借助 Cloud Foundations 产品工厂和包工厂以最佳安全实践事件驱动自动初始化实例安装基础软件并配置会话日志和监控指标

{
  "vpcs": {
    "security": {
      "is_hub": true, "enable_igw": true, "enable_nat": true,
      "cidr": "192.168.0.0/16",
      "subnets": [[[12, 0], [12, 1]], [[8, 1],  [8, 2]]]
    },
    "sandbox": {
      "accounts": ["SANDBOX_ACCOUNT"],
      "cidr": "10.1.0.0/16",
      "subnets": [[[12, 0], [12, 1]], [], [[8, 3], [8, 4]]]
    }
  },
  "tgw": {
    "enabled": true,
    "cidr": "10.0.0.0/8",
    "tables": {
      "pre":  { "associations": ["sandbox"], "routes": { "*": "security" } },
      "post": { "associations": ["security"], "propagations": ["sandbox"] }
    }
  }
}

aws s3api put-object \
--bucket $PREFIX-bucket-logs-ssm-$LOGS_ACCOUNT \
--key tmp/AWSCLIV2.msi \
--body AWSCLIV2.msi \
--server-side-encryption aws:kms \
--ssekms-key-id $SSM_KEY_ARN

[
  [{
      "service": "kms",
      "accounts": ["${STAGE}"],
      "keys": {
        "${Bootstrap}": {
          "allows": ["self", "logs"],
          "statements": [{
              "trusts": ["events"], "actions": ["kms:Decrypt", "kms:GenerateDataKey"]
          }]
        }
      }
  }],
  [{
      "service": "sqs",
      "accounts": ["${STAGE}"],
      "queues": {
        "${Bootstrap}-events-letter": {
          "key": "$.${Bootstrap}",
          "statements": [{
              "sid": "Dead-letter queue permissions",
              "trusts": ["events"],
              "actions": ["sqs:SendMessage"],
              "resources": ["$.arn.sqs:${PREFIX}-queue-${Bootstrap}-events-letter"],
              "conditions": {
                "ArnEquals": {
                  "aws:SourceArn": "arn:${PARTITION}:events:${REGION}:*:rule/${PREFIX}-rule-*"
                }
              }
          }]
        }
      }
  }],
  [
    {
      "service": "iam",
      "accounts": ["${STAGE}"],
      "roles": {
        "${Bootstrap}-ssm-service": { "template": "ssm-service" },
        "${Bootstrap}-events-service": {
          "trusts": ["events"],
          "statements": [
            {
              "actions": ["iam:PassRole"],
              "resources": ["$.arn.iam:role/${PREFIX}-role-${Bootstrap}-ssm-service"]
            },
            {
              "actions": ["kms:Decrypt", "kms:GenerateDataKey"],
              "resources": ["key:$.${Bootstrap}"]
            },
            {
              "actions": ["sqs:SendMessage"],
              "resources": ["$.arn.sqs:${PREFIX}-queue-${Bootstrap}-events-letter"]
            },
            {
              "actions": ["ssm:StartAutomationExecution"],
              "resources": ["$.arn.ssm:automation-definition/${PREFIX}-document-*"]
            }
          ]
        }
      }
    },
    {
      "service": "ssm",
      "accounts": ["${STAGE}"],
      "documents": {
        "${Bootstrap}": {
          "target": "/AWS::EC2::Instance", "file": "${PREFIX}-document-ec2-bootstrap.yaml"
        }
      }
    },
    {
      "service": "logs",
      "accounts": ["${STAGE}"],
      "groups": {
        "${Bootstrap}/windows/application": { "key": "$.${Bootstrap}" },
        "${Bootstrap}/windows/security": { "key": "$.${Bootstrap}" },
        "${Bootstrap}/windows/system": { "key": "$.${Bootstrap}" },
        "${Bootstrap}/linux/application": { "key": "$.${Bootstrap}" },
        "${Bootstrap}/linux/security": { "key": "$.${Bootstrap}" },
        "${Bootstrap}/linux/system": { "key": "$.${Bootstrap}" }
      }
    }
  ],
  [
    {
      "service": "events",
      "accounts": ["${STAGE}"],
      "rules": {
        "${Bootstrap}-ec2-running": {
          "letter": "$.${Bootstrap}-events-letter",
          "pattern": {
            "source": ["aws.ec2"],
            "detail": { "state": ["running"] },
            "detail-type": ["EC2 Instance State-change Notification"]
          },
          "automations": {
            "$.${Bootstrap}": {
              "role": "$.${Bootstrap}-events-service",
              "ssm_role": "$.${Bootstrap}-ssm-service",
              "inputs": { "instance_id": "$.detail.instance-id" },
              "parameters": {
                "Bootstrap": ["${Bootstrap}"],
                "LogsAccount": ["${LOGS_ACCOUNT}"],
                "InstanceId": ["<instance_id>"]
              }
            }
          }
        },
        "${Bootstrap}-ec2-tagging": {
          "letter": "$.${Bootstrap}-events-letter",
          "pattern": {
            "source": ["aws.ec2"],
            "detail-type": ["AWS API Call via CloudTrail"],
            "detail": { "eventName": ["CreateTags"], "eventSource": ["ec2.amazonaws.com"]}
          },
          "automations": {
            "$.${Bootstrap}": {
              "role": "$.${Bootstrap}-events-service",
              "ssm_role": "$.${Bootstrap}-ssm-service",
              "inputs": { "instance_id": "$.detail.requestParameters.resourcesSet.items[0].resourceId"},
              "parameters": {
                "Bootstrap": ["${Bootstrap}"],
                "LogsAccount": ["${LOGS_ACCOUNT}"],
                "InstanceId": ["<instance_id>"]
              }
            }
          }
        }
      }
    },
    {
      "service": "ssm",
      "accounts": ["${STAGE}"],
      "parameters": {
        "${Bootstrap}/cloudwatch/config/windows": {
          "key": "$.${Bootstrap}",
          "json": {
            "logs": {
              "logs_collected": {
                "windows_events": {
                  "collect_list": [
                    {
                      "log_group_name": "/${PREFIX}/${Bootstrap}/windows/system",
                      "event_name": "System"
                    },
                    {
                      "log_group_name": "/${PREFIX}/${Bootstrap}/windows/security",
                      "event_name": "Security"
                    },
                    {
                      "log_group_name": "/${PREFIX}/${Bootstrap}/windows/application",
                      "event_name": "Application"
                    }
                  ]
                }
              }
            }
          }
        },
        "${Bootstrap}/cloudwatch/config/linux": {
          "key": "$.${Bootstrap}", json": {}
        }
      }
    }
  ]
]

