*/
public class ComplianceFactory extends BaseFactory {
private static final Logger LOG = Logger.getLogger(ComplianceFactory.class.getName());
@SystemContext("security")
private SecurityProfile security;
@SystemContext("stackName")
private String stackName;
@DeploymentContext("awsConfigEnabled")
private Boolean awsConfigEnabled;
@DeploymentContext("auditManagerEnabled")
private Boolean auditManagerEnabled;
@DeploymentContext("auditManagerFrameworkId")
private String auditManagerFrameworkId;
@DeploymentContext("complianceFrameworks")
private String complianceFrameworks;
@DeploymentContext("createConfigInfrastructure")
private Boolean createConfigInfrastructure;
@DeploymentContext("enableS3VersioningRemediation")
private Boolean enableS3VersioningRemediation;
@DeploymentContext("enableCloudTrailBucketAccessRemediation")
private Boolean enableCloudTrailBucketAccessRemediation;
@DeploymentContext("enableRdsDeletionProtectionRemediation")
private Boolean enableRdsDeletionProtectionRemediation;
@DeploymentContext("enableRdsAutoMinorVersionUpgradeRemediation")
private Boolean enableRdsAutoMinorVersionUpgradeRemediation;
@DeploymentContext("enableSecurityHubRemediation")
private Boolean enableSecurityHubRemediation;
@DeploymentContext("enableInspectorRemediation")
private Boolean enableInspectorRemediation;
@DeploymentContext("enableMacieRemediation")
private Boolean enableMacieRemediation;
@DeploymentContext("enableGuardDutyRemediation")
private Boolean enableGuardDutyRemediation;
// Note: ECR image scanning remediation removed - not implemented
// If needed in future, add: @DeploymentContext("enableEcrImageScanningRemediation")
@DeploymentContext("scopeConfigRulesToDeployment")
private Boolean scopeConfigRulesToDeployment;
@DeploymentContext("provisionDatabase")
private Boolean provisionDatabase;
@DeploymentContext("deploymentId")
private String deploymentId;
@DeploymentContext("region")
private String region;
public ComplianceFactory(Construct scope, String id) {
super(scope, id);
}
// CloudFormation conditions for framework-specific Config rules
private CfnCondition pciDssCondition;
private CfnCondition soc2Condition;
private CfnCondition hipaaCondition;
private CfnCondition gdprCondition;
private CfnCondition databaseProvisionedCondition;
// Combined conditions for RDS rules (framework AND database)
private CfnCondition pciDssRdsCondition;
private CfnCondition soc2RdsCondition;
private CfnCondition hipaaRdsCondition;
private CfnCondition gdprRdsCondition;
// CloudTrail and bucket for S3 data event configuration
private Trail trail;
private Bucket trailBucket;
private String trailName;
@Override
public void create() {
LOG.info("Creating compliance resources for security profile: " + security);
// Create CloudFormation conditions for compliance frameworks
createFrameworkConditions();
// Create CloudTrail if enabled for this security profile (STAGING/PRODUCTION by default)
if (ctx.security == SecurityProfile.PRODUCTION || ctx.security == SecurityProfile.STAGING) {
createCloudTrail();
} else {
LOG.info("CloudTrail disabled for security profile: " + security);
}
// Check if AWS Audit Manager should be enabled (do this BEFORE Config infrastructure)
// This ensures Audit Manager configuration errors fail before creating account-level resources
boolean auditManagerEnabledFlag = Boolean.TRUE.equals(auditManagerEnabled)
|| (auditManagerEnabled == null && (ctx.security == SecurityProfile.PRODUCTION || ctx.security == SecurityProfile.STAGING));
if (auditManagerEnabledFlag) {
LOG.info("Creating AWS Audit Manager assessments and framework controls for profile: " + security);
createAuditManagerAssessments();
} else {
LOG.info("AWS Audit Manager disabled for profile: " + security);
}
// STEP 1: Check if Config INFRASTRUCTURE should be created (Recorder + Delivery Channel)
// These are account-level singleton resources - only ONE per region per account allowed
// createConfigInfrastructure controls ONLY infrastructure, NOT rules
boolean shouldCreateInfra = Boolean.TRUE.equals(createConfigInfrastructure);
boolean configInfraExists = false;
// Only check for existing infrastructure if we're planning to create it
if (shouldCreateInfra) {
configInfraExists = checkConfigInfrastructureExists();
if (configInfraExists) {
LOG.warning("Config infrastructure already exists but createConfigInfrastructure = true");
LOG.warning(" Existing Config Recorder detected in region: " + region);
LOG.warning(" Setting createConfigInfrastructure = false automatically to avoid conflict");
LOG.warning(" To override this behavior, manually set createConfigInfrastructure in deployment-context.json");
shouldCreateInfra = false;
}
}
ConfigInfrastructure configInfra = null;
if (shouldCreateInfra) {
LOG.info("Creating Config Recorder and Delivery Channel (account-level singletons)");
LOG.info(" IMPORTANT: Only ONE stack per region should have createConfigInfrastructure = true");
configInfra = createConfigInfrastructure();
} else {
if (configInfraExists) {
LOG.info("Config infrastructure already exists in region (auto-detected)");
} else {
LOG.info("Skipping Config infrastructure creation (createConfigInfrastructure = false)");
}
LOG.info(" Config Recorder 'cloudforge-config-recorder' will be referenced by name if needed");
}
// STEP 2: Deploy Conformance Packs (AWS managed rule bundles for compliance frameworks)
// Conformance Packs are the foundation - they deploy standardized Config rules
boolean configRulesEnabled = Boolean.TRUE.equals(awsConfigEnabled)
|| (awsConfigEnabled == null && (ctx.security == SecurityProfile.PRODUCTION || ctx.security == SecurityProfile.STAGING));
if (configRulesEnabled) {
LOG.info("Deploying Conformance Packs for compliance frameworks");
deployConformancePacks(configInfra);
}
// STEP 3: Deploy custom/additional Config rules not covered by Conformance Packs
// awsConfigEnabled controls ONLY rules and remediation, NOT infrastructure
// This is now completely decoupled from infrastructure creation
if (configRulesEnabled) {
LOG.info("Creating additional AWS Config rules not covered by Conformance Packs");
// Config Rules reference the recorder by name at runtime, regardless of whether
// we created the infrastructure in this stack or it already existed
// This eliminates the need for two separate code paths
if (configInfra != null) {
// We just created the infrastructure - add CloudFormation dependencies for ordering
LOG.info(" Config infrastructure created in this stack - adding CloudFormation dependencies");
createConfigRules(configInfra.recorder, configInfra.starterResource);
createAllFrameworkConfigRules(configInfra.recorder, configInfra.starterResource);
} else {
// Infrastructure already exists or wasn't created - rules still work, just no CF dependency
LOG.info(" Config Recorder referenced by name 'cloudforge-config-recorder'");
LOG.info(" Rules will be created without CloudFormation dependencies");
createConfigRulesWithoutRecorder();
createAllFrameworkConfigRulesWithoutRecorder();
}
} else {
LOG.info("AWS Config rules and remediation disabled for profile: " + security);
LOG.info(" awsConfigEnabled = " + awsConfigEnabled + " (controls rules and remediation)");
LOG.info(" createConfigInfrastructure = " + createConfigInfrastructure + " (controls recorder and channel)");
}
LOG.info("Compliance resources created successfully for profile: " + security);
// STEP 4: Deploy Config rules collected from factories
// This deploys only the rules that match actually-provisioned infrastructure
if (configRulesEnabled) {
deployCollectedConfigRules();
} else {
LOG.info("Skipping collected Config rules deployment (configRulesEnabled = false)");
}
}
/**
* Deploy AWS Config rules collected from factories.
*
*
This method deploys Config rules that were registered by infrastructure factories
* (e.g., GuardDutyFactory, VpcFactory, RdsFactory) where the infrastructure was actually
* created. Rules are filtered based on compliance frameworks and mode.
*
*
This approach ensures Config rules are only deployed for infrastructure that exists,
* and automatically deduplicates rules when multiple frameworks require the same control.
