Merge pull request #106 from cloudgraphdev/alpha

tyler-dunkel · web-flow · commit 5401496d1a70 · 2023-01-24T14:14:53.000-06:00
Beta release
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,12 @@
+# [0.84.0-alpha.1](https://github.com/cloudgraphdev/cloudgraph-provider-aws/compare/0.83.1...0.84.0-alpha.1) (2023-01-24)
+
+
+### Features
+
+* **CG-1311:** add AWS security hub ([067bf70](https://github.com/cloudgraphdev/cloudgraph-provider-aws/commit/067bf70678fd48b60f97feb6c2390e6ae31ea358))
+* **CG-1311:** update README ([b36b426](https://github.com/cloudgraphdev/cloudgraph-provider-aws/commit/b36b426f8c25a2ebc96934fd7236aec669080083))
+* **creds:** update credentials flow to support sso ([db29e83](https://github.com/cloudgraphdev/cloudgraph-provider-aws/commit/db29e8339cd8e6f481333cdeccf83ca4568439b1))
+
 ## [0.83.1](https://github.com/cloudgraphdev/cloudgraph-provider-aws/compare/0.83.0...0.83.1) (2022-11-28)
 
 
diff --git a/README.md b/README.md
@@ -4,7 +4,8 @@ Use the CloudGraph AWS Provider to scan and normalize cloud infrastructure using
 