[
  [
    {
      "service": "iam",
      "accounts": ["${STAGE}"],
      "roles": {
        "${HostName}-ec2-service": { "template": "ssm-ec2-service" },
        "${HostName}-session-user": { "template": "ssm-session-user" }
      }
    },
    {
      "service": "sso",
      "permissions": {
        "${HostName}-session-user": {
          "enabled": "${SsoEnabled}",
          "template": "ssm-session-user"
        }
      },
      "groups": {
        "${HostName}-ssm": {
          "enabled": "${SsoEnabled}",
          "assigns": { "${HostName}-ssm": ["${STAGE}"] }
        }
      }
    },
    {
      "service": "vpc",
      "accounts": ["${STAGE}"],
      "groups": {
        "${HostName}": {
          "vpc": "$.${VpcName}",
          "out": [
            { "protocol": "icmp", "cidr": "*" },
            { "protocol": "https", "cidr": "*" },
            { "protocol": "mssql", "cidr": "*" },
            { "protocol": "mysql", "cidr": "*" },
            { "protocol": "postgres", "cidr": "*" },
            { "protocol": "oracle", "cidr": "*" }
          ]
        }
      }
    }
  ],
  [
    {
      "service": "ec2",
      "accounts": ["${STAGE}"],
      "instances": {
        "${HostName}-linux": {
          "role": "$.${HostName}-ec2-service",
          "volumes": [{ "size": 20 }],
          "vpc": {
            "vpc": "$.${VpcName}", "subnet": "$.private", "groups": "$.${HostName}"
          },
          "tags": {
            "cf.ec2.bootstrap.enabled": "true",
            "cf.ec2.bootstrap.packages": "",
            "cf.ec2.bootstrap.cloudwatch.config": "linux"
          },
          "user_data": ["#!/bin/bash", "useradd --create-home ${PREFIX}"]
        },
        "${HostName}-windows": {
          "ami": "windows",
          "role": "$.${HostName}-ec2-service",
          "volumes": [{ "size": 30 }],
          "vpc": {
            "vpc": "$.${VpcName}", subnet": "$.private", groups": "$.${HostName}"
          },
          "tags": {
            "cf.ec2.bootstrap.enabled": "true",
            "cf.ec2.bootstrap.packages": "AWSCLIV2.msi",
            "cf.ec2.bootstrap.cloudwatch.config": "windows"
          }
        }
      }
    }
  ]
]