*/
private void deployCollectedConfigRules() {
var collectedRules = ctx.getRequiredConfigRules();
if (collectedRules.isEmpty()) {
LOG.info("No Config rules collected from factories");
return;
}
LOG.info("Deploying " + collectedRules.size() + " Config rules collected from factories");
String frameworks = complianceFrameworks != null ? complianceFrameworks : "";
ComplianceMode mode = ctx.cfc.complianceMode();
int deployedCount = 0;
for (AwsConfigRule rule : collectedRules) {
if (rule.isRequired(frameworks, mode)) {
// Deploy the Config rule
CfnConfigRule.Builder.create(this, "Collected" + rule.name())
.configRuleName(rule.getRuleName())
.description(rule.getDescription() + " (collected from factory)")
.source(CfnConfigRule.SourceProperty.builder()
.owner("AWS")
.sourceIdentifier(rule.getRuleName().toUpperCase().replace("-", "_"))
.build())
.build();
deployedCount++;
LOG.fine(" Deployed: " + rule.getRuleName() + " (" + rule.getSecurityControl() + ")");
} else {
LOG.fine(" Skipped: " + rule.getRuleName() + " (not required for " + frameworks + "/" + mode + ")");
}
}
LOG.info("Deployed " + deployedCount + " of " + collectedRules.size() + " collected Config rules");
// Also deploy account-level authentication/access control rules
deployAuthenticationConfigRules(frameworks, mode);
}
/**
* Deploy account-level authentication and access control Config rules.
* These rules check IAM settings across the entire AWS account and are
* required by most compliance frameworks (PCI-DSS, HIPAA, SOC2, etc.).
*/
private void deployAuthenticationConfigRules(String frameworks, ComplianceMode mode) {
// Authentication rules - required by most compliance frameworks
var authRules = java.util.List.of(
AwsConfigRule.IAM_USER_MFA_ENABLED,
AwsConfigRule.IAM_PASSWORD_POLICY,
AwsConfigRule.IAM_USER_GROUP_MEMBERSHIP,
AwsConfigRule.IAM_NO_ADMIN_ACCESS
);
int deployedCount = 0;
for (AwsConfigRule rule : authRules) {
if (rule.isRequired(frameworks, mode)) {
CfnConfigRule.Builder.create(this, "Auth" + rule.name())
.configRuleName(rule.getRuleName())
.description(rule.getDescription())
.source(CfnConfigRule.SourceProperty.builder()
.owner("AWS")
.sourceIdentifier(rule.getRuleName().toUpperCase().replace("-", "_"))
.build())
.build();
deployedCount++;
}
}
if (deployedCount > 0) {
LOG.info("Deployed " + deployedCount + " authentication/access control Config rules");
}
}
/**
* Creates CloudFormation conditions for each compliance framework.
* These conditions determine which framework-specific Config rules are deployed.
*
* Supports multiple frameworks via comma-separated values (e.g., "PCI-DSS,SOC2,HIPAA").
* When a framework is removed, its condition becomes false and CloudFormation deletes those rules.
*/
private void createFrameworkConditions() {
List frameworks = determineFrameworks();
LOG.info("Creating CloudFormation conditions for frameworks: " + String.join(", ", frameworks));
// Normalize framework names for comparison
List normalizedFrameworks = frameworks.stream()
.map(f -> f.trim().toUpperCase().replace("-", "").replace("_", ""))
.collect(java.util.stream.Collectors.toList());
// Create condition for PCI-DSS
boolean enablePciDss = normalizedFrameworks.contains("PCIDSS");
pciDssCondition = CfnCondition.Builder.create(this, "EnablePciDssRules")
.expression(Fn.conditionEquals(enablePciDss ? "true" : "false", "true"))
.build();
// Create condition for SOC 2
boolean enableSoc2 = normalizedFrameworks.contains("SOC2");
soc2Condition = CfnCondition.Builder.create(this, "EnableSoc2Rules")
.expression(Fn.conditionEquals(enableSoc2 ? "true" : "false", "true"))
.build();
// Create condition for HIPAA
boolean enableHipaa = normalizedFrameworks.contains("HIPAA");
hipaaCondition = CfnCondition.Builder.create(this, "EnableHipaaRules")
.expression(Fn.conditionEquals(enableHipaa ? "true" : "false", "true"))
.build();
// Create condition for GDPR
boolean enableGdpr = normalizedFrameworks.contains("GDPR");
gdprCondition = CfnCondition.Builder.create(this, "EnableGdprRules")
.expression(Fn.conditionEquals(enableGdpr ? "true" : "false", "true"))
.build();
// Create condition for database provisioning
// RDS Config rules should only deploy when a database is actually provisioned
boolean dbProvisioned = (provisionDatabase != null && provisionDatabase);
databaseProvisionedCondition = CfnCondition.Builder.create(this, "DatabaseProvisioned")
.expression(Fn.conditionEquals(dbProvisioned ? "true" : "false", "true"))
.build();
// Create combined conditions for RDS rules (framework AND database)
// These ensure RDS Config rules only deploy when both the framework is enabled AND a database is provisioned
pciDssRdsCondition = CfnCondition.Builder.create(this, "EnablePciDssRdsRules")
.expression(Fn.conditionAnd(pciDssCondition, databaseProvisionedCondition))
.build();
soc2RdsCondition = CfnCondition.Builder.create(this, "EnableSoc2RdsRules")
.expression(Fn.conditionAnd(soc2Condition, databaseProvisionedCondition))
.build();
hipaaRdsCondition = CfnCondition.Builder.create(this, "EnableHipaaRdsRules")
.expression(Fn.conditionAnd(hipaaCondition, databaseProvisionedCondition))
.build();
gdprRdsCondition = CfnCondition.Builder.create(this, "EnableGdprRdsRules")
.expression(Fn.conditionAnd(gdprCondition, databaseProvisionedCondition))
.build();
LOG.info("CloudFormation conditions created: PCI-DSS = " + enablePciDss + ", SOC2 = " + enableSoc2 +
", HIPAA = " + enableHipaa + ", GDPR = " + enableGdpr + ", Database = " + dbProvisioned);
}
/**
* Create CloudTrail for audit logging.
*
* Uses fixed account-level bucket name for cross-stack reusability.
* This allows multiple stacks to share the same CloudTrail infrastructure.
*
* Naming Strategy:
* - Fixed bucket name: cloudforge-cloudtrail-{accountId}-{region}
* - Fixed trail name: cloudforge-cloudtrail
* - First deployment: CloudFormation creates bucket with fixed name
* - Redeployment: CloudFormation reuses existing bucket
* - Removal: Bucket is retained (RemovalPolicy.RETAIN) for compliance
* - Multiple stacks: Share the same CloudTrail bucket
*
* IMPORTANT: Uses fromBucketName to import existing buckets instead of creating new ones.
* This prevents "AlreadyExists" errors when buckets were retained from previous deployments.
