SecurityHubでAWSリソースをセキュアにしてみた #やってみた – Qiita

SecurityHubはAWS Configの有効化が必須
AWS Security HubでAWS Configが必須となる理由は、Security Hubがリソースの状態や設定を正確に把握し、セキュリティ標準に基づく評価（セキュリティチェック）を行うために、Configの記録が必要不可欠だからです。

• Config

  import * as cdk from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  import * as s3 from 'aws-cdk-lib/aws-s3';
  import * as iam from 'aws-cdk-lib/aws-iam';
  import * as config from 'aws-cdk-lib/aws-config';
  
  export class AwsConfigConstruct extends cdk.Stack {
    public readonly bucket: s3.Bucket;
    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
      super(scope, id, props);
     
      const configBucket = new cdk.aws_s3.Bucket(this, "configBucket", {
        blockPublicAccess: cdk.aws_s3.BlockPublicAccess.BLOCK_ALL,
        encryption: cdk.aws_s3.BucketEncryption.S3_MANAGED,
        enforceSSL: true,
        versioned: false,
        removalPolicy: cdk.RemovalPolicy.DESTROY,
        autoDeleteObjects: true,
      });
  
      // Add bucket policy
      const bucketPolicy = new iam.PolicyStatement({
        sid: "AWSConfigBucketPermissionsCheck",
        effect: iam.Effect.ALLOW,
        principals: [new iam.ServicePrincipal("config.amazonaws.com")],
        actions: ["s3:GetBucketAcl"],
        resources: [configBucket.bucketArn],
        conditions: {
          StringEquals: {
            "AWS:SourceAccount": AWS_ACCOUNT_ID, // Using the account ID of the stack
          },
        },
      });
  
      const listBucketPolicy = new iam.PolicyStatement({
        sid: "AWSConfigBucketExistenceCheck",
        effect: iam.Effect.ALLOW,
        principals: [new iam.ServicePrincipal("config.amazonaws.com")],
        actions: ["s3:ListBucket"],
        resources: [configBucket.bucketArn],
        conditions: {
          StringEquals: {
            "AWS:SourceAccount": AWS_ACCOUNT_ID,
          },
        },
      });
  
      const putObjectPolicy = new iam.PolicyStatement({
        sid: "AWSConfigBucketDelivery",
        effect: iam.Effect.ALLOW,
        principals: [new iam.ServicePrincipal("config.amazonaws.com")],
        actions: ["s3:PutObject"],
        resources: [`${configBucket.bucketArn}/AWSLogs/${process.env.AWS_ACCOUNT_ID}/Config/*`],
        conditions: {
          StringEquals: {
            "s3:x-amz-acl": "bucket-owner-full-control",
            "AWS:SourceAccount": AWS_ACCOUNT_ID,
          },
        },
      });
  
      // Add the policy statements to the bucket
      configBucket.addToResourcePolicy(bucketPolicy);
      configBucket.addToResourcePolicy(listBucketPolicy);
      configBucket.addToResourcePolicy(putObjectPolicy);
  
      const configRole = new iam.CfnServiceLinkedRole(this, 'ConfigServiceLinkedRole', {
        awsServiceName: 'config.amazonaws.com',
      });
  
      const configRecorder = new config.CfnConfigurationRecorder(
        this,
        "ConfigRecorder",
        {
          name: "CloudFrontVpcOriginConfigRecorder",
          roleArn: `arn:aws:iam::${AWS_ACCOUNT_ID}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig`,
          recordingGroup: {
            allSupported: true,
            includeGlobalResourceTypes: true,
          },
          recordingMode: {
            recordingFrequency: "CONTINUOUS",
          },
        }
      );
  
      const configDeliveryChannel = new config.CfnDeliveryChannel(
        this,
        "ConfigDeliveryChannel",
        {
          name: "CloudFrontVpcOriginConfigDeliveryChannel",
          s3BucketName: configBucket.bucketName, // S3バケット名を指定
          configSnapshotDeliveryProperties: {
            deliveryFrequency: "TwentyFour_Hours",
          },
        }
      );
      configDeliveryChannel.node.addDependency(configBucket);
      configDeliveryChannel.node.addDependency(configRole);
      configRecorder.node.addDependency(configRole);
      configRecorder.node.addDependency(configBucket);
    }
  }
  

• SecurityHub

  import * as cdk from 'aws-cdk-lib';
  import { Construct } from 'constructs';
  
  
  export class SecurityHubStack extends cdk.Stack {
    constructor(scope: Construct, id: string, props?: cdk.StackProps) {
      super(scope, id, props);
  
      // Security Hubの有効化
      const hub = new cdk.aws_securityhub.CfnHub(this, 'SecurityHub', {
          enableDefaultStandards: false, // デフォルトのセキュリティ基準を無効化
          autoEnableControls: true, // 自動的にコントロールを有効化しない
      });
  
      // 東京リージョンでAWS Foundational Security Best Practices標準の有効化
      const awsFsbp = new cdk.aws_securityhub.CfnStandard(this, 'AWSFoundationalSecurityBestPractices', {
          standardsArn: `arn:aws:securityhub:ap-northeast-1::standards/aws-foundational-security-best-practices/v/1.0.0`,
      });
  
      awsFsbp.addDependency(hub);
  
    }
  }
  

AWS GuardDuty

// GuardDutyの有効化と各種機能の有効化
    const guardDuty = new cdk.aws_guardduty.CfnDetector(this, 'GuardDuty', {
      enable: true,
      features: [
      { name: 'S3_DATA_EVENTS', status: 'ENABLED' }, // S3 Protection
      { name: 'EKS_AUDIT_LOGS', status: 'DISABLED' }, // EKS 監査ログのモニタリング設定（無効）
      { name: 'RUNTIME_MONITORING', status: 'ENABLED', additionalConfiguration: [ { name: 'EC2_AGENT_MANAGEMENT', status: 'ENABLED' } ] }, // ランタイムモニタリング（EC2自動エージェント設定有効）
      { name: 'EBS_MALWARE_PROTECTION', status: 'ENABLED' }, // EC2 の Malware Protection
      { name: 'RDS_LOGIN_EVENTS', status: 'DISABLED' }, // RDS Protection（無効）
      { name: 'LAMBDA_NETWORK_LOGS', status: 'ENABLED' }, // Lambda 保護
      ],
    });

    // EventBridge ルールを作成
    const eventRule = new events.Rule(this, 'EventRule', {
      eventPattern: {
        source: ['aws.securityhub'],
        /**
         * 全ての Security Hub Findings を対象にする場合は以下のように設定
         * @see https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-integration-types.html#securityhub-cwe-integration-types-all-findings
         */
        detailType: ['Security Hub Findings - Imported'],
        detail: {
          findings: {
            Severity: {
              Label: ['CRITICAL', 'HIGH'],
            },
            // 抑制対象を除外する設定を追加
            Workflow: {
              Status: ['NEW', 'NOTIFIED', 'RESOLVED'], // SUPPRESSED を除外
            },
          },
        },
      },
    });

    securityGroup.addIngressRule(
        ec2.Peer.anyIpv4(),
        ec2.Port.tcp(9000),
        'Allow HTTP access port 9000'
    );

    ec2securityGroup.addIngressRule(
        ec2.Peer.prefixList(cloudfrontPrefixList.prefixListId),
        ec2.Port.tcp(9000),
        'Allow CloudFront to connect to EC2 origin'
    )