aws_clb_encryption.pt

name "AWS Unencrypted ELB Listeners (CLB)"
rs_pt_ver 20180301
type "policy"
short_description "**Deprecated: This policy is no longer being updated. Please see [README](https://github.com/flexera-public/policy_templates/tree/master/security/aws/clb_unencrypted/) for more details.** Report any AWS Classic Load Balancers w/Internet-facing Unencrypted Listeners. \n See the [README](https://github.com/flexera-public/policy_templates/tree/master/security/aws/clb_unencrypted/) and [docs.flexera.com/flexera/EN/Automation](https://docs.flexera.com/flexera/EN/Automation/AutomationGS.htm) to learn more."
long_description ""
category "Security"
severity "medium"
info(
  version: "3.1.3",
  provider: "AWS",
  service: "ELB",
  policy_set: "",
  deprecated: "true",
  hide_skip_approvals: "true"
)

###############################################################################
# Parameters
###############################################################################

parameter "param_allowed_regions_allow_or_deny" do
  type "string"
  label "Allow/Deny Regions"
  description "Allow or Deny entered regions. See the README for more details"
  allowed_values "Allow", "Deny"
  default "Allow"
end

parameter "param_allowed_regions" do
  type "list"
  label "Regions"
  allowed_pattern /^([a-zA-Z-_]+-[a-zA-Z0-9-_]+-[0-9-_]+,*|)+$/
  description "A list of allowed or denied regions. See the README for more details"
end

parameter "param_email" do
  type "list"
  label "Email Address"
  description "Email addresses of the recipients you wish to notify"
end

parameter "param_aws_account_number" do
  type "string"
  category "Policy Settings"
  label "Account Number"
  description "Leave blank; this is for automated use with Meta Policies. See README for more details."
  default ""
end

parameter "param_exclude_tags" do
  type "list"
  label "Ignore Tags"
  description "List of one or more Tags that will exclude Classic Load Balancer from actions being taken. Format: Key=Value"
end

###############################################################################
# Authentication
###############################################################################

credentials "auth_aws" do
  schemes "aws","aws_sts"
  label "AWS"
  description "Select the AWS Credential from the list"
  tags "provider=aws"
  aws_account_number $param_aws_account_number
end

###############################################################################
# Pagination
###############################################################################

pagination "elb_pagination" do
  get_page_marker do
    body_path "DescribeLoadBalancersResult.NextMarker"
  end
  set_page_marker do
    query "Marker"
  end
end

###############################################################################
# Datasources
###############################################################################

# ds_region_list is a list of regions that are opted-in or opt-in-not-required
datasource "ds_regions_list" do
  # https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRegions.html
  request do
    auth $auth_aws
    host "ec2.amazonaws.com"
    path "/"
    query "Action", "DescribeRegions"
    query "Version", "2016-11-15"
    query "Filter.1.Name", "opt-in-status"
    query "Filter.1.Value.1", "opt-in-not-required"
    query "Filter.1.Value.2", "opted-in"
  end
  result do
    encoding "xml"
    collect xpath(response, "//DescribeRegionsResponse/regionInfo/item", "array") do
      field "region", xpath(col_item, "regionName")
    end
  end
end

# Get only SCP enabled regions
datasource "ds_regions" do
  run_script $js_regions, $param_allowed_regions, $ds_regions_list, $param_allowed_regions_allow_or_deny
end

#Get the list of all Classic load Balancers
datasource "ds_elb_list" do
  iterate $ds_regions
  request do
    run_script $js_elb_list, val(iter_item,"region")
  end
  result do
    encoding "json"
    collect jmes_path(response, "DescribeLoadBalancersResponse.DescribeLoadBalancersResult.*[*][]") do
      field "loadBalancerName", jmes_path(col_item, "LoadBalancerName")
      field "region", val(iter_item,"region")
      field "availabilityZones", jmes_path(col_item, "AvailabilityZones")
      field "scheme",  jmes_path(col_item, "Scheme")
      field "listenerDescriptions", jmes_path(col_item, "ListenerDescriptions")
    end
  end
end