*/
private void createCloudTrail() {
LOG.info("Creating CloudTrail for audit logging");
// Use stack-scoped trail name to avoid conflicts between multiple stacks in same region
// Each stack gets its own CloudTrail trail (but can share buckets via SSM)
this.trailName = "cloudforge-cloudtrail-" + this.stackName;
LOG.info("CloudTrail will use stack-scoped name: " + this.trailName);
LOG.info(" This avoids conflicts when deploying multiple stacks in the same region");
// Check SSM Parameter Store at DEPLOYMENT TIME for existing bucket (stack-scoped)
String ssmParamName = "/cloudforge/shared/" + this.region + "/stack/" + this.stackName + "/cloudtrail/bucket-arn";
Bucket trailBucket = getOrCreateBucketWithSSM("CloudTrailBucket", ssmParamName);
LOG.info("CloudTrail bucket ARN will be tracked in SSM Parameter Store for reuse");
// Enable KMS encryption for CloudTrail when:
// 1. HIPAA or PCI-DSS compliance in PRODUCTION (mandatory)
// 2. cloudWatchLogsKmsEncryptionEnabled is explicitly set to true (optional hardening)
boolean isHipaa = complianceFrameworks != null && complianceFrameworks.toUpperCase().contains("HIPAA");
boolean isPciDss = complianceFrameworks != null && complianceFrameworks.toUpperCase().contains("PCI-DSS");
boolean useKms = (security == SecurityProfile.PRODUCTION && (isHipaa || isPciDss))
|| config.isCloudWatchLogsKmsEncryptionEnabled();
// Create KMS-encrypted CloudWatch Log Group for CloudTrail (PCI-DSS Req 3.4)
Key cloudTrailLogsKmsKey = null;
LogGroup cloudTrailLogGroup = null;
if (useKms) {
cloudTrailLogsKmsKey = Key.Builder.create(this, "CloudTrailLogsKmsKey")
.description("KMS key for CloudTrail CloudWatch Logs (HIPAA/PCI-DSS compliance)")
.enableKeyRotation(true)
.removalPolicy(RemovalPolicy.DESTROY)
.build();
cloudTrailLogGroup = LogGroup.Builder.create(this, "CloudTrailLogGroup")
.logGroupName("/aws/cloudtrail/" + this.trailName)
.retention(config.getLogRetentionDays())
.encryptionKey(cloudTrailLogsKmsKey)
.removalPolicy(RemovalPolicy.DESTROY)
.build();
}
// Create CloudTrail using high-level Trail construct
// If trail with this name already exists, CloudFormation will update it or fail gracefully
Trail.Builder trailBuilder = Trail.Builder.create(this, "CloudTrail")
.trailName(this.trailName) // Fixed name for reusability
.bucket(trailBucket)
.enableFileValidation(true)
.includeGlobalServiceEvents(true)
.isMultiRegionTrail(true);
// Configure CloudWatch Logs - use pre-created encrypted log group if KMS enabled
if (cloudTrailLogGroup != null) {
trailBuilder.cloudWatchLogGroup(cloudTrailLogGroup);
trailBuilder.sendToCloudWatchLogs(true);
} else {
trailBuilder.sendToCloudWatchLogs(true);
trailBuilder.cloudWatchLogsRetention(config.getLogRetentionDays());
}
// Apply KMS encryption for HIPAA/PCI-DSS compliance in PRODUCTION
if (useKms) {
Key cloudTrailKmsKey = Key.Builder.create(this, "CloudTrailKmsKey")
.description("KMS key for CloudTrail (HIPAA/PCI-DSS compliance)")
.enableKeyRotation(true)
.removalPolicy(RemovalPolicy.DESTROY)
.build();
// Grant CloudTrail service permission to use the key
cloudTrailKmsKey.addToResourcePolicy(PolicyStatement.Builder.create()
.sid("Enable CloudTrail log encryption")
.effect(Effect.ALLOW)
.principals(List.of(new ServicePrincipal("cloudtrail.amazonaws.com")))
.actions(List.of("kms:GenerateDataKey*", "kms:Decrypt"))
.resources(List.of("*"))
.build());
trailBuilder.encryptionKey(cloudTrailKmsKey);
}
Trail trail = trailBuilder.build();
// Store trail for later configuration
this.trail = trail;
this.trailBucket = trailBucket;
// CloudTrail trail can be safely deleted - all audit logs are stored in the S3 bucket
// The S3 bucket has its own RETAIN policy to preserve the actual log data
trail.applyRemovalPolicy(RemovalPolicy.DESTROY);
LOG.info("CloudTrail created: " + trail.getTrailArn());
LOG.info("CloudTrail removal policy: DESTROY (logs retained in S3 bucket)");
LOG.info("CloudTrail name: " + trailName + " (stack-scoped to avoid conflicts)");
// Register AWS Config rules for CloudTrail compliance
ctx.requireConfigRule(AwsConfigRule.CLOUDTRAIL_ENABLED);
ctx.requireConfigRule(AwsConfigRule.CLOUDTRAIL_LOG_FILE_VALIDATION);
ctx.requireConfigRule(AwsConfigRule.MULTI_REGION_CLOUDTRAIL);
// Register KMS encryption Config rules when enabled
if (useKms) {
ctx.requireConfigRule(AwsConfigRule.CLOUDTRAIL_ENCRYPTION_ENABLED);
ctx.requireConfigRule(AwsConfigRule.CLOUDWATCH_LOG_GROUP_ENCRYPTED);
}
// Configure CloudTrail Insights when required by compliance frameworks (SOC2, NIST)
if (config.isCloudTrailInsightsEnabled()) {
configureCloudTrailInsights(trail);
}
// Store CloudTrail ARN in SSM for future reference (stack-specific)
AwsCustomResource cloudTrailSsmWriter = storeResourceArnInSSM("CloudTrailArn",
"/cloudforge/" + this.stackName + "/" + this.region + "/cloudtrail/arn",
trail.getTrailArn(),
"CloudTrail ARN for stack " + this.stackName + " in region " + this.region);
if (cloudTrailSsmWriter != null) {
cloudTrailSsmWriter.getNode().addDependency(trail);
}
// Configure S3 data event logging using CloudFormation escape hatch
configureCloudTrailS3DataEvents(trail);
}
/**
* Configure CloudTrail S3 data event logging using Advanced Event Selectors.
* This adds AdvancedEventSelectors to the underlying CfnTrail resource for SOC2/PCI-DSS/HIPAA compliance.
* Uses the newer Advanced Event Selectors API which properly supports wildcards.
*/
private void configureCloudTrailS3DataEvents(Trail trail) {
// Get the underlying CfnTrail resource
CfnTrail cfnTrail = (CfnTrail) trail.getNode().getDefaultChild();
// Use Advanced Event Selectors (newer API) via CloudFormation property override
// Advanced Event Selectors support proper wildcard matching for all S3 buckets
// Using addPropertyOverride to bypass CDK builder API issues
cfnTrail.addPropertyOverride("AdvancedEventSelectors", List.of(
// Selector 1: Log all management events
Map.of(
"Name", "Log all management events",
"FieldSelectors", List.of(
Map.of(
"Field", "eventCategory",
"Equals", List.of("Management")
)
)
),
// Selector 2: Log all S3 data events (SOC2/PCI-DSS/HIPAA compliance)
Map.of(
"Name", "Log all S3 data events for SOC2 compliance",
"FieldSelectors", List.of(
Map.of(
"Field", "eventCategory",
"Equals", List.of("Data")
),
Map.of(
"Field", "resources.type",
"Equals", List.of("AWS::S3::Object")
)
)
)
));
LOG.info("CloudTrail S3 data event logging configured for ALL S3 buckets using Advanced Event Selectors (SOC2/PCI-DSS/HIPAA compliance)");
}
/**
* Configure CloudTrail Insights for anomaly detection in API activity.
* This enables both API call rate and API error rate insights.
*
*
CloudTrail Insights identifies unusual operational activity, such as:
*
*
Spikes in API call volume
*
Increases in error rates
*
Unusual patterns that may indicate security incidents
*
*
*
Required for SOC2 CC7.2 (anomaly detection) and NIST SI-4 (system monitoring).
*
* @param trail The CloudTrail trail to configure Insights on
*/
private void configureCloudTrailInsights(Trail trail) {
LOG.info("Enabling CloudTrail Insights for anomaly detection (SOC2/NIST compliance)");
// Get the underlying CfnTrail resource to configure Insights
CfnTrail cfnTrail = (CfnTrail) trail.getNode().getDefaultChild();
// Enable both API call rate and API error rate Insights
cfnTrail.addPropertyOverride("InsightSelectors", List.of(
Map.of("InsightType", "ApiCallRateInsight"),
Map.of("InsightType", "ApiErrorRateInsight")
));
LOG.info("CloudTrail Insights enabled: ApiCallRateInsight, ApiErrorRateInsight");
}
/**
* Add additional S3 bucket to CloudTrail data event logging.
* Called from createAuditManagerAssessments() to track Audit Manager reports bucket.
