Feature/dns take over

deployment/build_packages.sh

@@ -23,7 +23,7 @@ SCRIPT_PATH="$( cd "$(dirname "$0")" ; pwd -P )"
 PACKAGES_DIR="${SCRIPT_PATH}/packages/"
 LIBRARY="${SCRIPT_PATH}/../hammer/library"
 
-LAMBDAS="ami-info logs-forwarder ddb-tables-backup sg-issues-identification s3-acl-issues-identification s3-policy-issues-identification iam-keyrotation-issues-identification iam-user-inactive-keys-identification cloudtrails-issues-identification ebs-unencrypted-volume-identification ebs-public-snapshots-identification rds-public-snapshots-identification"
+LAMBDAS="ami-info logs-forwarder ddb-tables-backup sg-issues-identification s3-acl-issues-identification s3-policy-issues-identification iam-keyrotation-issues-identification iam-user-inactive-keys-identification cloudtrails-issues-identification ebs-unencrypted-volume-identification ebs-public-snapshots-identification rds-public-snapshots-identification dns-takeover-identification"
 
 pushd "${SCRIPT_PATH}" > /dev/null
 pushd ../hammer/identification/lambdas > /dev/null

deployment/cf-templates/ddb.json

@@ -329,6 +329,38 @@
                 },
                 "TableName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" }, "rds-public-snapshots" ] ]}
             }
+        },
+        "DynamoDBDNSTakeoverDetails": {
+            "Type": "AWS::DynamoDB::Table",
+            "DeletionPolicy": "Retain",
+            "DependsOn": ["DynamoDBCredentials"],
+            "Properties": {
+                "AttributeDefinitions": [
+                    {
+                        "AttributeName": "account_id",
+                        "AttributeType": "S"
+                    },
+                    {
+                        "AttributeName": "issue_id",
+                        "AttributeType": "S"
+                    }
+                ],
+                "KeySchema": [
+                    {
+                        "AttributeName": "account_id",
+                        "KeyType": "HASH"
+                    },
+                    {
+                        "AttributeName": "issue_id",
+                        "KeyType": "RANGE"
+                    }
+                ],
+                "ProvisionedThroughput": {
+                    "ReadCapacityUnits": "10",
+                    "WriteCapacityUnits": "2"
+                },
+                "TableName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" }, "dns-takeover" ] ]}
+            }
         }
     }
 }

