AWS Cloudformationテンプレート検索の例。
テンプレートの例
AWSTemplateFormatVersion: "2010-09-09" Resources: dynamodb003S1: Type: AWS::DynamoDB::Table Properties: PointInTimeRecoverySpecification: PointInTimeRecoveryEnabled: true AttributeDefinitions: - AttributeName: Album AttributeType: S - AttributeName: Artist AttributeType: S - AttributeName: Sales AttributeType: N - AttributeName: NumberOfSongs AttributeType: N KeySchema: - AttributeName: Album KeyType: HASH - AttributeName: Artist KeyType: RANGE ProvisionedThroughput: ReadCapacityUnits: "5" WriteCapacityUnits: "5" SSESpecification: SSEEnabled: true TableName: myTableName GlobalSecondaryIndexes: - IndexName: myGSI KeySchema: - AttributeName: Sales KeyType: HASH - AttributeName: Artist KeyType: RANGE Projection: NonKeyAttributes: - Album - NumberOfSongs ProjectionType: INCLUDE ProvisionedThroughput: ReadCapacityUnits: "5" WriteCapacityUnits: "5" - IndexName: myGSI2 KeySchema: - AttributeName: NumberOfSongs KeyType: HASH - AttributeName: Sales KeyType: RANGE Projection: NonKeyAttributes: - Album - Artist ProjectionType: INCLUDE ProvisionedThroughput: ReadCapacityUnits: "5" WriteCapacityUnits: "5" LocalSecondaryIndexes: - IndexName: myLSI KeySchema: - AttributeName: Album KeyType: HASH - AttributeName: Sales KeyType: RANGE Projection: NonKeyAttributes: - Artist - NumberOfSongs ProjectionType: INCLUDE
検索コマンドの例
#!/usr/bin/env bash # Scans a template file # Requires "jq" (https://stedolan.github.io/jq/) to be installed api_key="Your Trend Vision One API Key" api_base_url="https://api.xdr.trendmicro.com" file_path="Path to template" content=$(cat ${file_path} | jq '.' -MRs) payload="{\"type\":\"cloudformation-template\",\"content\":${content}}" echo Request: echo ${payload} | jq '.' -M echo Response: curl -s -X POST \ -H "Authorization: Bearer ${api_key}" \ -H "Content-Type: application/json" \ ${api_base_url}/beta/cloudPosture/scanTemplate \ --data-binary "${payload}" | jq '.' -M
Template Scanner APIの出力例
{ "scanResults": [ { "id": "ccc:OrganisationId:RG-001:ResourceGroup:us-east-1:dynamodb003s1-otfs8ljoe0sp", "accountId": "", "ruleId": "RG-001", "provider": "aws", "ruleTitle": "Tags", "riskLevel": "LOW", "status": "FAILURE", "service": "ResourceGroup", "description": "dynamodb-table dynamodb003s1-otfs8ljoe0sp has [Environment, Role, Owner, Name] tags missing", "resource": "dynamodb003s1-otfs8ljoe0sp", "resourceType": "dynamodb-table", "ignored": false, "categories": [ "security", "reliability", "performance-efficiency", "cost-optimisation", "operational-excellence", "sustainability" ], "compliances": [ "AWAF", "CIS-V8", "NIST4", "NIST5", "SOC2", "NIST-CSF", "ISO27001", "ISO27001-2022", "AGISM", "HITRUST", "ASAE-3150", "PCI-V4", "FEDRAMP", "MAS", "CSA" ], "region": "us-east-1", "notScored": false, "resolutionPageUrl": "https://wstaging.cloudconformity.com/knowledge-base/aws/ResourceGroup/tags.html" }, { "id": "ccc:OrganisationId:DynamoDB-003:DynamoDB:us-east-1:dynamodb003s1-otfs8ljoe0sp", "accountId": "", "ruleId": "DynamoDB-003", "provider": "aws", "ruleTitle": "DynamoDB Continuous Backups", "riskLevel": "HIGH", "status": "SUCCESS", "service": "DynamoDB", "description": "Continuous Backups are enabled for [dynamodb003s1-otfs8ljoe0sp]", "resource": "dynamodb003s1-otfs8ljoe0sp", "resourceType": "dynamodb-table", "resourceId": "dynamodb003s1-otfs8ljoe0sp", "ignored": false, "categories": ["reliability"], "compliances": [ "AWAF", "CIS-V8", "NIST4", "NIST5", "SOC2", "NIST-CSF", "ISO27001", "ISO27001-2022", "AGISM", "HIPAA", "HITRUST", "ASAE-3150", "PCI", "PCI-V4", "APRA", "FEDRAMP", "MAS", "CSA", "ENISA", "FISC-V9" ], "region": "us-east-1", "tags": [], "notScored": false, "resolutionPageUrl": "https://wstaging.cloudconformity.com/knowledge-base/aws/DynamoDB/continuous-backups.html" }, { "id": "ccc:OrganisationId:DynamoDB-004:DynamoDB:us-east-1:dynamodb003s1-otfs8ljoe0sp", "accountId": "", "ruleId": "DynamoDB-004", "provider": "aws", "ruleTitle": "Enable Encryption at Rest with Amazon KMS Keys", "riskLevel": "HIGH", "status": "SUCCESS", "service": "DynamoDB", "description": "Table [dynamodb003s1-otfs8ljoe0sp] is encrypted at rest using the AWS managed key or Customer managed key", "resource": "dynamodb003s1-otfs8ljoe0sp", "resourceType": "dynamodb-table", "resourceId": "dynamodb003s1-otfs8ljoe0sp", "ignored": false, "categories": ["security"], "compliances": [ "GDPR", "AWAF", "CIS-V8", "NIST4", "NIST5", "SOC2", "NIST-CSF", "ISO27001", "ISO27001-2022", "AGISM", "HIPAA", "HITRUST", "ASAE-3150", "PCI", "PCI-V4", "APRA", "FEDRAMP", "MAS", "CSA", "ENISA", "FISC-V9", "LGPD" ], "region": "us-east-1", "tags": [], "notScored": false, "resolutionPageUrl": "https://wstaging.cloudconformity.com/knowledge-base/aws/DynamoDB/encrypted-with-cmk.html" } ], "missingParameters": [], "skippedRules": [] }