#Get respective tags for all Classic load Balancers
datasource "ds_elb_list_with_tags" do
  iterate $ds_elb_list
  request do
    run_script $js_elb_list_with_tags, val(iter_item,"region"), val(iter_item, "loadBalancerName")
  end
  result do
    encoding "json"
    collect jmes_path(response, "DescribeTagsResponse.DescribeTagsResult.TagDescriptions[*]") do
      field "loadBalancerName", val(iter_item, "loadBalancerName")
      field "region", val(iter_item,"region")
      field "availabilityZones", val(iter_item, "availabilityZones")
      field "scheme",  val(iter_item,"scheme")
      field "listenerDescriptions", val(iter_item,"listenerDescriptions")
      field "tags" do
        collect jmes_path(col_item,"Tags") do
          field "tagKey", jmes_path(col_item,"Key")
          field "tagValue", jmes_path(col_item,"Value")
        end
      end
    end
  end
end

datasource "ds_unencrypted_elb_map" do
  run_script $js_elb_filter_map, $ds_elb_list_with_tags, $param_exclude_tags
end

###############################################################################
# Script
###############################################################################

script "js_regions", type:"javascript" do
  parameters "user_entered_regions", "all_regions", "regions_allow_or_deny"
  result "regions"
  code <<-EOS
    if(_.isEmpty(user_entered_regions)){
      regions = all_regions;
    }else{
      //Filter unique regions
      var uniqueRegions = _.uniq(user_entered_regions);
      var all_regions_list = [];
      //Filter and remove denied regions from all_regions
      if (regions_allow_or_deny == "Deny"){
        var all_regions = all_regions.filter(function(obj){
          return user_entered_regions.indexOf(obj.region) === -1;
        });
      }
      all_regions.forEach(function(all_region){
        all_regions_list.push(all_region.region)
      })
      //Filter valid regions
      var valid_regions = [];
      _.map(uniqueRegions, function(uniqueRegion){
        if(all_regions_list.indexOf(uniqueRegion) > -1){
          valid_regions.push({"region": uniqueRegion})
        }
      })

      //Throw an error if no valid regions found
      if (_.isEmpty(valid_regions)) {
        regions = all_regions;
      }else{
        regions = valid_regions
      }
    }
  EOS
end

#https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeLoadBalancers.html (Classic Load Balancer)
script "js_elb_list", type: "javascript" do
  parameters "region"
  result "request"
  code <<-EOS
    request = {
      auth: 'auth_aws',
      pagination: 'elb_pagination',
      host: 'elasticloadbalancing.'+region+'.amazonaws.com',
      path: '/',
      verb: 'GET',
      query_params: {
        "Action": "DescribeLoadBalancers",
        "Version": "2012-06-01"
      },
      headers: {
        "Accept": "application/json"
      }
    }
  EOS
end

#https://docs.aws.amazon.com/elasticloadbalancing/2012-06-01/APIReference/API_DescribeTags.html (Classic Load Balancer)
script "js_elb_list_with_tags", type: "javascript" do
  parameters "region", "loadBalancerName"
  result "request"
  code <<-EOS
    request = {
      auth: 'auth_aws',
      host: 'elasticloadbalancing.'+region+'.amazonaws.com',
      path: '/',
      verb: 'GET',
      query_params: {
        "Action": "DescribeTags",
        "Version": "2012-06-01",
        "LoadBalancerNames.member.1": loadBalancerName
      },
      headers: {
        "Accept": "application/json"
      }
    }
  EOS
end