deployment/cf-templates/identification.json

@@ -164,6 +164,10 @@
         "SourceIdentificationRDSSnapshots": {
             "Type": "String",
             "Default": "rds-public-snapshots-identification.zip"
+        },
+        "SourceIdentificationDNSTakeover": {
+            "Type": "String",
+            "Default": "dns-takeover-identification.zip"
         }
     },
     "Conditions": {
@@ -209,6 +213,9 @@
             "IdentificationMetricRDSSnapshotsError": {
                 "value": "RDSSnapshotsError"
             },
+            "IdentificationMetricDNSTakeoverError": {
+                "value": "DNSTakeoverError"
+            },
             "SNSDisplayNameSecurityGroups": {
                 "value": "describe-security-groups-sns"
             },
@@ -263,6 +270,12 @@
             "SNSTopicNameRDSSnapshots": {
                 "value": "describe-rds-public-snapshots-lambda"
             },
+            "SNSDisplayNameDNSTakeover": {
+                "value": "describe-dns-takeover-sns"
+            },
+            "SNSTopicNameDNSTakeover": {
+                "value": "describe-dns-takeover-lambda"
+            },
             "LogsForwarderLambdaFunctionName": {
                 "value": "logs-forwarder"
             },
@@ -322,6 +335,12 @@
             },
             "IdentifyRDSSnapshotsLambdaFunctionName": {
                 "value": "describe-rds-public-snapshots"
+            },
+            "InitiateDNSTakeoverLambdaFunctionName": {
+                "value": "initiate-dns-takeover"
+            },
+            "IdentifyDNSTakeoverLambdaFunctionName": {
+                "value": "describe-dns-takeover"
             }
         }
     },
@@ -1463,6 +1482,107 @@
                 "LogGroupName" : { "Ref": "LogGroupLambdaEvaluateRDSSnapshots" }
             }
         },
+
+        "LambdaInitiateDNSTakeoverEvaluation": {
+            "Type": "AWS::Lambda::Function",
+            "DependsOn": ["SNSNotifyLambdaEvaluateDNSTakeover", "LogGroupLambdaInitiateDNSTakeoverEvaluation"],
+            "Properties": {
+                "Code": {
+                    "S3Bucket": { "Ref": "SourceS3Bucket" },
+                    "S3Key": { "Ref": "SourceIdentificationDNSTakeover" }
+                },
+                "Environment": {
+                    "Variables": {
+                        "SNS_DNS_TAKEOVER_ARN": { "Ref": "SNSNotifyLambdaEvaluateDNSTakeover" }
+                    }
+                },
+                "Description": "Lambda function for initiate to identify dns takeover issues.",
+                "FunctionName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" },
+                                                     { "Fn::FindInMap": ["NamingStandards", "InitiateDNSTakeoverLambdaFunctionName", "value"] } ]
+                                              ]},
+                "Handler": "initiate_to_desc_dns_takeover.lambda_handler",
+                "MemorySize": 128,
+                "Timeout": "300",
+                "Role": {"Fn::Join" : ["", [ "arn:aws:iam::",
+                                             { "Ref": "AWS::AccountId" },
+                                             ":role/",
+                                             { "Ref": "ResourcesPrefix" },
+                                             { "Ref": "IdentificationIAMRole" }
+                                           ] ]},
+                "Runtime": "python3.6"
+            }
+        },
+        "LogGroupLambdaInitiateDNSTakeoverEvaluation": {
+            "Type" : "AWS::Logs::LogGroup",
+            "Properties" : {
+                "LogGroupName": {"Fn::Join": ["", [ "/aws/lambda/",
+                                                    { "Ref": "ResourcesPrefix" },
+                                                    { "Fn::FindInMap": ["NamingStandards",
+                                                                        "InitiateDNSTakeoverLambdaFunctionName",
+                                                                        "value"]
+                                                    } ] ] },
+                "RetentionInDays": "7"
+            }
+        },
+        "SubscriptionFilterLambdaInitiateDNSTakeoverEvaluation": {
+            "Type" : "AWS::Logs::SubscriptionFilter",
+            "DependsOn": ["LambdaLogsForwarder",
+                          "PermissionToInvokeLambdaLogsForwarderCloudWatchLogs",
+                          "LogGroupLambdaInitiateDNSTakeoverEvaluation"],
+            "Properties" : {
+                "DestinationArn" : { "Fn::GetAtt" : [ "LambdaLogsForwarder", "Arn" ] },
+                "FilterPattern" : "[level != START && level != END && level != DEBUG, ...]",
+                "LogGroupName" : { "Ref": "LogGroupLambdaInitiateDNSTakeoverEvaluation" }
+            }
+        },
+
+        "LambdaEvaluateDNSTakeover": {
+            "Type": "AWS::Lambda::Function",
+            "DependsOn": ["LogGroupLambdaEvaluateDNSTakeover"],
+            "Properties": {
+                "Code": {
+                    "S3Bucket": { "Ref": "SourceS3Bucket" },
+                    "S3Key": { "Ref": "SourceIdentificationDNSTakeover" }
+                },
+                "Description": "Lambda function to describe dns takeover issues.",
+                "FunctionName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" },
+                                                     { "Fn::FindInMap": ["NamingStandards", "IdentifyDNSTakeoverLambdaFunctionName", "value"] } ]
+                                              ]},
+                "Handler": "describe_dns_takeover.lambda_handler",
+                "MemorySize": 128,
+                "Timeout": "300",
+                "Role": {"Fn::Join" : ["", [ "arn:aws:iam::",
+                                             { "Ref": "AWS::AccountId" },
+                                             ":role/",
+                                             { "Ref": "ResourcesPrefix" },
+                                             { "Ref": "IdentificationIAMRole" }
+                                           ] ]},
+                "Runtime": "python3.6"
+            }
+        },
+        "LogGroupLambdaEvaluateDNSTakeover": {
+            "Type" : "AWS::Logs::LogGroup",
+            "Properties" : {
+                "LogGroupName": {"Fn::Join": ["", [ "/aws/lambda/",
+                                                    { "Ref": "ResourcesPrefix" },
+                                                    { "Fn::FindInMap": ["NamingStandards",
+                                                                        "IdentifyDNSTakeoverLambdaFunctionName",
+                                                                        "value"]
+                                                    } ] ] },
+                "RetentionInDays": "7"
+            }
+        },
+        "SubscriptionFilterLambdaEvaluateDNSTakeover": {
+            "Type" : "AWS::Logs::SubscriptionFilter",
+            "DependsOn": ["LambdaLogsForwarder",
+                          "PermissionToInvokeLambdaLogsForwarderCloudWatchLogs",
+                          "LogGroupLambdaEvaluateDNSTakeover"],
+            "Properties" : {
+                "DestinationArn" : { "Fn::GetAtt" : [ "LambdaLogsForwarder", "Arn" ] },
+                "FilterPattern" : "[level != START && level != END && level != DEBUG, ...]",
+                "LogGroupName" : { "Ref": "LogGroupLambdaEvaluateDNSTakeover" }
+            }
+        },
 
