Skip to content
This repository has been archived by the owner on May 13, 2021. It is now read-only.

Garrison Agent that provides AWS Lambda compliance checks

Notifications You must be signed in to change notification settings

forward3d/garrison-agent-aws-lambda

Repository files navigation

Garrison Agent - AWS Lambda

This is a part of the Garrison security project. This agent provides various AWS Lambda compliance checks.

Checks Provided

Function Name Description
check_dead_letter Alerts if a Lambda function has no dead letter config.
check_encryption_at_rest Alerts if a Lambda function is not using a customer master key (AWS KMS CMK) for encryption at rest.
check_runtime_deprecations Alerts if a Lambda function is using a deprecated runtime.

Installation & Example

Docker Hub - https://hub.docker.com/r/forward3d/garrison-agent-aws-lambda/

docker pull forward3d/garrison-agent-aws-lambda
docker run --rm -e "GARRISON_URL=https://garrison.internal.acme.com" forward3d/garrison-agent-aws-lambda check_runtime_deprecations

Agent Specific Configuration

These are additional specific configuration options for this agent. Global agent configurations still apply.

Environmental Variable Default Expects
GARRISON_AWS_REGIONS all [1] Comma Separated Strings eg. eu-west-1,us-west-2
  1. AWS Regions as returned by the AWS SDK at runtime for Lambda.

AWS Authentication

As this requires access to the AWS API you will need this IAM policy as a minimum for it to operate correctly.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
              "lambda:ListFunctions"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

We recommend using EC2/ECS Task roles so that you don't need to send credentials into the container, however if you can't use those or want to send in specific Access Keys and Secret keys, please see the AWS Documentation as to how you do that.

Cross-Account Authentication (STS AssumeRole)

If you run Garrison agents in one account, and want to reach into other AWS accounts you need to send in extra environmental variables to support that.

Environmental Variable Value
AWS_ACCOUNT_ID Not used as part of authentication, but to override the tag set on any alerts
AWS_ASSUME_ROLE_CREDENTIALS_ARN Arn of the role (in the other account) you wish to assume