*
*
Note: Since CloudTrail is now configured to track ALL S3 buckets using wildcard,
* this method is no longer needed to add specific buckets. Kept for compatibility.
*/
private void addS3DataEventLogging(Bucket bucket) {
if (this.trail == null || this.trailBucket == null) {
LOG.warning("CloudTrail not initialized, cannot add S3 data event logging for: " + bucket.getBucketName());
return;
}
// No action needed - CloudTrail already tracks all S3 buckets via wildcard configuration
LOG.info("S3 data event logging already enabled for all buckets (including " + bucket.getBucketName() + ")");
}
/**
* Create AWS Config rules for compliance monitoring.
* All rules depend on the provided Configuration Recorder.
*
* @param recorder The Configuration Recorder that rules depend on
*/
private void createConfigRules(CfnConfigurationRecorder recorder, AwsCustomResource starterResource) {
LOG.info("Setting up AWS Config rules for compliance monitoring");
// Create managed rules based on security profile
// All rules explicitly depend on the recorder being started
createEncryptionConfigRules(recorder, starterResource);
createS3ConfigRules(recorder, starterResource);
createIAMConfigRules(recorder, starterResource);
if (security == SecurityProfile.PRODUCTION) {
createProductionConfigRules(recorder, starterResource);
}
LOG.info("AWS Config rules configured");
}
/**
* Inner class to hold Config infrastructure components (recorder + starter).
* Config Rules must depend on BOTH the recorder AND the starter resource
* to ensure the recorder is in STARTED state before rules are created.
*/
private static class ConfigInfrastructure {
final CfnConfigurationRecorder recorder;
final AwsCustomResource starterResource;
ConfigInfrastructure(CfnConfigurationRecorder recorder, AwsCustomResource starterResource) {
this.recorder = recorder;
this.starterResource = starterResource;
}
}
/**
* Helper method to add dependencies to Config Rules.
* Rules must depend on both the recorder AND the starter resource.
*
* @param rule The Config Rule to add dependencies to
* @param recorder The Configuration Recorder
* @param starterResource The Custom Resource that starts the recorder
*/
private void addConfigRuleDependencies(CfnConfigRule rule, CfnConfigurationRecorder recorder, AwsCustomResource starterResource) {
rule.addOverride("DeletionPolicy", "Delete"); // Ensure Config rules are deleted with stack
rule.getNode().addDependency(recorder);
if (starterResource != null) {
rule.getNode().addDependency(starterResource);
}
}
/**
* Deploys AWS Conformance Packs for compliance frameworks.
* Conformance Packs are AWS-managed bundles of Config rules for SOC2, PCI-DSS, HIPAA, and GDPR.
*
*
Benefits:
*
*
AWS maintains the rule definitions and updates them when standards change
*
Industry-standard rule sets with best practice configurations
*
Standardized compliance reporting across accounts
*
*
* @param configInfra Config infrastructure (null if not created in this stack)
*/
private void deployConformancePacks(ConfigInfrastructure configInfra) {
List frameworks = determineFrameworks();
LOG.info("Deploying Conformance Packs for frameworks: " + String.join(", ", frameworks));
// Map framework names to AWS Conformance Pack SSM document names
// These are the actual document names in AWS Systems Manager
// NOTE: Use "ExcludingGlobalResourceTypes" for non-us-east-1 regions
// The "IncludingGlobalResourceTypes" version has CloudFront rules that only work in us-east-1
String pciDssTemplate = "us-east-1".equals(this.region)
? "AWSConformancePacks-OperationalBestPracticesforPCIDSSv4IncludingGlobalResourceTypes"
: "AWSConformancePacks-OperationalBestPracticesforPCIDSSv4ExcludingGlobalResourceTypes";
Map frameworkToTemplate = Map.of(
"PCIDSS", pciDssTemplate,
"HIPAA", "AWSConformancePacks-OperationalBestPracticesforHIPAASecurity"
// Note: SOC2 and GDPR don't have dedicated AWS-managed conformance packs
// SOC2 controls are covered by individual Config rules deployed separately
// GDPR requirements can use NIST Privacy Framework as closest match
);
for (String framework : frameworks) {
String normalizedFramework = framework.trim().toUpperCase().replace("-", "").replace("_", "");
String templateName = frameworkToTemplate.get(normalizedFramework);
if (templateName == null) {
LOG.warning("No AWS Conformance Pack available for framework: " + framework);
continue;
}
// Use stack name instead of security profile to avoid conflicts when switching profiles
String conformancePackName = "CloudForge-" + normalizedFramework + "-" + this.stackName;
LOG.info(" Deploying Conformance Pack: " + conformancePackName);
LOG.info(" SSM Document: " + templateName);
// Create Conformance Pack using SSM document reference
// Note: We use addPropertyOverride for TemplateSSMDocumentDetails because CDK 2.196.0
// has a bug where the Java bindings generate incorrect property casing (documentName
// instead of DocumentName). CloudFormation requires PascalCase for this property.
CfnConformancePack conformancePack = CfnConformancePack.Builder.create(this, "ConformancePack" + normalizedFramework)
.conformancePackName(conformancePackName)
.deliveryS3Bucket("") // Empty string uses default Config bucket
.build();
// Workaround for CDK 2.196.0 property casing bug - use L1 override to set correct casing
conformancePack.addPropertyOverride("TemplateSSMDocumentDetails.DocumentName", templateName);
// Delete conformance packs on stack deletion - they can be recreated when needed
conformancePack.applyRemovalPolicy(RemovalPolicy.DESTROY);
// Add condition for framework-specific deployment
CfnCondition condition = getConditionForFramework(normalizedFramework);
if (condition != null) {
conformancePack.getCfnOptions().setCondition(condition);
}
// Add dependency on Config infrastructure if it was created in this stack
if (configInfra != null) {
conformancePack.getNode().addDependency(configInfra.recorder);
conformancePack.getNode().addDependency(configInfra.starterResource);
}
LOG.info(" Conformance Pack created: " + conformancePackName);
}
LOG.info("Conformance Packs deployment complete");
}
/**
* Get the CloudFormation condition for a specific framework.
*/
private CfnCondition getConditionForFramework(String normalizedFramework) {
return switch (normalizedFramework) {
case "SOC2" -> soc2Condition;
case "PCIDSS" -> pciDssCondition;
case "HIPAA" -> hipaaCondition;
case "GDPR" -> gdprCondition;
default -> null;
};
}
/**
* Creates Configuration Recorder and Delivery Channel for AWS Config.
*
* IMPORTANT: AWS Config only allows ONE Configuration Recorder and ONE Delivery Channel
* per region per account. This method creates account-level resources with fixed names.
*
* If resources already exist from a previous deployment, CDK will reuse them.
* This enables multiple stacks to share the same Config infrastructure.