         "EventBackupDDB": {
             "Type": "AWS::Events::Rule",
@@ -1592,6 +1712,23 @@
             }
         },
 
+        "EventInitiateEvaluationDNSTakeover": {
+            "Type": "AWS::Events::Rule",
+            "DependsOn": ["LambdaInitiateDNSTakeoverEvaluation"],
+            "Properties": {
+                "Description": "Hammer ScheduledRule to initiate DNS Takeover evaluations",
+                "Name": {"Fn::Join" : ["", [{ "Ref": "ResourcesPrefix" }, "InitiateEvaluationDNSTakeover"] ] },
+                "ScheduleExpression": {"Fn::Join": ["", [ "cron(", "35 ", { "Ref": "IdentificationCheckRateExpression" }, ")" ] ]},
+                "State": "ENABLED",
+                "Targets": [
+                  {
+                    "Arn": { "Fn::GetAtt": ["LambdaInitiateDNSTakeoverEvaluation", "Arn"] },
+                    "Id": "LambdaInitiateDNSTakeoverEvaluation"
+                  }
+                ]
+            }
+        },
+
         "PermissionToInvokeLambdaLogsForwarderCloudWatchLogs": {
             "Type": "AWS::Lambda::Permission",
             "DependsOn": ["LambdaLogsForwarder"],
@@ -1704,6 +1841,16 @@
                 "SourceArn": { "Fn::GetAtt": ["EventInitiateEvaluationRDSSnapshots", "Arn"] }
             }
         },
+        "PermissionToInvokeLambdaInitiateDNSTakeoverEvaluationCloudWatchEvents": {
+            "Type": "AWS::Lambda::Permission",
+            "DependsOn": ["LambdaInitiateDNSTakeoverEvaluation", "EventInitiateEvaluationDNSTakeover"],
+            "Properties": {
+                "FunctionName": { "Ref": "LambdaInitiateDNSTakeoverEvaluation" },
+                "Action": "lambda:InvokeFunction",
+                "Principal": "events.amazonaws.com",
+                "SourceArn": { "Fn::GetAtt": ["EventInitiateEvaluationDNSTakeover", "Arn"] }
+            }
+        },
 
         "SNSNotifyLambdaEvaluateSG": {
             "Type": "AWS::SNS::Topic",
@@ -1868,6 +2015,25 @@
             }
         },
 
