template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: SAM Template for xray-aws-security-hub

# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 20
    Environment:
      Variables:
        APP_VERSION: 1.2.4

Parameters:
  DeploymentEnvironment:
    Description: Deployment environment for the app (e.g. dev, stage, prod). 'dev' should only be used for development purpose and will enable additional logging (including API token as part of HTTP request log) to CloudWatch.
    Type: String
    Default: prod

  DebugLogsEnabled:
    Description: Enable or disable debug logs.
    Type: String
    Default: false
    AllowedValues: [true, false]

  ApiAuthToken:
    Description: Authentication token for API endpoint. This will be stored in Secrets Manager and used to verify Xray webhook requests. No requirements are applied to this token but we encourage you to apply good security practices. Leave blank to not use any authentication. This value needs to be set as custom HTTP Authorization header in Xray webhook.
    NoEcho: True
    Type: String

  NotificationEmail:
    Description: Email address to notify of operational issues. When set, an alert email notification will be sent to this address when the Xray Dead Letter Queue has more than 10 messages.
    Default: jane.doe@example.com
    Type: String

  SecurityHubRegion:
    Description: 'The region, where Security Hub is enabled. It will be used to import and update findings and might be different from your deployment region. Security Hub regions: https://docs.aws.amazon.com/general/latest/gr/sechub.html'
    Type: String
    Default: us-east-1
    AllowedValues:
      - af-south-1
      - ap-east-1
      - ap-northeast-1
      - ap-northeast-2
      - ap-northeast-3
      - ap-south-1
      - ap-southeast-1
      - ap-southeast-2
      - ap-southeast-3
      - ca-central-1
      - eu-central-1
      - eu-north-1
      - eu-south-1
      - eu-west-1
      - eu-west-2
      - eu-west-3
      - me-south-1
      - sa-east-1
      - us-east-1
      - us-east-2
      - us-west-1
      - us-west-2

Metadata:
  AWS::ServerlessRepo::Application:
    Name: jfrog-xray-security-hub-integration
    Description: This serverless application integrates JFrog Xray with AWS Security Hub and sends Xray violations (security, licence compliance, operational risk) to Security Hub.
    Author: JFrog
    SpdxLicenseId: Apache-2.0
    LicenseUrl: LICENSE.txt
    ReadmeUrl: SERVERLESS-REPO-README.md
    Labels: ['jfrog', 'xray', 'devops', 'security', 'license', 'operational_risk', 'serverless', 'securityhub']
    HomePageUrl: https://github.com/jfrog/xray-aws-security-hub
    SemanticVersion: 1.2.4
    SourceCodeUrl: https://github.com/jfrog/xray-aws-security-hub

Conditions:
  IsDebugEnv: !Equals [!Ref 'DebugLogsEnabled', 'true']
  HasAuthToken: !Not [!Equals [!Ref 'ApiAuthToken', '']]
  HasNotificationEmail: !Not [!Equals [!Ref 'NotificationEmail', '']]

Resources:
  SecurityHubAuthTokenSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: Xray Security Hub API Gateway auth token
      Name: XraySecurityHubAuthToken
      SecretString: !Ref ApiAuthToken
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  ApiGwAccountConfig:
    Type: AWS::ApiGateway::Account
    Properties:
      CloudWatchRoleArn: !GetAtt ApiGatewayLoggingRole.Arn

  ApiGatewayLoggingRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - !Sub arn:${AWS::Partition}:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  SecurityHubApi:
    Type: AWS::Serverless::Api
    Properties:
      OpenApiVersion: '2.0'
      Auth:
        ApiKeyRequired: False
        Authorizers:
          TokenAuthorizer:
            FunctionArn: !GetAtt AuthorizerFunction.Arn
            FunctionPayloadType: TOKEN
            Identity:
              Header: Authorization
        DefaultAuthorizer: TokenAuthorizer
      MethodSettings:
        - DataTraceEnabled: !If [IsDebugEnv, True, False]
          LoggingLevel: !If [IsDebugEnv, 'INFO', 'ERROR']
          ResourcePath: '/*' # allows for logging on any resource
          HttpMethod: '*' # allows for logging on any method
          ThrottlingRateLimit: 100
          ThrottlingBurstLimit: 1000
      Name: security-hub-api-dev
      StageName: !Ref DeploymentEnvironment
      TracingEnabled: !If [IsDebugEnv, True, False]

  AuthorizerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Description: Security Hub Xray integration Lambda execution role
      Path: /
      Policies:
        - PolicyName: logs
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
        - PolicyName: secretsmanager
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                  - secretsmanager:DescribeSecret
                  - secretsmanager:ListSecretVersionIds
                Resource: !Ref SecurityHubAuthTokenSecret
              - Effect: Allow
                Action:
                  - secretsmanager:ListSecrets
                Resource: '*'
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  EventProcessorRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Description: Security Hub Xray integration Lambda execution role
      Path: /
      Policies:
        - PolicyName: logs
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
        - PolicyName: lambda
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                  - lambda:InvokeAsync
                Resource: '*'
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  IssueProcessorRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Description: Security Hub Xray integration Lambda execution role
      Path: /
      Policies:
        - PolicyName: logs
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
        - PolicyName: sqs
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - sqs:ReceiveMessage
                  - sqs:SendMessage
                  - sqs:DeleteMessage
                  - sqs:GetQueueAttributes
                Resource: !GetAtt XraySourceQueue.Arn
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  TransformerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Description: Security Hub Xray integration Lambda execution role
      Path: /
      Policies:
        - PolicyName: logs
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
        - PolicyName: sqs
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - sqs:ReceiveMessage
                  - sqs:SendMessage
                  - sqs:DeleteMessage
                  - sqs:GetQueueAttributes
                Resource: !GetAtt XraySourceQueue.Arn
        - PolicyName: securityHub
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - securityhub:Get*
                  - securityhub:List*
                  - securityhub:Describe*
                  - securityhub:BatchImportFindings
                  - securityhub:BatchUpdateFindings
                Resource: arn:aws:securityhub:*
        - PolicyName: dynamoDB
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:PutItem
                  - dynamodb:Query
                Resource: !GetAtt DynamoDBTable.Arn
        - PolicyName: s3bucket
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - s3:Put*
                  - s3:Get*
                  - s3:List*
                  - s3:Delete*
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:s3:::'
                      - !Ref S3Bucket
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  AuthorizerFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      FunctionName: Authorizer
      CodeUri: authorizer/
      Environment:
        Variables:
          HAS_AUTH_TOKEN: !If [HasAuthToken, 'true', 'false']
          MAX_LOG_LEVEL: !If [IsDebugEnv, 'debug', 'info']
          NODE_ENV: !If [IsDebugEnv, 'development', 'production']
          SECRET_ID: XraySecurityHubAuthToken
      Handler: app.handler
      Runtime: nodejs16.x
      Role: !GetAtt AuthorizerRole.Arn # access to secrets
      Tags:
        App: xray-aws-security-hub
        Environment: !Ref DeploymentEnvironment

  EventProcessorFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Description: "Processes Xray payload as an event, splits the list of issues on chunks of 10 issues and invokes IssueProcessor Lambda."
      FunctionName: EventProcessor
      CodeUri: eventProcessor/
      Environment:
        Variables:
          MAX_LOG_LEVEL: !If [IsDebugEnv, 'debug', 'info']
          NODE_ENV: !If [IsDebugEnv, 'development', 'production']
          SECURITY_HUB_REGION: !Ref SecurityHubRegion
      Handler: app.lambdaHandler
      Runtime: nodejs16.x
      Role: !GetAtt EventProcessorRole.Arn # access to lambda, logs
      Events: # Initiated by API call form API gateway
        ProcessCallPayload:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /
            Method: post
            RestApiId:
              Ref: SecurityHubApi
      Tags:
        App: xray-aws-security-hub
        Environment: !Ref DeploymentEnvironment

  IssueProcessorFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      Description: "Processes chunks of 10 issues and batch send messages to SQS queue."
      FunctionName: IssueProcessor
      CodeUri: issueProcessor/
      Handler: app.lambdaHandler
      Runtime: nodejs16.x
      Role: !GetAtt IssueProcessorRole.Arn # access to SQS, logs
      Environment:
        Variables:
          MAX_LOG_LEVEL: !If [IsDebugEnv, 'debug', 'info']
          NODE_ENV: !If [IsDebugEnv, 'development', 'production']
          SQS_QUEUE_URL: !Ref XraySourceQueue
          SECURITY_HUB_REGION: !Ref SecurityHubRegion
      Tags:
        App: xray-aws-security-hub
        Environment: !Ref DeploymentEnvironment

  TransformerFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      FunctionName: Transformer
      CodeUri: transformer/
      Handler: app.lambdaHandler
      Runtime: nodejs16.x
      Role: !GetAtt TransformerRole.Arn # access to SQS, sec hub, logs
      Environment:
        Variables:
          DEV_ACCOUNT_ID: ''
          MAX_LOG_LEVEL: !If [IsDebugEnv, 'debug', 'info']
          NODE_ENV: !If [IsDebugEnv, 'development', 'production']
          USE_DEV_ACCOUNT_ID: 'false'
          SECURITY_HUB_REGION: !Ref SecurityHubRegion
          XRAY_FINDINGS_TABLE: !Ref DynamoDBTable
          S3_BUCKET_NAME: !Ref S3Bucket
      Events: # Initiated by the message in SQS queue
        TransformCallPayload:
          Type: SQS # More info https://github.com/aws/serverless-application-model/blob/master/versions/2016-10-31.md#sqs
          Properties:
            Queue: !GetAtt XraySourceQueue.Arn
            BatchSize: 10
            Enabled: True
      Tags:
        App: xray-aws-security-hub
        Environment: !Ref DeploymentEnvironment

  XraySourceQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: XraySourceQueue.fifo
      FifoQueue: True
      ContentBasedDeduplication: False
      VisibilityTimeout: 120 # should be at least 6x of lambda timeout
      ReceiveMessageWaitTimeSeconds: 1 # added for testing
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt XrayDeadLetterQueue.Arn
        maxReceiveCount: 5
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  XrayDeadLetterQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: DeadLetterQueue.fifo
      FifoQueue: True
      ContentBasedDeduplication: False
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  AlarmTopic:
    Type: AWS::SNS::Topic
    Condition: HasNotificationEmail
    Properties:
      KmsMasterKeyId: alias/aws/sns
      Subscription:
        - Endpoint:
            Ref: NotificationEmail
          Protocol: email
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  QueueDepthAlarm:
    Type: AWS::CloudWatch::Alarm
    Condition: HasNotificationEmail
    Properties:
      AlarmDescription: Alarm if queue depth increases to more than 10 messages.
      Namespace: AWS/SQS
      MetricName: ApproximateNumberOfMessagesVisible
      Dimensions:
        - Name: QueueName
          Value: !GetAtt XraySourceQueue.QueueName
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 10
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
        - Ref: AlarmTopic
      InsufficientDataActions:
        - Ref: AlarmTopic

  DynamoDBTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      DeletionProtectionEnabled: true
      TableName: !Sub "xray-findings-${DeploymentEnvironment}"
      AttributeDefinitions:
        - AttributeName: ID
          AttributeType: S
        - AttributeName: TIMESTAMP
          AttributeType: S
      KeySchema:
        - AttributeName: ID
          KeyType: HASH
        - AttributeName: TIMESTAMP
          KeyType: RANGE
      BillingMode: PAY_PER_REQUEST
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: true
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  S3Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Sub "jfrog-xray-aws-failed-findings-${AWS::Region}-${AWS::AccountId}-${DeploymentEnvironment}"
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      LifecycleConfiguration:
        Rules:
          - Id: StandardIARule
            Prefix: standardIA
            Status: Enabled
            ExpirationInDays: 365
            Transitions:
              - TransitionInDays: 30
                StorageClass: STANDARD_IA
      Tags:
        - Key: App
          Value: xray-aws-security-hub
        - Key: Environment
          Value: !Ref DeploymentEnvironment

  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:GetObject'
              - 's3:PutObject'
            Effect: Allow
            Principal:
              AWS:
                - !GetAtt TransformerRole.Arn
            Resource:
              - !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref S3Bucket
                  - '/*'

Outputs:
  # ServerlessRestApi is an implicit API created out of Events key under Serverless::Function
  # Find out more about other implicit resources you can reference within SAM
  # https://github.com/awslabs/serverless-application-model/blob/master/docs/internals/generated_resources.rst#api

  ApiEndpoint:
    Description: "API Gateway endpoint URL"
    Value: !Sub "https://${SecurityHubApi}.execute-api.${AWS::Region}.${AWS::URLSuffix}/${DeploymentEnvironment}"