Landing Zone Accelerator on AWS for Healthcare

https://github.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare
Admin
Landing Zone Accelerator for Healthcare is an AWS solution that deploys a secure, compliant cloud...
Tokens:11,046
Snippets:47
Trust Score:9
Update:4 months ago
Show doc for...
Tokens:
Raw
### Global Configuration for Logging and Monitoring Setup (YAML)

Source: https://context7.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare/llms.txt

This YAML configuration file defines global settings for logging, monitoring, and cost management across the AWS Organization. It specifies the home and enabled regions, CloudTrail logging behavior, Session Manager settings, S3 bucket lifecycle policies, and configurations for cost reporting and budget alerts.

```yaml
# config/global-config.yaml
homeRegion: &HOME_REGION us-east-1
enabledRegions:
  - *HOME_REGION
cloudwatchLogRetentionInDays: 3653
controlTower:
  enable: true
  landingZone:
    version: "3.3"
    logging:
      loggingBucketRetentionDays: 365
      accessLoggingBucketRetentionDays: 3650
      organizationTrail: true
logging:
  account: LogArchive
  centralLogBucket:
    lifecycleRules:
      - enabled: true
        expiration: 1000
        transitions:
          - storageClass: GLACIER_IR
            transitionAfter: 365
reports:
  costAndUsageReport:
    compression: Parquet
    format: Parquet
    reportName: "hlc-accelerator-cur"
    timeUnit: DAILY
  budgets:
    - deploymentTargets:
        accounts:
          - Management
      name: accel-budget
      amount: 2000
      notifications:
        - type: ACTUAL
          threshold: 90
          comparisonOperator: GREATER_THAN

```

--------------------------------

### Configure IAM Identity Center Delegation in YAML

Source: https://github.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare/blob/main/documentation/3-post-deployment.md

This snippet shows how to update the `iam-configs.yaml` file to delegate administration of IAM Identity Center to a specific member account. It requires specifying the `identityCenter` class with `name` and `delegatedAdminAccount` properties. Dependencies include the LZA configuration structure. This configuration is part of the broader AWS Organizations setup.

```yaml
identityCenter:
  name: "MyIdentityCenter"
  delegatedAdminAccount: "111122223333"
```

--------------------------------

### Enable All Default Regions in global-config.yaml

Source: https://github.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare/blob/main/documentation/3-post-deployment.md

This snippet demonstrates how to update the `global-config.yaml` file to enable security controls in all default AWS regions. It involves adding a list of region codes to the `enabledRegions` property. This ensures consistent security posture across your AWS environment. The process requires committing and pushing changes to a CodeCommit repository and then releasing the `AWSAccelerator-Pipeline`.

```yaml
enabledRegions:
  - *HOME_REGION
  - "ap-northeast-1"
  - "ap-northeast-2"
  - "ap-northeast-3"
  - "ap-south-1"
  - "ap-southeast-1"
  - "ap-southeast-2"
  - "eu-central-1"
  - "eu-north-1"
  - "eu-west-1"
  - "eu-west-2"
  - "eu-west-3"
  - "sa-east-1"
  - "us-east-2"
  - "us-west-1"
  - "us-west-2"
```

--------------------------------

### Monitor Security Events with CloudWatch Metrics and Alarms

Source: https://context7.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare/llms.txt

YAML configuration for CloudWatch log metric filters and alarms to monitor security events aligned with CIS AWS Foundations Benchmark. It includes filters for root account usage, IAM policy changes, and CloudTrail modifications, with associated alarms in the 'SecurityHigh' SNS topic.

```yaml
# config/security-config.yaml (cloudWatch section)
cloudWatch:
  metricSets:
    - regions:
        - us-east-1
      deploymentTargets:
        accounts:
          - Management
      metrics:
        - filterName: RootAccountUsageMetricFilter
          logGroupName: aws-controltower/CloudTrailLogs
          filterPattern: '{$.userIdentity.type="Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType !="AwsServiceEvent"}'
          metricNamespace: LogMetrics
          metricName: RootAccountUsage
          metricValue: "1"
        - filterName: IAMPolicyChangesMetricFilter
          logGroupName: aws-controltower/CloudTrailLogs
          filterPattern: "{($.eventName=DeleteGroupPolicy) || ($.eventName=PutGroupPolicy) || ($.eventName=CreatePolicy)}"
          metricNamespace: LogMetrics
          metricName: IAMPolicyChanges
  alarmSets:
    - alarms:
        - alarmName: CIS-1.7-RootAccountUsage
          alarmDescription: Alarm for usage of "root" account
          snsTopicName: SecurityHigh
          metricName: RootAccountUsage
          namespace: LogMetrics
          comparisonOperator: GreaterThanOrEqualToThreshold
          evaluationPeriods: 1
          period: 300
          statistic: Sum
          threshold: 1
```