*
* @return ConfigInfrastructure containing recorder and starter resource for rule dependencies
*/
private ConfigInfrastructure createConfigInfrastructure() {
// Use fixed names (not stack-specific) since these are account-level resources
// AWS Config only allows 1 recorder and 1 delivery channel per region per account
String recorderName = "cloudforge-config-recorder";
String channelName = "cloudforge-config-channel";
LOG.info("Creating AWS Config infrastructure (account-level resources)");
LOG.info(" Recorder name: " + recorderName);
LOG.info(" Delivery channel: " + channelName);
// Create bucket with SSM tracking for PRODUCTION mode (stack-scoped)
String configSsmParam = "/cloudforge/shared/" + this.region + "/stack/" + this.stackName + "/config/bucket-arn";
Bucket configBucket = getOrCreateBucketWithSSM("ConfigBucket", configSsmParam);
LOG.info("AWS Config bucket ARN will be tracked in SSM Parameter Store");
// Create IAM role for AWS Config with explicit trust policy
Role configRole = Role.Builder.create(this, "ConfigRole")
.assumedBy(ServicePrincipal.Builder.create("config.amazonaws.com").build())
.description("AWS Config service role for compliance monitoring and rule evaluation")
.managedPolicies(List.of(
ManagedPolicy.fromAwsManagedPolicyName("service-role/AWS_ConfigRole"),
ManagedPolicy.fromAwsManagedPolicyName("SecurityAudit") // Required for Security Hub evaluation
))
.build();
// Grant additional permissions for Config rule evaluations
configRole.addToPolicy(PolicyStatement.Builder.create()
.effect(Effect.ALLOW)
.actions(List.of(
// Security Hub permissions
"securityhub:DescribeHub",
"securityhub:GetFindings",
"securityhub:GetEnabledStandards",
// ACM permissions for certificate expiration checks
"acm:DescribeCertificate",
"acm:ListCertificates",
"acm:GetCertificate",
// GuardDuty permissions
"guardduty:GetDetector",
"guardduty:ListDetectors",
// Inspector permissions
"inspector2:GetFindingsReportStatus",
"inspector2:ListFindings",
// Macie permissions
"macie2:GetMacieSession",
// EC2 permissions for EBS encryption checks
"ec2:DescribeVolumes",
"ec2:DescribeSnapshots",
"ec2:DescribeSnapshotAttribute",
"ec2:GetEbsEncryptionByDefault",
"ec2:GetEbsDefaultKmsKeyId",
// IAM permissions for password policy and root account checks
"iam:GetAccountPasswordPolicy",
"iam:GetAccountSummary",
"iam:ListUsers",
"iam:GetUser",
"iam:GetLoginProfile",
"iam:ListAccessKeys",
"iam:GetAccessKeyLastUsed",
// S3 permissions for bucket encryption and versioning checks
"s3:GetEncryptionConfiguration",
"s3:GetBucketVersioning",
"s3:GetBucketPolicy",
"s3:GetBucketPolicyStatus",
"s3:ListAllMyBuckets"
))
.resources(List.of("*"))
.build());
configBucket.grantWrite(configRole);
// RETAIN the Config role - it's referenced by the retained recorder/delivery channel
configRole.applyRemovalPolicy(RemovalPolicy.RETAIN);
CfnConfigurationRecorder recorder = CfnConfigurationRecorder.Builder.create(this, "ConfigRecorder")
.name(recorderName)
.roleArn(configRole.getRoleArn())
.recordingGroup(CfnConfigurationRecorder.RecordingGroupProperty.builder()
.allSupported(true)
.includeGlobalResourceTypes(true)
.build())
.recordingMode(CfnConfigurationRecorder.RecordingModeProperty.builder()
.recordingFrequency("CONTINUOUS")
.build())
.build();
// RETAIN resources - they're account-level and should survive stack deletion
recorder.applyRemovalPolicy(RemovalPolicy.RETAIN);
recorder.getNode().addDependency(configRole);
recorder.getNode().addDependency(configBucket);
CfnDeliveryChannel deliveryChannel = CfnDeliveryChannel.Builder.create(this, "ConfigDeliveryChannel")
.name(channelName)
.s3BucketName(configBucket.getBucketName())
.build();
// RETAIN resources - they're account-level and should survive stack deletion
deliveryChannel.applyRemovalPolicy(RemovalPolicy.RETAIN);
deliveryChannel.getNode().addDependency(configRole);
deliveryChannel.getNode().addDependency(configBucket);
LOG.info("AWS Config infrastructure created (will be retained on stack deletion)");
// Store Config Recorder and Delivery Channel ARNs in SSM for compliance tracking
// These are ALWAYS tracked (not just PRODUCTION) because they're account-level singletons
String recorderArn = software.amazon.awscdk.Stack.of(this).formatArn(software.amazon.awscdk.ArnComponents.builder()
.service("config")
.resource("config-recorder")
.resourceName(recorderName)
.build());
String channelArn = software.amazon.awscdk.Stack.of(this).formatArn(software.amazon.awscdk.ArnComponents.builder()
.service("config")
.resource("delivery-channel")
.resourceName(channelName)
.build());
// Store Recorder ARN (always, not just PRODUCTION)
AwsCustomResource recorderSsmWriter = storeResourceArnInSSMAlways("ConfigRecorderArn",
"/cloudforge/shared/" + this.region + "/config/recorder-arn",
recorderArn,
"AWS Config Recorder ARN for region " + this.region);
recorderSsmWriter.getNode().addDependency(recorder);
// Store Channel ARN (always, not just PRODUCTION)
AwsCustomResource channelSsmWriter = storeResourceArnInSSMAlways("ConfigDeliveryChannelArn",
"/cloudforge/shared/" + this.region + "/config/channel-arn",
channelArn,
"AWS Config Delivery Channel ARN for region " + this.region);
channelSsmWriter.getNode().addDependency(deliveryChannel);
// Automatically start the Config Recorder for SOC2 and other compliance frameworks
// This ensures compliance recording begins immediately upon deployment
AwsCustomResource starterResource = startConfigRecorder(recorder, recorderName);
return new ConfigInfrastructure(recorder, starterResource);
}
/**
* Automatically start the Config Recorder using AWS SDK custom resource.
* This ensures compliance recording begins immediately upon deployment.
*
*
Why auto-start is required:
*
*
AWS Config Recorder is created in a STOPPED state by default (AWS safeguard)
*
SOC2, HIPAA, PCI-DSS, and GDPR require continuous compliance monitoring
*
Manual start would create compliance gap between deployment and activation
*
*
*
Implementation:
* Uses AWS SDK custom resource to call StartConfigurationRecorder API.
* This is idempotent - if already started, the call succeeds with no changes.
*
* @param recorder The CfnConfigurationRecorder to start
* @param recorderName The name of the recorder (e.g., "cloudforge-config-recorder")
* @return The AwsCustomResource that starts the recorder (for Config Rule dependencies)
*/
private AwsCustomResource startConfigRecorder(CfnConfigurationRecorder recorder, String recorderName) {
LOG.info("Auto-starting Config Recorder for compliance frameworks");
LOG.info(" Recorder: " + recorderName);
LOG.info(" Reason: SOC2/HIPAA/PCI-DSS/GDPR require continuous compliance monitoring");
// Validate region is available
if (region == null || region.isEmpty() || region.contains("$")) {
LOG.warning("Region not available - cannot auto-start Config Recorder");
LOG.warning(" Manual start required: aws configservice start-configuration-recorder --configuration-recorder-name " + recorderName);
return null;
}
// Create AWS SDK call to start the recorder
AwsSdkCall startRecorderCall = AwsSdkCall.builder()
.service("ConfigService")
.action("startConfigurationRecorder")
.parameters(Map.of(
"ConfigurationRecorderName", recorderName
))
.physicalResourceId(PhysicalResourceId.of("config-recorder-starter-" + recorderName))
.region(region)
.build();
// Create AWS SDK call to verify the recorder is running
// This ensures Config Rules are not created until recorder is operational
AwsSdkCall verifyRecorderCall = AwsSdkCall.builder()
.service("ConfigService")
.action("describeConfigurationRecorderStatus")
.parameters(Map.of(
"ConfigurationRecorderNames", List.of(recorderName)
))
.physicalResourceId(PhysicalResourceId.of("config-recorder-verifier-" + recorderName))
.region(region)
.outputPaths(List.of("ConfigurationRecordersStatus.0.recording")) // Extract recording status
.build();
// Create custom resource that starts the recorder on create and update
AwsCustomResource startRecorderResource = AwsCustomResource.Builder.create(this, "StartConfigRecorder")
.onCreate(startRecorderCall)
.onUpdate(startRecorderCall) // Idempotent - safe to call on update
.policy(AwsCustomResourcePolicy.fromSdkCalls(
software.amazon.awscdk.customresources.SdkCallsPolicyOptions.builder()
.resources(List.of("*")) // Config Service requires wildcard for start operation
.build()
))
.build();
// Create a second custom resource that WAITS for the recorder to be operational
// This verifier depends on the starter and MUST complete before Config Rules are created
AwsCustomResource verifyRecorderResource = AwsCustomResource.Builder.create(this, "VerifyConfigRecorderStarted")
.onCreate(verifyRecorderCall)
.onUpdate(verifyRecorderCall)
.policy(AwsCustomResourcePolicy.fromSdkCalls(
software.amazon.awscdk.customresources.SdkCallsPolicyOptions.builder()
.resources(List.of("*"))
.build()
))
.build();
// Chain: Recorder → Starter → Verifier → Config Rules
verifyRecorderResource.getNode().addDependency(startRecorderResource);
// Ensure recorder is created before we try to start it
startRecorderResource.getNode().addDependency(recorder);
LOG.info("Config Recorder auto-start configured successfully");
LOG.info(" Recorder will start automatically during deployment");
LOG.info(" Verifier will confirm recorder is operational before Config Rules are created");
LOG.info(" Compliance recording will begin immediately");
// Return the VERIFIER resource (not the starter) for Config Rule dependencies
// Config Rules must wait for the verifier to confirm the recorder is operational
return verifyRecorderResource;
}
/**
* Creates Config rules for encryption compliance.