#Process the response data, check for the tags and generate a list of internetfacing listeners
script "js_elb_filter_map", type: "javascript" do
  parameters "ds_elb_list_with_tags", "param_exclude_tags"
  result "content"
  code <<-EOS
    var param_exclude_tags_lower=[];
    for(var j=0; j < param_exclude_tags.length; j++){
      param_exclude_tags_lower[j]=param_exclude_tags[j].toString().toLowerCase();
    }

    var content=[]
    for(var i=0; i<ds_elb_list_with_tags.length; i++){
      elb=ds_elb_list_with_tags[i]

      // Constructing availabilityZones with comma separated to display in detail_template
      var availabilityZones=elb['availabilityZones']
      var s_availabilityZones=""
      for(var j=0; j < availabilityZones.length; j++){
        availabilityZone = availabilityZones[j]
        s_availabilityZones = s_availabilityZones + ', '+ availabilityZone
      }

      //Constructing Tags of individual ELB into key=value format. Check, if the tag present in entered param_exclude_tags. Ignore the Load Balancer if the tag matches/present.
      var tags = elb['tags']
      var isTagMatched=false
      var tagKeyValue=""
      for(var j=0; j < tags.length; j++){
        tag = tags[j]
        if((param_exclude_tags_lower.indexOf((tag['tagKey']).toLowerCase()) !== -1) || (param_exclude_tags_lower.indexOf((tag['tagKey']+'='+tag['tagValue']).toLowerCase()) !== -1)){
          isTagMatched = true;
        }
        // Constructing tags with comma separated to display in detail_template
        if((tag['tagValue']).length > 0){
          tagKeyValue = tagKeyValue + ', '+ tag['tagKey']+'='+tag['tagValue']
        }else{
          tagKeyValue = tagKeyValue + ', '+ tag['tagKey']
        }
      }

      //If the Load Balancer tag does not match with entered param_exclude_tags, then check if Load Balancer is internet-facing and has HTTPS/SSL in use.
      if(!(isTagMatched) && (elb['scheme']) === 'internet-facing') {
        // check for HTTPS or SSL listeners
        var protocols = _.pluck(_.pluck(elb['listenerDescriptions'],'Listener'),'Protocol')
        var ports = _.pluck(_.pluck(elb['listenerDescriptions'],'Listener'),'LoadBalancerPort')
        for (var x = 0; x < protocols.length; x++) {
          switch (protocols[x]) {
            case "HTTPS":
              break
            case "SSL":
              break
            default:
              content.push ({
                id: elb['loadBalancerName'],
                loadBalancerType: "classic",
                loadBalancerProtocol: protocols[x],
                loadBalancerPort: ports[x],
                region: elb['region'],
                availabilityZones:(s_availabilityZones.slice(2)),
                tagKeyValue:(tagKeyValue.slice(2)),
                loadBalancerProtocolAndPort: protocols[x]+" "+ports[x]
              })
          }
        }
      }
    }
  content = _.sortBy(content,'id')
  content = _.sortBy(content,'loadBalancerType')
  content = _.sortBy(content,'region')
  EOS
end

###############################################################################
# Policy
###############################################################################

policy "policy_unencrypted_CLB" do
  validate $ds_unencrypted_elb_map do
    summary_template "{{ rs_project_name }} (Account ID: {{ rs_project_id }}): {{ len data }} AWS Unencrypted ELB Listeners (CLB)"
    escalate $esc_unencrypted_lbs
    check eq(size(data),0)
    export do
      resource_level true
      field "id" do
        label "LoadBalancer Name"
      end
      field "loadBalancerType" do
        label "LoadBalancer Type"
      end
      field "loadBalancerProtocolAndPort" do
        label "Listener Protocol (Port)"
      end
      field "region" do
        label "Region"
      end
      field "availabilityZones" do
        label "Availability Zones"
      end
      field "tagKeyValue" do
        label "TAGs"
      end
    end
  end
end

###############################################################################
# Escalations
###############################################################################

escalation "esc_unencrypted_lbs" do
  automatic true
  label "Send Email"
  description "Send incident email"
  email $param_email
end


###############################################################################
# Cloud Workflow
###############################################################################