--------------------------------

### Automate IAM Instance Profile Attachment with SSM Document

Source: https://context7.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare/llms.txt

An SSM Automation document written in YAML to attach a specified IAM instance profile to an EC2 instance. This is useful for remediating non-compliant instances, particularly when used with AWS Config. It requires parameters for the instance profile name, instance ID, and an assumed IAM role.

```yaml
# config/ssm-documents/attach-iam-instance-profile.yaml
description: Associate AWS IAM Instance Profile to EC2 Instance
schemaVersion: '0.3'
assumeRole: '{{ AutomationAssumeRole }}'
parameters:
  IamInstanceProfile:
    type: String
  InstanceId:
    type: String
  AutomationAssumeRole:
    type: String
mainSteps:
  - name: associateIamProfile
    action: 'aws:executeAwsApi'
    inputs:
      Service: ec2
      Api: associate_iam_instance_profile
      IamInstanceProfile:
        Name: '{{ IamInstanceProfile }}'
      InstanceId: '{{ InstanceId }}'
```

--------------------------------

### Security Configuration for Compliance Controls (YAML)

Source: https://context7.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare/llms.txt

This YAML file configures various AWS security services to enforce compliance. It enables Security Hub with specific standards (CIS, NIST, AWS Foundational), GuardDuty for threat detection, EBS default volume encryption, S3 public access blocking, and AWS Config rules with automated remediation for common security best practices.

```yaml
# config/security-config.yaml
centralSecurityServices:
  delegatedAdminAccount: Audit
  ebsDefaultVolumeEncryption:
    enable: true
  s3PublicAccessBlock:
    enable: true
  guardduty:
    enable: true
    s3Protection:
      enable: true
    exportConfiguration:
      enable: true
      destinationType: S3
      exportFrequency: FIFTEEN_MINUTES
  securityHub:
    enable: true
    regionAggregation: true
    standards:
      - name: AWS Foundational Security Best Practices v1.0.0
        enable: true
      - name: CIS AWS Foundations Benchmark v1.4.0
        enable: true
      - name: NIST Special Publication 800-53 Revision 5
        enable: true
awsConfig:
  ruleSets:
    - deploymentTargets:
        organizationalUnits:
          - Root
      rules:
        - name: accelerator-s3-bucket-server-side-encryption-enabled
          identifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
          remediation:
            automatic: true
            targetId: Accelerator-Put-S3-Encryption
            parameters:
              - name: BucketName
                value: RESOURCE_ID
                type: String
        - name: accelerator-elb-logging-enabled
          identifier: ELB_LOGGING_ENABLED
          remediation:
            automatic: true
            targetId: Accelerator-SSM-ELB-Enable-Logging

```

--------------------------------

### Update Accelerator Prefix in Log Filters JSON

Source: https://github.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare/blob/main/documentation/2-install.md

This snippet shows how to update the 'acceleratorPrefix' in the 'dynamic-partitioning/log-filters.json' file. This is necessary if you changed the default accelerator prefix during the Landing Zone Accelerator on AWS deployment. Ensure the 'logGroupPattern' also reflects your custom prefix.

```json
[
  { "logGroupPattern": "/HCLS-Prod-SecurityHub", "s3Prefix": "security-hub" }
]
```

--------------------------------

### SCP: Deny Organization Departure and Root Key Creation

Source: https://context7.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare/llms.txt

A Service Control Policy (SCP) in JSON format that denies actions allowing an AWS account to leave the organization or create root user access keys. It also protects S3 account-level public access block settings, excluding accelerator roles. This policy is crucial for maintaining organizational integrity and security posture.

```json
{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Deny",
         "Action": [
            "organizations:LeaveOrganization",
            "organizations:DeleteOrganization"
         ],
         "Resource": ["*"],
         "Condition": {
            "ArnNotLike": {
               "aws:PrincipalARN": [
                  "arn:${PARTITION}:iam::*:role/${ACCELERATOR_PREFIX}-*",
                  "arn:${PARTITION}:iam::*:role/AWSControlTowerExecution"
               ]
            }
         }
      },
      {
         "Effect": "Deny",
         "Action": ["iam:CreateAccessKey"],
         "Resource": ["arn:${PARTITION}:aws:iam::*:root"]
      },
      {
         "Effect": "Deny",
         "Action": ["s3:PutAccountPublicAccessBlock"],
         "Resource": ["*"],
         "Condition": {
            "ArnNotLike": {
               "aws:PrincipalARN": [
                  "arn:${PARTITION}:iam::*:role/${ACCELERATOR_PREFIX}-*"
               ]
            }
         }
      }
   ]
}
```