+        "SNSNotifyLambdaEvaluateDNSTakeover": {
+            "Type": "AWS::SNS::Topic",
+            "DependsOn": "LambdaEvaluateDNSTakeover",
+            "Properties": {
+                "DisplayName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" },
+                                                    { "Fn::FindInMap": ["NamingStandards", "SNSDisplayNameDNSTakeover", "value"] } ]
+                                             ]},
+                "TopicName": {"Fn::Join" : ["", [ { "Ref": "ResourcesPrefix" },
+                                                  { "Fn::FindInMap": ["NamingStandards", "SNSTopicNameDNSTakeover", "value"] } ]
+                                           ]},
+                "Subscription": [{
+                    "Endpoint": {
+                        "Fn::GetAtt": ["LambdaEvaluateDNSTakeover", "Arn"]
+                    },
+                    "Protocol": "lambda"
+                }]
+            }
+        },
+
         "PermissionToInvokeLambdaEvaluateSgSNS": {
             "Type": "AWS::Lambda::Permission",
             "DependsOn": ["SNSNotifyLambdaEvaluateSG", "LambdaEvaluateSG"],
@@ -1959,6 +2125,17 @@
             }
         },
 
+        "PermissionToInvokeLambdaEvaluateDNSTakeoverSNS": {
+            "Type": "AWS::Lambda::Permission",
+            "DependsOn": ["SNSNotifyLambdaEvaluateDNSTakeover", "LambdaEvaluateDNSTakeover"],
+            "Properties": {
+                "Action": "lambda:InvokeFunction",
+                "Principal": "sns.amazonaws.com",
+                "SourceArn": { "Ref": "SNSNotifyLambdaEvaluateDNSTakeover" },
+                "FunctionName": { "Fn::GetAtt": ["LambdaEvaluateDNSTakeover", "Arn"] }
+            }
+        },
+
         "SNSIdentificationErrors": {
             "Type": "AWS::SNS::Topic",
             "Properties": {
@@ -2423,6 +2600,52 @@
                 "Threshold": 0,
                 "TreatMissingData": "notBreaching"
             }
+        },
+        "AlarmErrorsLambdaInitiateDNSTakeoverEvaluation": {
+            "Type": "AWS::CloudWatch::Alarm",
+            "DependsOn": ["SNSIdentificationErrors", "LambdaInitiateDNSTakeoverEvaluation"],
+            "Properties": {
+                "AlarmActions": [ { "Ref": "SNSIdentificationErrors" } ],
+                "OKActions": [ { "Ref": "SNSIdentificationErrors" } ],
+                "AlarmName": {"Fn::Join": ["/", [ { "Ref": "LambdaInitiateDNSTakeoverEvaluation" }, "LambdaError" ] ]},
+                "EvaluationPeriods": 1,
+                "Namespace": "AWS/Lambda",
+                "MetricName": "Errors",
+                "Dimensions": [
+                    {
+                        "Name": "FunctionName",
+                        "Value": { "Ref": "LambdaInitiateDNSTakeoverEvaluation" }
+                    }
+                ],
+                "Period": 3600,
+                "Statistic": "Maximum",
+                "ComparisonOperator" : "GreaterThanThreshold",
+                "Threshold": 0,
+                "TreatMissingData": "notBreaching"
+            }
+        },
+        "AlarmErrorsLambdaDNSTakeoverEvaluation": {
+            "Type": "AWS::CloudWatch::Alarm",
+            "DependsOn": ["SNSIdentificationErrors", "LambdaEvaluateDNSTakeover"],
+            "Properties": {
+                "AlarmActions": [ { "Ref": "SNSIdentificationErrors" } ],
+                "OKActions": [ { "Ref": "SNSIdentificationErrors" } ],
+                "AlarmName": {"Fn::Join": ["/", [ { "Ref": "LambdaEvaluateDNSTakeover" }, "LambdaError" ] ]},
+                "EvaluationPeriods": 1,
+                "Namespace": "AWS/Lambda",
+                "MetricName": "Errors",
+                "Dimensions": [
+                    {
+                        "Name": "FunctionName",
+                        "Value": { "Ref": "LambdaEvaluateDNSTakeover" }
+                    }
+                ],
+                "Period": 3600,
+                "Statistic": "Maximum",
+                "ComparisonOperator" : "GreaterThanThreshold",
+                "Threshold": 0,
+                "TreatMissingData": "notBreaching"
+            }
         }
     },
     "Outputs": {

