CODEWITHSUNDEEP
amazon-web-servicesaws-cloudformation
Duncan F
Duncan F

Reputation: 21

Can AWS CloudFormation templates for AWS Inspector add an SNS Topic

I've created some CloudFormation templates to deploy Inspector Templates/Targets and associated Lambda functions that parse the outputs and deliver findings to Slack. Is it possible to include in the CF template for Inspector an SNS Topic association as is done when creating a template in the Inspector portal?

It is not an available parameter of AWS::Inspector::AssessmentTemplate. Is this something I will just have to add manually via the portal?

Upvotes: 2

Views: 1005

Answers (2)

Akash
Akash

Reputation: 256

This is how I did it. I used the cloud formation template to create the assessment target, assessment resource group, and assessment template. Also, included a cloudwatch event rule to trigger assessment runs on a weekly basis.

As of today, there is no support for adding an SNS Topic through the Inspector Assessment template cloud formation resource, I went through the boto3 API for event subscription. Refer the API here: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/inspector.html#Inspector.Client.subscribe_to_event

If you refer the above API Doc you will be able to develop a small python lambda function to subscribe your inspector assessment template to the SNS topic. Then call that lambda function using a custom resource as follows in the same template where the assessment template is provisioned or defined.

Custom resource would look something like below:

  SubscribeToEvent: 
   Type: "Custom::<whatever_name>"
   Version: "1.0"
   Properties: 
     ServiceToken: !GetAtt <Lambda function logical name>.Arn
     AssessmentTemplateArn: !GetAtt <Assessment template logical name>.Arn
     topicArn: !Sub arn:aws:sns:${AWS::Region}:${account number}:<Nameofthetopic>

If you are trying to refer a cross-account topic or a topic which exist in another account, in that case, you need to update the topic policy to grant publish topic permissions to AWS Inspector Account. To find the AWS Account numbers refer here : https://docs.aws.amazon.com/inspector/latest/userguide/inspector_assessments.html#sns-topic

Upvotes: 1

Sudharsan Sivasankaran
Sudharsan Sivasankaran

Reputation: 5897

I see the SNS option is available only in the UI and CLI/API, I guess the UI/CLI creates Cloudwatch Events rule for you in the background, you create your own rule using AWS::Events::Rule

Reference: Event Patterns

EventRule: 
  Type: "AWS::Events::Rule"
  Properties: 
    Description: "EventRule"
    EventPattern: 
      source: 
        - "aws.inspector"
      detail-type: 
        - "AWS API Call via CloudTrail"
      resources:
        - arn:aws:inspector:us-west-2:123456789012:target/0-nvgVhaxX/template/0-7sbz2Kz0
      detail:
        eventSource:
          - "inspector.amazonaws.com"
        eventName: 
          - "ASSESSMENT_RUN_COMPLETED"
    State: "ENABLED"
    Targets: 
      - arn:aws:sns:us-west-2:123456789012:exampletopic

Upvotes: 1

Related Questions