolicy"],
153116
"Resource": "*",
154117
"Condition": {
155118
"ArnNotLike": {
@@ -161,4 +124,4 @@
161124
}
162125
}
163126
]
164-
}
127+
}

0 commit comments

Comments
 (0)