deployment/configs/config.json

@@ -118,5 +118,17 @@
         "reporting": false,
         "remediation": false,
         "remediation_retention_period": 0
+    },
+    "dns_takeover": {
+        "enabled": true,
+        "ddb.table_name": "djif-hammer-dns-takeover",
+        "take_over_criteria_days": 30,
+        "reporting": true,
+        "remediation": false,
+        "remediation_retention_period": 21
+    },
+    "cnameRecordsets":{
+        "enabled": true,
+        "matching_record_sets": ["wsj.com", "marketwatch.com", "barrons.com"]
     }
 }

deployment/configs/whitelist.json

@@ -35,5 +35,8 @@
 	"rds_public_snapshot":{
 		"__comment__": "Detects public RDS snapshots (with 'all' in 'restore' attribute). Key - account id, values - snapshot ARNs.",
 		"123456789012": ["arn:aws:rds:eu-central-1:123456789012:snapshot:public", "arn:aws:rds:eu-west-1:123456789012:snapshot:rds:snapshot1"]
+	},
+	"dns_takeover":{
+
 	}
 }

deployment/terraform/modules/identification/identification.tf

@@ -11,7 +11,8 @@ resource "aws_cloudformation_stack" "identification" {
                   "aws_s3_bucket_object.iam-user-inactive-keys-identification",
                   "aws_s3_bucket_object.cloudtrails-issues-identification",
                   "aws_s3_bucket_object.ebs-unencrypted-volume-identification",
-                  "aws_s3_bucket_object.ebs-public-snapshots-identification"
+                  "aws_s3_bucket_object.ebs-public-snapshots-identification",
+                  "aws_s3_bucket_object.dns-takeover-identification"
                  ]
 
     tags = "${var.tags}"
@@ -34,6 +35,7 @@ resource "aws_cloudformation_stack" "identification" {
         SourceIdentificationEBSVolumes = "${aws_s3_bucket_object.ebs-unencrypted-volume-identification.id}"
         SourceIdentificationEBSSnapshots = "${aws_s3_bucket_object.ebs-public-snapshots-identification.id}"
         SourceIdentificationRDSSnapshots = "${aws_s3_bucket_object.rds-public-snapshots-identification.id}"
+        SourceIdentificationDNSTakeover = "${aws_s3_bucket_object.dns-takeover-identification.id}"
     }
 
     template_url = "https://${var.s3bucket}.s3.amazonaws.com/${aws_s3_bucket_object.identification-cfn.id}"

deployment/terraform/modules/identification/sources.tf

@@ -68,4 +68,10 @@ resource "aws_s3_bucket_object" "rds-public-snapshots-identification" {
     bucket = "${var.s3bucket}"
     key    = "lambda/${format("rds-public-snapshots-identification-%s.zip", "${md5(file("${path.module}/../../../packages/rds-public-snapshots-identification.zip"))}")}"
     source = "${path.module}/../../../packages/rds-public-snapshots-identification.zip"
+}
+
+resource "aws_s3_bucket_object" "dns-takeover-identification" {
+    bucket = "${var.s3bucket}"
+    key    = "lambda/${format("dns-takeover-identification-%s.zip", "${md5(file("${path.module}/../../../packages/dns-takeover-identification.zip"))}")}"
+    source = "${path.module}/../../../packages/dns-takeover-identification.zip"
 }