 <!-- toc -->
 
-- [Docs](#install)
+- [CloudGraph AWS Provider](#cloudgraph-aws-provider)
+- [Docs](#docs)
 - [Install](#install)
 - [Authentication](#authentication)
 - [Multi Account](#multi-account)
@@ -154,6 +155,7 @@ CloudGraph AWS Provider will ask you what regions you would like to crawl and wi
 | s3                          | cloudfront, cloudtrail, ecsCluster, iamRole, kinesisFirehose, kms, lambda, managedAirflow, sns, sqs                                                                                                                                                                                                                                                                                |
 | secretsManager              | kms, lambda                                                                                                                                                                                                                                                                                                                                                                   |
 | securityGroup               | alb, asg, clientVpnEndpoint, codebuild, dmsReplicationInstance, ecsService, lambda, ec2, elasticSearchDomain, elb, rdsCluster, rdsDbInstance, eksCluster, elastiCacheCluster, managedAirflow, sageMakerNotebookInstance, networkInterface, vpcEndpoint                                                                                                                                     |
+| securityHub                 |                                                                                                                                                                                                                                                                                                                                                                               |
 | ses                         |                                                                                                                                                                                                                                                                                                                                                                               |
 | sns                         | kms, cloudtrail, cloudwatch, s3                                                                                                                                                                                                                                                                                                                                               |
 | sqs                         | elasticBeanstalkEnv, s3                                                                                                                                                                                                                                                                                                                                                       |
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@cloudgraph/cg-provider-aws",
-  "version": "0.83.1",
+  "version": "0.84.0-alpha.1",
   "description": "cloud-graph provider plugin for AWS used to fetch AWS cloud data.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -31,6 +31,8 @@
     "terraform:cleanup": "rimraf ./tests/terraform/{.terraform,.terraform.lock.hcl,tfplan} ./tests/terraform/*.{tfstate,tfplan,backup}"
   },
   "dependencies": {
+    "@aws-sdk/credential-providers": "^3.256.0",
+    "@aws-sdk/shared-ini-file-loader": "^3.254.0",
     "@cloudgraph/sdk": "^0.22.1",
     "@fast-csv/parse": "^4.3.6",
     "@graphql-tools/load-files": "^6.5.3",
diff --git a/src/enums/resources.ts b/src/enums/resources.ts
@@ -44,6 +44,7 @@ export default {
   dynamoDbTable: 'aws_dynamodb_table',
   kinesisStream: 'aws_kinesis_stream',
   securityGroup: 'aws_security_group',
+  securityHub: 'aws_security_hub',
   iamRolePolicy: 'aws_iam_role_policy',
   efsMountTarget: 'aws_efs_mount_target',
   route53ZRecord: 'aws_route53_record',
diff --git a/src/enums/schemasMap.ts b/src/enums/schemasMap.ts
@@ -78,6 +78,7 @@ export default {
   [services.nat]: 'awsNatGateway',
   [services.networkInterface]: 'awsNetworkInterface',
   [services.sg]: 'awsSecurityGroup',
+  [services.securityHub]: 'awsSecurityHub',
   [services.subnet]: 'awsSubnet',
   [services.vpc]: 'awsVpc',
