ProwlerEC2toS3withSSMandSQS.yaml

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  ProwlerOption:
    Type: String
    MaxLength: 128
    Description: Prolwer parameters
    Default: aws
  EmailAddress:
    Type: String
    MaxLength: 128
    Description: CHECK YOUR INBOX! - TO RECEIVE NOTIFICATIONS YOU MUST ACCEPT THE TOPIC SUBSCRIPTION BEFORE PROWLER COMPLETES - This is the Email address to send Notification When the Prowler Report is Ready
  LatestAmiId:
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64'
  InstanceType:
    Type: String
    Description: Choosing t2 micro to be frugal
    Default: t3.large
Resources:
  #S3 Bucket
  S3Bucket:
    Type: AWS::S3::Bucket
    Properties: 
      BucketEncryption:
          ServerSideEncryptionConfiguration:
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true 
        BlockPublicPolicy: true 
        IgnorePublicAcls: true 
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
        - Id: LoggingLifeCycle
          Status: Enabled
          ExpirationInDays: '365'
          NoncurrentVersionExpirationInDays: '365'
      NotificationConfiguration:
        TopicConfigurations:
          - Event: s3:ObjectCreated:Put
            Topic: !Ref MySNSTopic

  S3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !GetAtt ProwlerIAMRole.Arn
            Action: s3:PutObject
            Resource: !Sub "arn:${AWS::Partition}:s3:::${S3Bucket}/*"
          - Sid: Deny non-HTTPS access
            Effect: Deny
            Principal: "*"
            Action: s3:*
            Resource:
              - !Sub "arn:${AWS::Partition}:s3:::${S3Bucket}"
              - !Sub "arn:${AWS::Partition}:s3:::${S3Bucket}/*"
            Condition:
              Bool:
                aws:SecureTransport: "false"
  # Internet Gateway
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: InterntGateway
  # Internet Gateway Attachment
  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  # Elastic IP for Nat Gateway
  NatGatewayEIP:
    DependsOn: InternetGatewayAttachment
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: EIP for NAT Gateway
  # Nat Gateway
  NatGateway:
    Type: AWS::EC2::NatGateway
    Properties: 
      AllocationId: 
        Fn::GetAtt:
          - NatGatewayEIP
          - AllocationId
      SubnetId: !Ref PublicSubnet
      Tags: 
        - Key: Name
          Value: NatGateway
  # Public Route Table 
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: PublicRoutes
  # Default Public Route
  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  # Private Route Table
  PrivateRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: Private Route Table
  # Default Private Route
  DefaultPrivateRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway
  #RouteTableAssociation
  ProwlerSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PrivateRouteTable
      SubnetId: !Ref ProwlerSubnet
 #RouteTableAssociation
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet
  # VPC
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
      - Key: Name
        Value: VPC
  # Subnet Public
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.0.0/24
      AvailabilityZone: !Select [ 0, !GetAZs ]    # Get the first AZ in the list 
      Tags:
      - Key: Name
        Value: Public Subnet
  # Subnet Private
  ProwlerSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [ 0, !GetAZs ]    # Get the first AZ in the list 
      MapPublicIpOnLaunch: False
      Tags:
      - Key: Name
        Value: ProwlerSubnet  
# EC2 Instances
  LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        MetadataOptions:
          HttpTokens: required

  ProwlerStation:
    Type: 'AWS::EC2::Instance'
    DependsOn: 
      - NatGateway
      - InternetGateway
    Properties:
      LaunchTemplate:
        LaunchTemplateId:
          Ref: LaunchTemplate
        Version: "1"
      Monitoring: true
      UserData:
        Fn::Base64:
          Fn::Sub:
            - |
              #!/bin/bash -x
              sudo dnf upgrade -y
              cd /home/ec2-user
              sudo dnf install -y jq git pip openssl-devel bzip2-devel libffi-devel gcc git zlib-devel
              sudo yum remove awscli -y
              curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
              unzip awscliv2.zip
              sudo ./aws/install --bin-dir /usr/local/bin --install-dir /usr/local/aws-cli --update
              pip install prowler
              mkdir prowler
              cd prowler
              #the next line is needed or prowler execution will fail with a: No such file or directory
              mkdir output
              prowler ${prowler_options} >> ./output/prowler.log
              zip -r prowler.zip output/
              aws s3 cp ./prowler.zip s3://${bucket_name}
              sudo shutdown -h now
            - bucket_name: !Ref S3Bucket
              prowler_options: !Ref ProwlerOption
      IamInstanceProfile: !Ref ProwlerProfile
      ImageId: !Ref LatestAmiId
      InstanceType: !Ref InstanceType
      SecurityGroupIds: 
        - !Ref ProwlerSG
      SubnetId: !Ref ProwlerSubnet
      Tags:
        - Key: Name
          Value: ProwlerStation
  #Security Groups
  ProwlerSG:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: !Ref VPC
      GroupDescription: No Inbound SG
      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0
        Description: Allow all HTTPS outbound traffic to enable prowler scan.
      Tags:
        - Key: Name
          Value: ProwlerSG
# IAM
  ProwlerIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - arn:aws:iam::aws:policy/SecurityAudit
        - arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
      Policies: 
        - PolicyName: ProwlerExecRoleAdditionalViewPrivileges
          PolicyDocument:
            Version : '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
                - account:Get*
                - apigateway:GET
                - appstream:Describe*
                - appstream:List*
                - backup:List*
                - cloudtrail:GetInsightSelectors
                - codeartifact:List*
                - codebuild:BatchGet*
                - codebuild:ListReportGroups
                - cognito-idp:GetUserPoolMfaConfig
                - dlm:Get*
                - drs:Describe*
                - ds:Get*
                - ds:Describe*
                - ds:List*
                - dynamodb:GetResourcePolicy
                - ec2:GetEbsEncryptionByDefault
                - ec2:GetSnapshotBlockPublicAccessState
                - ec2:GetInstanceMetadataDefaults
                - ecr:Describe*
                - ecr:GetRegistryScanningConfiguration
                - elasticfilesystem:DescribeBackupPolicy
                - glue:GetConnections
                - glue:GetSecurityConfiguration*
                - glue:SearchTables
                - lambda:GetFunction*
                - logs:FilterLogEvents
                - lightsail:GetRelationalDatabases
                - macie2:GetMacieSession
                - macie2:GetAutomatedDiscoveryConfiguration
                - s3:GetAccountPublicAccessBlock
                - shield:DescribeProtection
                - shield:GetSubscriptionState
                - securityhub:BatchImportFindings
                - securityhub:GetFindings
                - ssm:GetDocument
                - ssm-incidents:List*
                - support:Describe*
                - tag:GetTagKeys
                - wellarchitected:List*
              Resource: '*'
        - PolicyName: ProwlerCopyToS3
          PolicyDocument:
            Version : '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
                - "s3:PutObject"
              Resource: !Join
                - ''
                - - 'arn:aws:s3:::'
                  - !Ref S3Bucket
                  - /*
  ProwlerProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref ProwlerIAMRole
  #SNS
  MySNSTopic:
    Type: AWS::SNS::Topic
  MySNSSubscription:
    Type: AWS::SNS::Subscription
    Properties: 
      Protocol: email
      Endpoint: !Ref EmailAddress
      TopicArn: !Ref MySNSTopic
  MySNSTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties: 
      PolicyDocument:
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "s3.amazonaws.com"
                    },
                    "Action": [
                        "SNS:Publish"
                    ],
                    "Resource": {
                      "Ref": "MySNSTopic"
                    }
                }
            ]
        }     
      Topics: 
        - !Ref MySNSTopic