Generate Access Keys Using Cloudformation Template

The Trusted Advisor Exposed Keys CloudWatch Event Monitor demonstrates how to use AWS Step Functions to orchestrate a serverless AWS Lambda workflow in response to an Amazon CloudWatch Event generated by AWS Trusted Advisor.

Jul 08, 2018  AWS CloudFormation let us create AWS resources with JSON or YAML files. With CloudFormation, you can create and update your AWS infrastructure by code. In the previous post, we discuss how we can create publicly available RDS (How to Make RDS in Private Subnet Accessible From the Internet).In this post, let’s create a CloudFormation template for the public RDS stack. The AWS::KMS::Key resource specifies a customer master key (CMK) in AWS Key Management Service (AWS KMS). Authorized users can use the CMK to encrypt and decrypt small amounts of data (up to 4096 bytes), but they are more commonly used to generate data keys.

On detection of a Trusted Advisor Exposed Access Key CloudWatch Event this workflow deletes the exposed IAM Access Key, summarizes the recent API activity for the exposed key, and sends the summary message to an Amazon SNS Topic to notify the subscribers.

This repository contains sample code for all the AWS Lambda functions depicted in the diagram below as well as an AWS CloudFormation template for creating the functions and related resources.

Walkthrough of the Architecture

  1. An IAM Access Key is inadvertently uploaded to one of the popular code repositories (ex: github) monitored by Trusted Advisor.
  2. Trusted Advisor detects the key, generating a Trusted Advisor Exposed Access Keys CloudWatch Event. AWS also temporarily restricts the API calls the key is able to make.
  3. A configured CloudWatch Events rule matches this event, triggering an execution of the ExposedKey Step Functions state machine, which has the following sub-steps:
    • Delete the exposed IAM Access Key Pair
    • Summarize recent API activity for the user from CloudTrail
    • Send security notification message containing summary to SecurityNotificationTopic SNS Topic.

Running the Example

May 22, 2017  The lono generate command generates the CloudFormation templates to the output folder using the config/lono.rb and templates/. files. Dec 21, 2018  This article describes how you can use AWS CloudFormation to create and manage a Virtual Private Cloud (VPC), complete with subnets, NATting, route tables, etc. The emphasis is use of CloudFormation and Infrastructure as Code to build and manage resources in.

Option 1: Launch the CloudFormation Template in US East - N. Virginia (us-east-1)

The backend infrastructure can be deployed in US East - N. Virginia (us-east-1) using the provided CloudFormation template.Click Launch Stack to launch the template in the US East - N. Virginia (us-east-1) region in your account:

(In the last page of the wizard, make sure to:

  1. Click the checkboxes to give AWS CloudFormation permission to 'create IAM resources' and 'create IAM resources with custom names'
  2. Follow the instructions to 'Create Change Set'
  3. Click 'Execute')

Generate Access Keys Using Cloudformation Template Free

Option 2: Launch the CloudFormation Template Manually

Generate access keys using cloudformation template for kids

If you would like to deploy the template manually, you need a S3 bucket in the target region, and then package the Lambda functions into that S3 bucket by using the aws cloudformation package utility.

** Note that this template may only be launched into US East - N. Virginia (us-east-1) as that is the only region where Trusted Advisor CloudWatch Event rules are configurable. **

Set environment variables for later commands to use:

Then go to the cloudformation folder and use the aws cloudformation package utility

Last, deploy the stack with the resulting yaml (exposed_access_keys.output.yaml) through the CloudFormation Console or command line:

Testing the Example

To test the example without exposing an IAM Access Key to a public repository you can simulate the workflow by executing the ExposedKey state machine with a set of test json for the event. To do this follow the steps detailed below.

Ensure you have at least one E-mail address subscribed to the SecurityNotificationTopic created by the template to receive the notification.

  1. Go to the Identity & Access Management console
  2. Go to Users
  3. Click Add User and create a user with programmatic access
    • For the User name put test-user
    • For Access type select Programmatic access
    • Do not set any permissions for the user
    • Note the Access key ID from the Review page for later use in the test json
  4. Go to the Step Functions console
  5. Select the ExposedKey state machine
  6. Click New execution to create the test execution of the state machine
    • Copy and paste the json below to the execution json field
    • Replace ACCESS_KEY_ID_HERE with the Access key ID noted from the earlier creation of test-user
    • You do not need to enter an execution id as one will be randomly generated by default

You can follow the state machine's progress in the Step Functions console. The summary message for test-user will be sent to the e-mail address(es) subscribed to the SecurityNotificationTopic SNS Topic.

  • Note that the summary for this user will likely be empty as it will not have logged any API calls to CloudTrail

Here is an example of what this message might look like for a user who has made recent API calls to IAM and Step Functions:

Cleaning Up the Stack Resources

To remove all resources created by this example, do the following:

  1. Delete the CloudFormation stack.
  2. Delete the CloudWatch log groups associated with each Lambda function created by the CloudFormation stack.

CloudFormation Template Resources

The following sections explain all of the resources created by the CloudFormation template provided with this example.

CloudWatch

  • TrustedAdvisorExposedKeyRule - A CloudWatch Events Rule to detect Trusted Advisor Exposed Key events and send them to the Step Functions state machine target

Step Functions

  • ExposedKeysStepFunction - A Step Functions state machine that orchestrates the access key deletion, API call summary, and notification of security

Lambda

Generate Access Keys Using Cloudformation Template Microsoft

  • DeleteAccessKeyPair - Lambda function that deletes the exposed IAM Access Key Pair associated with username provided by event.
  • LookupCloudTrailEvents - Lambda function that looks up and summarizes recent API activity for the exposed access key provided by the event.
  • NotifySecurity - Lambda function that constructs and sends security notification message containing API activity summary to SNS Topic created by this CloudFormation template.

SNS

  • NotificationTopic - SNS Topic that API activity security message is sent to.

IAM

  • ExecuteStateMachineRole - IAM Role with policy that allows CloudWatch Events rule to invoke executions of Step Functions state machines
  • StepFunctionExecutionRole IAM Role with policy that allows Step Functions state machines to invoke Lambda functions.
  • LambdaDeleteAccessKeyPairRole - IAM Role with policy that allows Lambda function to invoke 'iam:DeleteAccessKey' API call and write log messages to CloudWatch Logs.
  • LambdaLookupCloudTrailEventsRole - IAM Role with policy that allows Lambda function to invoke 'cloudtrail:LookupEvents' API call and write log messages to CloudWatch Logs.
  • LambdaSnsPublishRole - IAM Role with policy that allows Lambda function to invoke 'sns:Publish' API call and write log messages to CloudWatch Logs.

License

Generate Access Keys Using Cloudformation Template

Cloudformation Template Documentation

This reference architecture sample is licensed under Apache 2.0.