   [services.vpcEndpoint]: 'awsVpcEndpoint',
diff --git a/src/enums/serviceAliases.ts b/src/enums/serviceAliases.ts
@@ -67,6 +67,7 @@ export default {
   [services.sageMakerProject]: 'sageMakerProjects',
   [services.secretsManager]: 'secretsManager',
   [services.sg]: 'securityGroups',
+  [services.securityHub]: 'securityHubs',
   [services.subnet]: 'subnets',
   [services.systemsManagerDocument]: 'systemsManagerDocuments',
   [services.systemsManagerInstance]: 'systemsManagerInstances',
diff --git a/src/enums/serviceMap.ts b/src/enums/serviceMap.ts
@@ -53,6 +53,7 @@ import Route53HostedZone from '../services/route53HostedZone'
 import Route53Record from '../services/route53Record'
 import RouteTable from '../services/routeTable'
 import SecretsManager from '../services/secretsManager'
+import SecurityHub from '../services/securityHub'
 import S3 from '../services/s3'
 import SES from '../services/ses'
 import SQS from '../services/sqs'
@@ -182,6 +183,7 @@ export default {
   [services.sageMakerProject]: SageMakerProject,
   [services.s3]: S3,
   [services.secretsManager]: SecretsManager,
+  [services.securityHub]: SecurityHub,
   [services.ses]: SES,
   [services.iamAccessAnalyzer]: IamAccessAnalyzer,
   [services.iamUser]: IamUser,
diff --git a/src/enums/services.ts b/src/enums/services.ts
@@ -84,6 +84,7 @@ export default {
   sageMakerProject: 'sageMakerProject',
   s3: 's3',
   secretsManager: 'secretsManager',
+  securityHub: 'securityHub',
   ses: 'ses',
   sg: 'sg',
   sns: 'sns',
diff --git a/src/properties/logger.ts b/src/properties/logger.ts
@@ -689,4 +689,10 @@ export default {
    * Vpc Peering Connections
    */
   fetchedVpcPeeringConnections: (num: number): string => `Found ${num} Vpc Peering Connections`,
+  /**
+   * Security Hub
+   */
+  securityHubNotFound: (region: string): string => `Security Hub not found/disabled for region: ${region}`,
+  fetchedSecurityHub: (region: string): string => `Security Hub found/enabled for region: ${region}`,
+  fetchingSecurityHub: 'Fetching Security Hub data for this AWS account via the AWS SDK...',
 }
diff --git a/src/services/account/schema.graphql b/src/services/account/schema.graphql
@@ -86,6 +86,7 @@ type awsAccount implements awsOptionalService @key(fields: "id") {
   sageMakerProjects: [awsSageMakerProject]
   secretsManager: [awsSecretsManager]
   securityGroups: [awsSecurityGroup]
+  securityHub: [awsSecurityHub]
   systemsManagerDocuments: [awsSystemsManagerDocument]
   systemsManagerInstances: [awsSystemsManagerInstance]
   ses: [awsSes]
diff --git a/src/services/index.ts b/src/services/index.ts
@@ -7,6 +7,8 @@ import CloudGraph, {
 import { loadFilesSync } from '@graphql-tools/load-files'
 import { mergeTypeDefs } from '@graphql-tools/merge'
 import AWS, { Config } from 'aws-sdk'
+import { loadSharedConfigFiles } from '@aws-sdk/shared-ini-file-loader'
+import { fromIni } from '@aws-sdk/credential-providers'
 import chalk from 'chalk'
 import { DocumentNode } from 'graphql'
 import STS from 'aws-sdk/clients/sts'
@@ -78,7 +80,7 @@ export default class Provider extends CloudGraph.Client {
     const result: { [key: string]: any } = { ...providerSettings }
     let profiles
     try {
-      profiles = this.getProfilesFromSharedConfig()
+      profiles = await this.getProfilesFromSharedConfig()
     } catch (error: any) {
       this.logger.warn('No AWS profiles found')
     }
@@ -304,19 +306,21 @@ export default class Provider extends CloudGraph.Client {
       switch (true) {
         case role && role !== '': {
           let sts = new AWS.STS()
-          await new Promise<void>(resolve => {
+          await new Promise<void>(async resolve => {
             if (profile && profile !== 'default') {
-              const creds = this.getSharedIniFileCredentials(profile)
+              let creds: AWS.Credentials
+              const credsFunction = fromIni({
+                profile
+              })
               if (creds) {
-                sts = new AWS.STS({ credentials: creds })
+                sts = new AWS.STS({ credentials: await credsFunction() })
               }
             }
             const options = {
               RoleSessionName: 'CloudGraph',
               RoleArn: role,
               ...(externalId && { ExternalId: externalId }),
             }
-
             sts.assumeRole(options, (err, data) => {
               if (err) {
                 this.logger.error(
@@ -478,18 +482,22 @@ export default class Provider extends CloudGraph.Client {
     return credentials
   }
 
