aws-resource-remediation/src/remediators/ElasticSearchRemediator.js

A module to remediate AWS resources.

/**
 * Created by Sunday on 03/14/2017.
 */

const AWS = require('aws-sdk');
const constants = require('../constants');
var logger = require('node-generic-logger');


function ElasticSearchRemediator(es) {
    this.es = es;
}

ElasticSearchRemediator.prototype.removePublicAccess=function(invocation, context, lastResult , cb){
	var self= this;
	if (this.es == null) {
        var awscreds = {
            accessKeyId: invocation['aws.credentials.accessKeyId'],
            secretAccessKey: invocation['aws.credentials.secretAccessKey'],
            region: invocation['region']
        };
		this.es = new AWS.ES({accessKeyId: awscreds.accessKeyId, secretAccessKey: awscreds.secretAccessKey, region: awscreds.region});
    }
	resourceSplit = context.resourceId.split(":");
	var id = resourceSplit[0];
	var domainName = resourceSplit[resourceSplit.length-1];
	this.es.describeElasticsearchDomainConfig({DomainName:domainName}, function(err, data) {
		if (err) {
			logger.error('Failed to run describeElasticsearchDomainConfig : ' + err.stack);
			cb(err);
		} else {
			logger.debug('For each Domain : '+domainName);
			if(data.DomainConfig.AccessPolicies.Options){
				var option = JSON.parse(data.DomainConfig.AccessPolicies.Options);
				var i = 0;
				var compliantStatus =false;
				option.Statement.forEach(function(Statement){
					if ( Statement.Effect == "Allow"  &&  Statement.Principal.AWS == "*" ){
						var used_ARN="arn:aws:iam::"+id+":root";
						option.Statement[i].Principal.AWS= used_ARN;
						logger.debug('Domain having non-compliant entry : '+domainName);
						compliantStatus =true
					}
					i++;
				});
				if(compliantStatus){
					var updatePparams = {
						DomainName: domainName,
						AccessPolicies: JSON.stringify(option)
					};
					self.es.updateElasticsearchDomainConfig(updatePparams, function(err, data) {
						if(err) {
							logger.error('Failed to run updateElasticsearchDomainConfig : ' + err.stack);
							return cb(err);
						}
						logger.info('Remediation done for : '+domainName);
						return cb(null, data);
					});
				} else {
					return cb(null, {message:"Already remediated"});
				}
			}
		}
	});

}

module.exports = ElasticSearchRemediator;