Aws_scripts/security-baseline.yaml at main · nelsonrosario89/Aws_scripts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Security Baseline - AWS Config, GuardDuty, Security Hub'

Resources:
  # AWS Config
  ConfigRecorder:
    Type: AWS::Config::ConfigurationRecorder
    Properties:
      Name: default
      RecordingGroup:
        AllSupported: true
        IncludeGlobalResourceTypes: true
      RoleARN: !GetAtt ConfigRole.Arn

  ConfigDeliveryChannel:
    Type: AWS::Config::DeliveryChannel
    Properties:
      ConfigSnapshotDeliveryProperties:
        DeliveryFrequency: Twelve_Hours
      Name: default
      S3BucketName: "nellz-89-bucket"
      S3KeyPrefix: "aws-config/"

  ConfigRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: config.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWS_ConfigRole

  # GuardDuty
  GuardDutyDetector:
    Type: AWS::GuardDuty::Detector
    Properties:
      Enable: true
      FindingPublishingFrequency: FIFTEEN_MINUTES
      DataSources:
        S3Logs:
          Enable: true

  # Security Hub
  SecurityHubStandard:
    Type: AWS::SecurityHub::Standards::Subscription
    Properties:
      StandardsArn: !Sub 'arn:${AWS::Partition}:securityhub:${AWS::Region}::standards/aws-foundational-security-best-practices/v/1.0.0'

Outputs:
  ConfigRecorderName:
    Description: Name of the AWS Config Recorder
    Value: !Ref ConfigRecorder
  GuardDutyDetectorId:
    Description: ID of the GuardDuty Detector
    Value: !Ref GuardDutyDetector