--------------------------------

### Validate IAM Instance Profile Permissions with AWS Lambda

Source: https://context7.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare/llms.txt

A Lambda function that checks if IAM roles attached to EC2 instance profiles have specific AWS or customer-managed policies. It takes IAM role configurations as input and outputs compliance status. Requires AWS SDK for JavaScript.

```javascript
const { ConfigServiceClient, PutEvaluationsCommand } = require("@aws-sdk/client-config-service");
const client = new ConfigServiceClient();

const APPLICABLE_RESOURCES = ['AWS::IAM::Role'];

exports.handler = async function (event, context) {
  console.log(`Custom Rule for checking Policies attached to IAM role used under Instance Profile...`);
  const invokingEvent = JSON.parse(event.invokingEvent);
  const configurationItem = invokingEvent.configurationItem;
  const ruleParams = JSON.parse(event.ruleParameters || '{}');

  if (!ruleParams.AWSManagedPolicies && !ruleParams.CustomerManagedPolicies) {
    throw new Error('Either "AWSManagedPolicies" or "CustomerManagedPolicies" are required');
  }

  const evaluation = await evaluateCompliance({ configurationItem, ruleParams });

  await client.send(new PutEvaluationsCommand({
    ResultToken: event.resultToken,
    Evaluations: [{
      ComplianceResourceId: configurationItem.resourceId,
      ComplianceResourceType: configurationItem.resourceType,
      ComplianceType: evaluation.complianceType,
      OrderingTimestamp: new Date(configurationItem.configurationItemCaptureTime),
      Annotation: evaluation.annotation,
    }],
  }));
};

async function evaluateCompliance(props) {
  const { configurationItem, ruleParams } = props;

  if (!configurationItem.configuration || !configurationItem.configuration.instanceProfileList ||
      configurationItem.configuration.instanceProfileList.length === 0) {
    return {
      complianceType: 'NOT_APPLICABLE',
      annotation: 'The IAM Role is not under any Instance Profile',
    };
  }

  const existingPolicyNames = configurationItem.configuration.attachedManagedPolicies.map(p => p.policyName);

  if (ruleParams.AWSManagedPolicies) {
    const requiredPolicies = ruleParams.AWSManagedPolicies.split(',');
    for (const policy of requiredPolicies) {
      if (policy && !existingPolicyNames.includes(policy.trim())) {
        return {
          complianceType: 'NON_COMPLIANT',
          annotation: 'The IAM Role is not having required policies attached ' + policy,
        };
      }
    }
  }

  return {
    complianceType: 'COMPLIANT',
    annotation: 'The resource is compliant',
  };
}
```

--------------------------------

### AWS Lambda: Custom Config Rule for EC2 Instance Profile Detection

Source: https://context7.com/aws-samples/landing-zone-accelerator-on-aws-for-healthcare/llms.txt

An AWS Lambda function written in JavaScript that acts as a custom AWS Config rule. It identifies EC2 instances lacking an IAM instance profile and can trigger automated remediation. The function uses the AWS SDK for JavaScript v3 and requires configuration to be deployed.

```javascript
const { ConfigServiceClient, PutEvaluationsCommand } = require("@aws-sdk/client-config-service");
const client = new ConfigServiceClient();

const APPLICABLE_RESOURCES = ['AWS::EC2::Instance'];

exports.handler = async function(event, context) {
  console.log(`Custom Rule for checking EC2 Instance IAM Profile attachment...`);
  const invokingEvent = JSON.parse(event.invokingEvent);
  const configurationItem = invokingEvent.configurationItem;

  const evaluation = await evaluateCompliance({ configurationItem });

  const payload = {
    ResultToken: event.resultToken,
    Evaluations: [{
      ComplianceResourceId: configurationItem.resourceId,
      ComplianceResourceType: configurationItem.resourceType,
      ComplianceType: evaluation.complianceType,
      OrderingTimestamp: new Date(configurationItem.configurationItemCaptureTime),
      Annotation: evaluation.annotation,
    }],
  };

  await client.send(new PutEvaluationsCommand(payload));
};

async function evaluateCompliance(props) {
  const { configurationItem } = props;

  if (!APPLICABLE_RESOURCES.includes(configurationItem.resourceType)) {
    return {
      complianceType: 'NOT_APPLICABLE',
      annotation: `The rule doesn't apply to resources of type ${configurationItem.resourceType}`,
    };
  }

  if (configurationItem.configuration && configurationItem.configuration.iamInstanceProfile) {
    return {
      complianceType: 'COMPLIANT',
      annotation: 'The resource is compliant',
    };
  }

  return {
    complianceType: 'NON_COMPLIANT',
    annotation: 'The EC2 instance has no IAM profile attached',
  };
}
```
Tokens:
Raw