* All rules explicitly depend on the Configuration Recorder being started.
*
* @param recorder The Configuration Recorder that rules depend on
* @param starterResource The Custom Resource that starts the recorder
*/
private void createEncryptionConfigRules(CfnConfigurationRecorder recorder, AwsCustomResource starterResource) {
CfnConfigRule ebsRule = CfnConfigRule.Builder.create(this, "EbsEncryptionRule")
.source(CfnConfigRule.SourceProperty.builder()
.owner("AWS")
.sourceIdentifier(ManagedRuleIdentifiers.EC2_EBS_ENCRYPTION_BY_DEFAULT)
.build())
.build();
addConfigRuleDependencies(ebsRule, recorder, starterResource);
CfnConfigRule s3EncryptionRule = CfnConfigRule.Builder.create(this, "S3BucketEncryptionRule")
.source(CfnConfigRule.SourceProperty.builder()
.owner("AWS")
.sourceIdentifier(ManagedRuleIdentifiers.S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED)
.build())
.build();
addConfigRuleDependencies(s3EncryptionRule, recorder, starterResource);
}
/**
* Creates Config rules for S3 security compliance.
* All rules explicitly depend on the Configuration Recorder being started.
*
* Optional scoping: If scopeConfigRulesToDeployment is enabled, rules only monitor
* S3 buckets tagged with the deployment ID, not all buckets in the account.
*
* Optional remediation: If enableS3VersioningRemediation is enabled, automatically
* enables versioning on non-compliant buckets.
*
* @param recorder The Configuration Recorder that rules depend on
* @param starterResource The Custom Resource that starts the recorder
*/
private void createS3ConfigRules(CfnConfigurationRecorder recorder, AwsCustomResource starterResource) {
CfnConfigRule publicAccessRule = CfnConfigRule.Builder.create(this, "S3PublicAccessBlockRule")
.source(CfnConfigRule.SourceProperty.builder()
.owner("AWS")
.sourceIdentifier(ManagedRuleIdentifiers.S3_BUCKET_PUBLIC_READ_PROHIBITED)
.build())
.build();
addConfigRuleDependencies(publicAccessRule, recorder, starterResource);
// Build S3 versioning rule with optional scope configuration
CfnConfigRule.Builder versioningRuleBuilder = CfnConfigRule.Builder.create(this, "S3VersioningRule")
.source(CfnConfigRule.SourceProperty.builder()
.owner("AWS")
.sourceIdentifier(ManagedRuleIdentifiers.S3_BUCKET_VERSIONING_ENABLED)
.build());
// Add scope to only monitor buckets created by this stack if configured
if (Boolean.TRUE.equals(scopeConfigRulesToDeployment) && stackName != null) {
versioningRuleBuilder.scope(CfnConfigRule.ScopeProperty.builder()
.complianceResourceTypes(List.of("AWS::S3::Bucket"))
.tagKey("aws:cloudformation:stack-name")
.tagValue(stackName)
.build());
LOG.info("S3 versioning rule scoped to stack: " + stackName);
} else {
LOG.info("S3 versioning rule monitoring all account buckets");
}
CfnConfigRule versioningRule = versioningRuleBuilder.build();
addConfigRuleDependencies(versioningRule, recorder, starterResource);
// Add automatic remediation if enabled (PRODUCTION only by default)
boolean shouldEnableS3VersioningRemediation = Boolean.TRUE.equals(enableS3VersioningRemediation)
|| (enableS3VersioningRemediation == null && ctx.security == SecurityProfile.PRODUCTION);
if (shouldEnableS3VersioningRemediation) {
createS3VersioningRemediation(versioningRule);
}
}
/**
* Creates Config rules for IAM security compliance.
* All rules explicitly depend on the Configuration Recorder being started.
*
* Includes automatic remediation for password policy based on enabled compliance frameworks.
*
* @param recorder The Configuration Recorder that rules depend on
* @param starterResource The Custom Resource that starts the recorder
*/
private void createIAMConfigRules(CfnConfigurationRecorder recorder, AwsCustomResource starterResource) {
// Get password policy parameters based on enabled compliance frameworks
Map passwordPolicyParams = getPasswordPolicyParameters();
CfnConfigRule passwordPolicyRule = CfnConfigRule.Builder.create(this, "IAMPasswordPolicyRule")
.source(CfnConfigRule.SourceProperty.builder()
.owner("AWS")
.sourceIdentifier(ManagedRuleIdentifiers.IAM_PASSWORD_POLICY)
.build())
.inputParameters(passwordPolicyParams)
.build();
addConfigRuleDependencies(passwordPolicyRule, recorder, starterResource);
// Create automatic remediation for password policy
createPasswordPolicyRemediation(passwordPolicyRule);
CfnConfigRule rootAccessKeyRule = CfnConfigRule.Builder.create(this, "IAMRootAccessKeyRule")
.source(CfnConfigRule.SourceProperty.builder()
.owner("AWS")
.sourceIdentifier(ManagedRuleIdentifiers.IAM_ROOT_ACCESS_KEY_CHECK)
.build())
.build();
addConfigRuleDependencies(rootAccessKeyRule, recorder, starterResource);
}
/**
* Get password policy parameters based on enabled compliance frameworks.
*
* Applies the strictest requirements from all enabled frameworks:
* - HIPAA: 14 chars, all complexity, 90-day rotation, 24 password reuse
* - PCI-DSS: 8 chars, complexity required, 90-day rotation
* - SOC2: 12 chars, complexity recommended
*
* @return Map of password policy parameters for AWS Config rule
*/
private Map getPasswordPolicyParameters() {
List frameworks = determineFrameworks();
// Normalize framework names
List normalizedFrameworks = frameworks.stream()
.map(f -> f.trim().toUpperCase().replace("-", "").replace("_", ""))
.collect(java.util.stream.Collectors.toList());
boolean hipaaEnabled = normalizedFrameworks.contains("HIPAA");
boolean pciDssEnabled = normalizedFrameworks.contains("PCIDSS");
boolean soc2Enabled = normalizedFrameworks.contains("SOC2");
// Determine strictest requirements
int minLength;
int maxPasswordAge;
int passwordReusePrevention;
String frameworkName;
if (hipaaEnabled) {
minLength = 14;
maxPasswordAge = 90;
passwordReusePrevention = 24;
frameworkName = "HIPAA";
} else if (soc2Enabled) {
minLength = 12;
maxPasswordAge = 90;
passwordReusePrevention = 12;
frameworkName = "SOC2";
} else if (pciDssEnabled) {
minLength = 8;
maxPasswordAge = 90;
passwordReusePrevention = 4;
frameworkName = "PCI-DSS";
} else {
// Default based on security profile
minLength = security == SecurityProfile.PRODUCTION ? 14 : 12;
maxPasswordAge = 90;
passwordReusePrevention = 12;
frameworkName = "Default (" + security + ")";
}
LOG.info("IAM password policy requirements (" + frameworkName + "):");
LOG.info(" Minimum length: " + minLength + " characters");
LOG.info(" Max password age: " + maxPasswordAge + " days");
LOG.info(" Password reuse prevention: " + passwordReusePrevention + " passwords");
LOG.info(" Complexity: Uppercase, lowercase, numbers, symbols required");
// Return parameters as JSON string (required by AWS Config)
Map params = new java.util.HashMap<>();
params.put("MinimumPasswordLength", minLength);
params.put("RequireUppercaseCharacters", true);
params.put("RequireLowercaseCharacters", true);
params.put("RequireNumbers", true);
params.put("RequireSymbols", true);
params.put("MaxPasswordAge", maxPasswordAge);
params.put("PasswordReusePrevention", passwordReusePrevention);
return params;
}
/**
* Create automatic remediation for IAM password policy using AWS SSM Automation.