-  private getProfilesFromSharedConfig(): string[] {
-    let profiles
+  private async getProfilesFromSharedConfig(): Promise<string[]> {
+    let profiles = []
     try {
-      profiles = Object.keys(
-        AWS['util'].getProfilesFromSharedConfig(AWS['util'].iniLoader)
-      )
+      const filesObject = await loadSharedConfigFiles()
+      const files = Object.keys(filesObject)
+      for (const file of files) {
+        const fileProfiles = Object.keys(filesObject[file])
+        if (fileProfiles && fileProfiles.length > 0) {
+          profiles.push(...fileProfiles)
+        }
+      }
     } catch (error: any) {
       this.logger.warn('Unable to read AWS shared credential file')
       this.logger.debug(error)
     }
-
-    return profiles || []
+    return profiles
   }
 
   private mergeRawData(
@@ -689,7 +697,7 @@ export default class Provider extends CloudGraph.Client {
         const { profile, roleArn: role } = account
         // verify that profile exists in the shared credential file
         if (profile) {
-          const profiles = this.getProfilesFromSharedConfig()
+          const profiles = await this.getProfilesFromSharedConfig()
           if (!profiles.includes(profile)) {
             this.logger.warn(
               `Profile: ${profile} not found in shared credentials file. Skipping...`
diff --git a/src/services/securityHub/data.ts b/src/services/securityHub/data.ts
@@ -0,0 +1,70 @@
+import CloudGraph from '@cloudgraph/sdk'
+import SecurityHub, { DescribeHubResponse } from 'aws-sdk/clients/securityhub'
+import { AWSError } from 'aws-sdk/lib/error'
+import groupBy from 'lodash/groupBy'
+import isEmpty from 'lodash/isEmpty'
+import { Config } from 'aws-sdk/lib/config'
+import { initTestEndpoint } from '../../utils'
+import AwsErrorLog from '../../utils/errorLog'
+import awsLoggerText from '../../properties/logger'
+
+const { logger } = CloudGraph
+const lt = { ...awsLoggerText }
+const serviceName = 'SecurityHub'
+const errorLog = new AwsErrorLog(serviceName)
+const endpoint = initTestEndpoint(serviceName)
+
+export interface RawAwsSecurityHub {
+  HubArn: string;
+  SubscribedAt: string;
+  AutoEnableControls?: boolean;
+  region: string;
+}
+
+export default async ({
+  regions,
+  config,
+}: {
+  regions: string
+  config: Config
+}): Promise<{ [property: string]: RawAwsSecurityHub[] }> =>
+  new Promise(async resolve => {
+    const hubData: RawAwsSecurityHub[] = []
+
+    const regionPromises = regions.split(',').map(region => {
+      const securityHub = new SecurityHub({ ...config, region, endpoint })
+      return new Promise<void>(resolveRegion =>
+        securityHub.describeHub(
+          {},
+          (err: AWSError, data: DescribeHubResponse) => {
+            if (err) {
+              errorLog.generateAwsErrorLog({
+                functionName: 'securityHub:describeHub',
+                err,
+              })
+            }
+
+            if (isEmpty(data) || !data) {
+              logger.debug(lt.securityHubNotFound(region))
+              return resolveRegion()
+            }
+
+            logger.debug(lt.fetchedSecurityHub(region))
+            hubData.push({
+              HubArn: data.HubArn,
+              SubscribedAt: data.SubscribedAt,
+              AutoEnableControls: data.AutoEnableControls,
+              region,
+            })
+            resolveRegion()
+          }
+        )
+      )
+    })
+
+    logger.debug(lt.fetchingSecurityHub)
+    await Promise.all(regionPromises)
+    errorLog.reset()
+
+    resolve(groupBy(hubData, 'region'))
+  })
diff --git a/src/services/securityHub/format.ts b/src/services/securityHub/format.ts
@@ -0,0 +1,34 @@
+import { RawAwsSecurityHub } from './data'
+import {
+  AwsSecurityHub
+} from '../../types/generated'
+
+
+/**
+ * Security Hub
+ */
+
+export default ({
+  service,
+  account,
+  region,
+}: {
+  service: RawAwsSecurityHub
+  account: string
+  region: string
+}): AwsSecurityHub => {
+  const {
+    HubArn: arn,
+    SubscribedAt: subscribedAt,
+    AutoEnableControls: autoEnableControls,
+  } = service
+
+  return {
+    id: arn,
+    accountId: account,
+    arn,
+    region,
+    subscribedAt,
+    autoEnableControls,
+  }
+}
diff --git a/src/services/securityHub/index.ts b/src/services/securityHub/index.ts
@@ -0,0 +1,13 @@
+import { Service } from '@cloudgraph/sdk'
+import BaseService from '../base'
+import format from './format'
+import getData from './data'
+import mutation from './mutation'
+
+export default class SecurityHub extends BaseService implements Service {
+  format = format.bind(this)
+
+  getData = getData.bind(this)
+
+  mutation = mutation
+}
diff --git a/src/services/securityHub/mutation.ts b/src/services/securityHub/mutation.ts
@@ -0,0 +1,5 @@
+export default `mutation($input: [AddawsSecurityHubInput!]!) {
+  addawsSecurityHub(input: $input, upsert: true) {
+    numUids
+  }
+}`
diff --git a/src/services/securityHub/schema.graphql b/src/services/securityHub/schema.graphql
@@ -0,0 +1,4 @@
+type awsSecurityHub implements awsBaseService @key(fields: "arn") {
+  subscribedAt: String @search(by: [hash, regexp])
+  autoEnableControls: Boolean @search 
+}
diff --git a/src/types/generated.ts b/src/types/generated.ts
@@ -220,6 +220,7 @@ export type AwsAccount = AwsOptionalService & {
   sageMakerProjects?: Maybe<Array<Maybe<AwsSageMakerProject>>>;
   secretsManager?: Maybe<Array<Maybe<AwsSecretsManager>>>;
   securityGroups?: Maybe<Array<Maybe<AwsSecurityGroup>>>;
+  securityHub?: Maybe<Array<Maybe<AwsSecurityHub>>>;
   ses?: Maybe<Array<Maybe<AwsSes>>>;
   sns?: Maybe<Array<Maybe<AwsSns>>>;
   sqs?: Maybe<Array<Maybe<AwsSqs>>>;
@@ -4062,6 +4063,11 @@ export type AwsSecurityGroup = AwsBaseService & {
   vpcId?: Maybe<Scalars['String']>;
 };
 
+export type AwsSecurityHub = AwsBaseService & {
+  autoEnableControls?: Maybe<Scalars['Boolean']>;
+  subscribedAt?: Maybe<Scalars['String']>;
+};
+
 export type AwsServiceBillingInfo = {
   cost?: Maybe<Scalars['Float']>;
   currency?: Maybe<Scalars['String']>;
diff --git a/yarn.lock b/yarn.lock
