aws-resource-remediation/src/remediators/S3Remediator.js

A module to remediate AWS resources.

/**
 * Created by Sunday on 03/14/2017.
 */

const AWS = require('aws-sdk');
const constants = require('../constants');
var logger = require('node-generic-logger');


function S3Remediator(s3) {
	this.s3 = s3;
}


S3Remediator.prototype.removeEveryoneAndAuthenticatedPermission=function(invocation, context, lastResult , cb){
	var self = this;
	if (this.s3 == null) {
		var awscreds = {
			accessKeyId: invocation['aws.credentials.accessKeyId'],
			secretAccessKey: invocation['aws.credentials.secretAccessKey'],
			region: invocation['region']
		};
		this.s3 = new AWS.S3({
			accessKeyId: awscreds.accessKeyId,
			secretAccessKey: awscreds.secretAccessKey,
			region: awscreds.region,
			signatureVersion:"v4"
		});
	}
	bucketSplit=context.resourceId.split(":");
	bucketName = bucketSplit[bucketSplit.length-1];
	this.s3.getBucketAcl({Bucket:bucketName}, function(err, data) {
		if (err) {
			logger.error('Failed to run getBucketAcl' + err.stack);
			cb(err);
		} else {
			logger.debug('Available grants:'+data.Grants);
			var i=0;
			var compliantStatus =0;
			data.Grants.forEach(function(grants){
				type=grants.Grantee.Type;
				if (type == "Group"){
					var URI=grants.Grantee.URI;
					if (URI == "http://acs.amazonaws.com/groups/global/AllUsers" || URI == "http://acs.amazonaws.com/groups/global/AuthenticatedUsers"){
						compliantStatus =1
						delete data.Grants[i]
					}
				}
				i++;
			});
			if( compliantStatus == 1 ){
				var putBucketAclParams = {
					Bucket : bucketName,
					AccessControlPolicy  : data
				};
				logger.debug('Grants set for remediation:'+putBucketAclParams.AccessControlPolicy.Grants);
				self.s3.putBucketAcl(putBucketAclParams, function(err, data) {
					if (err) {
						logger.error('Failed to run putBucketAcl' + err.stack);
						return cb(err);
					}
					logger.info('Remediation done for : '+bucketName);
					return cb(null, data);
				});
			} else {
				return cb(null, {message:"Already remediated."});
			}
		}
	});
}

S3Remediator.prototype.enableLogging=function(invocation, context, lastResult , cb){
	var self= this;
	if (this.s3 == null) {
        var awscreds = {
            accessKeyId: invocation['aws.credentials.accessKeyId'],
            secretAccessKey: invocation['aws.credentials.secretAccessKey'],
            region: invocation['region']
        };
		this.s3 = new AWS.S3({accessKeyId: awscreds.accessKeyId, secretAccessKey: awscreds.secretAccessKey, region: awscreds.region});
    }
    var targetBucketName = invocation.payload['bucketName'];
	bucketSplit=context.resourceId.split(":");
	bucketName = bucketSplit[bucketSplit.length-1];
	var s3params = {
		Bucket: bucketName,
    	LoggingEnabled: {
        	TargetBucket: targetBucketName,
       	 	TargetPrefix: "logs/"
    	}
	};
	s3.putBucketLogging(s3params, function(err, data) {
		if (err) {
			logger.error('Failed to run putBucketLogging : ' + err.stack);
			return cb(err);
		}
		logger.info('Remediation(enableLogging) done for : '+bucketName);
		return cb(null, data);
	});
}

S3Remediator.prototype.checkAndCreate=function(invocation, context, lastResult , cb){
	var self= this;
	if (this.s3 == null) {
        var awscreds = {
            accessKeyId: invocation['aws.credentials.accessKeyId'],
            secretAccessKey: invocation['aws.credentials.secretAccessKey'],
            region: invocation['region']
        };
		this.s3 = new AWS.S3({accessKeyId: awscreds.accessKeyId, secretAccessKey: awscreds.secretAccessKey, region: awscreds.region});
    }
    var bucketName = invocation.payload['bucketName'];
	var bucketParams= {
		Bucket: bucketName
	};
	s3.getBucketAcl(bucketParams,function(err, data) {
    	if (!err) {
			logger.debug("bucket exist, no need to create");
			return cb(null, data);					
    	}
		else {
			if ( ! err.toString().includes("The specified bucket does not exist")){
     			logger.error('Failed to run getBucketAcl : ' + err.stack);
				return cb(err);
			}
			logger.debug("bucket does not exist, creating now...");
		}
		s3.createBucket(bucketParams, function(err, data) {
  			if (err) {
     			logger.error('Failed to run createBucket : ' + err.stack);
				return cb(err);
    		}
			logger.info('Remediation done for : '+bucketName);
            return cb(null, data);
     	});
    });
}
module.exports = S3Remediator;