*
* Uses the official AWS-managed SSM document: AWSConfigRemediation-SetIAMPasswordPolicy
* This automatically fixes non-compliant password policies based on the Config rule parameters.
*
* @param passwordPolicyRule The Config rule to attach remediation to
*/
private void createPasswordPolicyRemediation(CfnConfigRule passwordPolicyRule) {
// Create IAM role for SSM Automation
Role ssmAutomationRole = Role.Builder.create(this, "PasswordPolicyRemediationRole")
.assumedBy(new ServicePrincipal("ssm.amazonaws.com"))
.managedPolicies(List.of(
ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore")
))
.inlinePolicies(Map.of(
"IAMPasswordPolicyPermissions",
software.amazon.awscdk.services.iam.PolicyDocument.Builder.create()
.statements(List.of(
PolicyStatement.Builder.create()
.effect(Effect.ALLOW)
.actions(List.of(
"iam:UpdateAccountPasswordPolicy",
"iam:GetAccountPasswordPolicy"
))
.resources(List.of("*"))
.build()
))
.build()
))
.build();
// Get password policy parameters
Map policyParams = getPasswordPolicyParameters();
// Create remediation configuration
// Note: Using addPropertyOverride to work around AWS CDK bug #8996 where
// staticValue generates lowercase keys instead of StaticValue (uppercase)
CfnRemediationConfiguration remediation = CfnRemediationConfiguration.Builder.create(
this, "PasswordPolicyRemediation")
.configRuleName(passwordPolicyRule.getRef())
.targetType("SSM_DOCUMENT")
.targetId("AWSConfigRemediation-SetIAMPasswordPolicy")
.targetVersion("1")
.automatic(true) // Enable automatic remediation
.maximumAutomaticAttempts(5)
.retryAttemptSeconds(60)
.build();
// Manually override Parameters with correct CloudFormation format
// CloudFormation expects StaticValue (uppercase) as an object with a Values array property
remediation.addPropertyOverride("Parameters", Map.of(
"AutomationAssumeRole", Map.of("StaticValue", Map.of("Values", List.of(ssmAutomationRole.getRoleArn()))),
"MinimumPasswordLength", Map.of("StaticValue", Map.of("Values", List.of(String.valueOf(policyParams.get("MinimumPasswordLength"))))),
"RequireUppercaseCharacters", Map.of("StaticValue", Map.of("Values", List.of("true"))),
"RequireLowercaseCharacters", Map.of("StaticValue", Map.of("Values", List.of("true"))),
"RequireNumbers", Map.of("StaticValue", Map.of("Values", List.of("true"))),
"RequireSymbols", Map.of("StaticValue", Map.of("Values", List.of("true"))),
"MaxPasswordAge", Map.of("StaticValue", Map.of("Values", List.of(String.valueOf(policyParams.get("MaxPasswordAge"))))),
"PasswordReusePrevention", Map.of("StaticValue", Map.of("Values", List.of(String.valueOf(policyParams.get("PasswordReusePrevention"))))),
"AllowUsersToChangePassword", Map.of("StaticValue", Map.of("Values", List.of("true")))
));
LOG.info("IAM password policy automatic remediation enabled");
LOG.info(" SSM Document: AWSConfigRemediation-SetIAMPasswordPolicy");
LOG.info(" Mode: Automatic (fixes non-compliant policies immediately)");
LOG.info(" Max attempts: 5, Retry interval: 60 seconds");
}
/**
* Creates automatic remediation for S3 bucket versioning compliance.
* Uses the official AWS-managed SSM document: AWS-ConfigureS3BucketVersioning
* This automatically enables versioning on non-compliant S3 buckets.
*
* NOTE: Enabling versioning has storage cost implications. Once enabled, versioning
* cannot be fully disabled (only suspended). Users should understand these implications
* before enabling automatic remediation.
*
* @param versioningRule The Config rule to attach remediation to
*/
private void createS3VersioningRemediation(CfnConfigRule versioningRule) {
// Create IAM role for SSM Automation
Role ssmAutomationRole = Role.Builder.create(this, "S3VersioningRemediationRole")
.assumedBy(new ServicePrincipal("ssm.amazonaws.com"))
.managedPolicies(List.of(
ManagedPolicy.fromAwsManagedPolicyName("AmazonSSMManagedInstanceCore")
))
.inlinePolicies(Map.of(
"S3VersioningPermissions",
software.amazon.awscdk.services.iam.PolicyDocument.Builder.create()
.statements(List.of(
PolicyStatement.Builder.create()
.effect(Effect.ALLOW)
.actions(List.of(
"s3:PutBucketVersioning",
"s3:GetBucketVersioning"
))
.resources(List.of("*"))
.build()
))
.build()
))
.build();
// Create remediation configuration
// Note: Using addPropertyOverride to work around AWS CDK bug #8996
CfnRemediationConfiguration remediation = CfnRemediationConfiguration.Builder.create(
this, "S3VersioningRemediation")
.configRuleName(versioningRule.getRef())
.targetType("SSM_DOCUMENT")
.targetId("AWS-ConfigureS3BucketVersioning")
.targetVersion("1")
.automatic(true) // Enable automatic remediation
.maximumAutomaticAttempts(5)
.retryAttemptSeconds(60)
.build();
// Manually override Parameters with correct CloudFormation format
remediation.addPropertyOverride("Parameters", Map.of(
"AutomationAssumeRole", Map.of("StaticValue", Map.of("Values", List.of(ssmAutomationRole.getRoleArn()))),
"BucketName", Map.of("ResourceValue", Map.of("Value", "RESOURCE_ID")),
"VersioningState", Map.of("StaticValue", Map.of("Values", List.of("Enabled")))
));
LOG.info("S3 bucket versioning automatic remediation enabled");
LOG.info(" SSM Document: AWS-ConfigureS3BucketVersioning");
LOG.info(" Mode: Automatic (enables versioning on non-compliant buckets)");
LOG.info(" WARNING: This has cost implications - versioned objects consume additional storage");
LOG.info(" Max attempts: 5, Retry interval: 60 seconds");
}
/**
* Creates auto-remediation configuration for CloudTrail bucket access errors.
*
*
This remediation automatically fixes CloudTrail S3 bucket policy access issues
* that prevent CloudTrail from writing logs. Common issues include:
*
*
Missing or incorrect bucket policy for CloudTrail service
*
Insufficient ACL permissions on the bucket
*
Bucket policy that denies CloudTrail access
*
*
*
The remediation uses the AWS-managed SSM document
* AWSConfigRemediation-EnableCloudTrailLogFileValidation to automatically
* fix bucket access policies when AWS Config detects non-compliance.
*
*
How It Works
*
*
AWS Config detects CloudTrail is not enabled or cannot access its bucket
*
Config triggers this automated remediation
*
SSM Automation updates the S3 bucket policy with correct CloudTrail permissions
*
CloudTrail resumes logging to the bucket
*
*
*
Required Permissions (Least Privilege)
*
The SSM automation role has scoped permissions following AWS best practices:
*
*
s3:GetBucketPolicy - Scoped to CloudForge CloudTrail buckets (arn:aws:s3:::cloudforge-cloudtrail-*)
*
s3:PutBucketPolicy - Scoped to CloudForge CloudTrail buckets (arn:aws:s3:::cloudforge-cloudtrail-*)
*
s3:GetBucketAcl - Scoped to CloudForge CloudTrail buckets (arn:aws:s3:::cloudforge-cloudtrail-*)
*
cloudtrail:GetTrail - Scoped to CloudForge trails (arn:aws:cloudtrail:*:*:trail/cloudforge-cloudtrail-*)
*
cloudtrail:DescribeTrails - Scoped to CloudForge trails (arn:aws:cloudtrail:*:*:trail/cloudforge-cloudtrail-*)
*
*
NOTE: No wildcard (*) permissions are used. All permissions are scoped to CloudForge-managed resources.
