Detective Controls (AWS Config)

# Run this configuration in the designated central audit/security account.

# 1. The IAM Role the aggregator will assume to collect data.
resource "aws_iam_role" "config_aggregator_role" {
  name = "ConfigAggregatorRole"
  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Action = "sts:AssumeRole",
      Effect = "Allow",
      Principal = { Service = "config.amazonaws.com" }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "config_aggregator_policy" {
  role       = aws_iam_role.config_aggregator_role.name
  # This managed policy grants necessary read permissions across the organization.
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigMultiAccountSetupRole"
}

# 2. The Configuration Aggregator itself.
resource "aws_config_configuration_aggregator" "organization_aggregator" {
  name = "OrganizationAggregator"

  organization_aggregation_source {
    all_regions = true
    role_arn    = aws_iam_role.config_aggregator_role.arn
  }

  # Note: For this to work, the "ConfigAggregatorRole" must also be created
  # in every member account with a trust policy allowing this audit account to assume it.
  # This is typically automated with CloudFormation StackSets or Terraform providers.
}

import boto3
import json

config = boto3.client('config')

# This list should be managed centrally (e.g., in SSM Parameter Store)
APPROVED_AMI_IDS = ["ami-0123456789abcdef0", "ami-fedcba9876543210"]

def evaluate_compliance(config_item):
    if config_item['resourceType'] != 'AWS::EC2::Instance':
        return 'NOT_APPLICABLE'

    ami_id = config_item['configuration']['imageId']
    
    if ami_id in APPROVED_AMI_IDS:
        return {
            "compliance_type": "COMPLIANT",
            "annotation": f"Instance is using an approved AMI ({ami_id})."
        }
    else:
        return {
            "compliance_type": "NON_COMPLIANT",
            "annotation": f"Instance is using unapproved AMI ({ami_id}). Only approved AMIs are allowed."
        }

def lambda_handler(event, context):
    invoking_event = json.loads(event['invokingEvent'])
    config_item = invoking_event['configurationItem']
    
    result = evaluate_compliance(config_item)
    
    evaluation = {
        'ComplianceResourceType': config_item['resourceType'],
        'ComplianceResourceId': config_item['resourceId'],
        'ComplianceType': result['compliance_type'],
        'Annotation': result['annotation'],
        'OrderingTimestamp': config_item['configurationItemCaptureTime']
    }

    config.put_evaluations(
        Evaluations=[evaluation],
        ResultToken=event['resultToken']
    )

description: >-
  Terminates an EC2 instance found to be non-compliant by an AWS Config rule.
schemaVersion: '0.3'
assumeRole: '{{ AutomationAssumeRole }}'
parameters:
  AutomationAssumeRole:
    type: String
    description: (Required) ARN of the role for Automation to perform actions.
  InstanceId:
    type: String
    description: (Required) The ID of the non-compliant EC2 instance.
mainSteps:
  - name: VerifyInstanceState
    action: 'aws:assertAwsResourceProperty'
    inputs:
      Service: ec2
      Api: DescribeInstances
      InstanceIds: [ '{{ InstanceId }}' ]
      PropertySelector: '$.Reservations[0].Instances[0].State.Name'
      DesiredValues: [ 'running', 'stopped' ]
    onFailure: Abort
  
  - name: TerminateInstance
    action: 'aws:executeAwsApi'
    inputs:
      Service: ec2
      Api: TerminateInstances
      InstanceIds:
        - '{{ InstanceId }}'
    description: Terminates the non-compliant EC2 instance.
    
  - name: VerifyInstanceTerminated
    action: 'aws:waitForAwsResourceProperty'
    timeoutSeconds: 300
    inputs:
      Service: ec2
      Api: DescribeInstances
      InstanceIds: [ '{{ InstanceId }}' ]
      PropertySelector: '$.Reservations[0].Instances[0].State.Name'
      DesiredValues: [ 'terminated' ]
    onFailure: Abort

# 1. The Custom AWS Config Rule
resource "aws_config_custom_rule" "approved_ami_rule" {
  name = "ApprovedAmiRule"
  
  lambda_function_arn = aws_lambda_function.approved_ami_check_lambda.arn
  trigger_types       = ["ConfigurationItemChangeNotification"]

  source {
    owner             = "CUSTOM_LAMBDA"
    source_identifier = aws_lambda_function.approved_ami_check_lambda.arn
  }

  scope {
    compliance_resource_types = ["AWS::EC2::Instance"]
  }
}

# 2. The SSM Automation Document for Remediation
resource "aws_ssm_document" "terminate_instance_remediation" {
  name          = "TerminateNonCompliantInstance"
  document_type = "Automation"
  content       = file("ssm_documents/terminate_instance.yml")
}

# 3. The Remediation Configuration linking the rule to the SSM document
resource "aws_config_remediation_configuration" "ami_rule_remediation" {
  config_rule_name = aws_config_custom_rule.approved_ami_rule.name
  
  target_id        = aws_ssm_document.terminate_instance_remediation.name
  target_type      = "SSM_DOCUMENT"
  
  automatic = true
  maximum_automatic_attempts = 2
  retry_attempt_seconds = 120

  parameter {
    name = "InstanceId"
    resource_value {
      value = "RESOURCE_ID"
    }
  }
  
  parameter {
    name = "AutomationAssumeRole"
    static_value {
      values = [aws_iam_role.remediation_role.arn]
    }
  }
}