*
* @param cloudTrailRule The AWS Config rule for CloudTrail enabled check
* @throws IllegalStateException if CloudTrail or S3 bucket is not configured
*/
private void addCloudTrailBucketAccessRemediation(CfnConfigRule cloudTrailRule) {
LOG.info("Setting up CloudTrail bucket access auto-remediation");
// Null guard: Verify CloudTrail and S3 bucket are configured before creating remediation
if (this.trail == null) {
String errorMsg = "Cannot configure CloudTrail bucket access remediation: CloudTrail is not configured. " +
"Ensure CloudTrail is enabled in the security profile configuration.";
LOG.severe(errorMsg);
throw new IllegalStateException(errorMsg);
}
if (this.trailBucket == null) {
String errorMsg = "Cannot configure CloudTrail bucket access remediation: CloudTrail S3 bucket is not configured. " +
"Ensure CloudTrail bucket creation succeeded before enabling remediation.";
LOG.severe(errorMsg);
throw new IllegalStateException(errorMsg);
}
if (this.trailName == null || this.trailName.isEmpty()) {
String errorMsg = "Cannot configure CloudTrail bucket access remediation: CloudTrail name is not set. " +
"This is an internal error - CloudTrail should have been assigned a name during creation.";
LOG.severe(errorMsg);
throw new IllegalStateException(errorMsg);
}
LOG.info(" CloudTrail name: " + this.trailName);
LOG.info(" CloudTrail bucket: " + this.trailBucket.getBucketName());
LOG.info(" Remediation will fix bucket policy if CloudTrail cannot write logs");
// Create IAM role for SSM Automation with CloudTrail and S3 permissions
// IMPORTANT: Permissions are scoped to EXACT resources (no wildcards) following least privilege
// Use exact ARNs for the specific CloudTrail and bucket in this deployment
String exactTrailArn = this.trail.getTrailArn();
String exactBucketArn = this.trailBucket.getBucketArn();
Role ssmAutomationRole = Role.Builder.create(this, "CloudTrailBucketAccessRemediationRole")
.assumedBy(new ServicePrincipal("ssm.amazonaws.com"))
.description("Role for automated CloudTrail S3 bucket access remediation - scoped to exact resources")
.inlinePolicies(Map.of(
"CloudTrailBucketAccessPermissions",
software.amazon.awscdk.services.iam.PolicyDocument.Builder.create()
.statements(List.of(
PolicyStatement.Builder.create()
.sid("S3BucketPolicyManagement")
.effect(Effect.ALLOW)
.actions(List.of(
"s3:GetBucketPolicy",
"s3:PutBucketPolicy",
"s3:GetBucketAcl",
"s3:PutBucketAcl"
))
// Scoped to exact CloudTrail bucket ARN (no wildcards)
.resources(List.of(exactBucketArn))
.build(),
PolicyStatement.Builder.create()
.sid("CloudTrailReadAccess")
.effect(Effect.ALLOW)
.actions(List.of(
"cloudtrail:GetTrail",
"cloudtrail:DescribeTrails",
"cloudtrail:GetEventSelectors"
))
// Scoped to exact CloudTrail ARN (no wildcards)
.resources(List.of(exactTrailArn))
.build()
))
.build()
))
.build();
// Destroy remediation role with stack deletion
ssmAutomationRole.applyRemovalPolicy(RemovalPolicy.DESTROY);
// Create custom SSM Automation document for CloudTrail bucket policy fix
software.amazon.awscdk.services.ssm.CfnDocument cloudTrailFixDocument =
software.amazon.awscdk.services.ssm.CfnDocument.Builder.create(this, "CloudTrailBucketPolicyFixDocument")
.name(stackName + "-fix-cloudtrail-bucket-access")
.documentType("Automation")
.documentFormat("YAML")
.content(Map.of(
"schemaVersion", "0.3",
"description", "Fixes CloudTrail S3 bucket access policy to allow CloudTrail to write logs",
"assumeRole", "{{ AutomationAssumeRole }}",
"parameters", Map.of(
"AutomationAssumeRole", Map.of(
"type", "String",
"description", "IAM role ARN for automation execution"
),
"TrailName", Map.of(
"type", "String",
"description", "Name of the CloudTrail trail"
),
"BucketName", Map.of(
"type", "String",
"description", "Name of the S3 bucket for CloudTrail logs"
)
),
"mainSteps", List.of(
Map.of(
"name", "GetCloudTrailBucket",
"action", "aws:executeAwsApi",
"description", "Retrieve CloudTrail S3 bucket name",
"inputs", Map.of(
"Service", "cloudtrail",
"Api", "GetTrail",
"Name", "{{ TrailName }}"
),
"outputs", List.of(
Map.of(
"Name", "S3BucketName",
"Selector", "$.Trail.S3BucketName",
"Type", "String"
)
)
),
Map.of(
"name", "FixBucketPolicy",
"action", "aws:executeAwsApi",
"description", "Update S3 bucket policy to grant CloudTrail access",
"inputs", Map.of(
"Service", "s3",
"Api", "PutBucketPolicy",
"Bucket", "{{ BucketName }}",
"Policy", "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"AWSCloudTrailAclCheck\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"cloudtrail.amazonaws.com\"},\"Action\":\"s3:GetBucketAcl\",\"Resource\":\"arn:aws:s3:::{{ BucketName }}\"},{\"Sid\":\"AWSCloudTrailWrite\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"cloudtrail.amazonaws.com\"},\"Action\":\"s3:PutObject\",\"Resource\":\"arn:aws:s3:::{{ BucketName }}/AWSLogs/*\",\"Condition\":{\"StringEquals\":{\"s3:x-amz-acl\":\"bucket-owner-full-control\"}}}]}"
)
)
)
))
.build();
// Create remediation configuration using the custom document
CfnRemediationConfiguration remediation = CfnRemediationConfiguration.Builder.create(
this, "CloudTrailBucketAccessRemediation")
.configRuleName(cloudTrailRule.getRef())
.targetType("SSM_DOCUMENT")
.targetId(cloudTrailFixDocument.getRef())
.targetVersion("1")
.automatic(true) // Enable automatic remediation
.maximumAutomaticAttempts(3)
.retryAttemptSeconds(120)
.build();
// Configure remediation parameters
remediation.addPropertyOverride("Parameters", Map.of(
"AutomationAssumeRole", Map.of(
"StaticValue", Map.of("Values", List.of(ssmAutomationRole.getRoleArn()))
),
"TrailName", Map.of(
"StaticValue", Map.of("Values", List.of(this.trailName != null ? this.trailName : "cloudforge-cloudtrail-" + this.region))
),
"BucketName", Map.of(
"StaticValue", Map.of("Values", List.of(this.trailBucket != null ? this.trailBucket.getBucketName() : ""))
)
));
// Ensure dependencies
remediation.getNode().addDependency(cloudTrailRule);
remediation.getNode().addDependency(cloudTrailFixDocument);
LOG.info("CloudTrail bucket access automatic remediation configured");
LOG.info(" SSM Document: " + cloudTrailFixDocument.getRef());
LOG.info(" Mode: Automatic (fixes S3 bucket policy when CloudTrail cannot access bucket)");
LOG.info(" Max attempts: 3, Retry interval: 120 seconds");
LOG.info(" Permissions: S3 bucket policy updates, CloudTrail read access");
LOG.info(" This ensures CloudTrail can always write audit logs for compliance");
}
/**
* Creates automatic remediation for RDS deletion protection compliance.
* Enables deletion protection on non-compliant RDS instances.
*
*
Safety: This is a SAFE remediation - it only enables protection, never disables it.