Auditing Resource Compliance with AWS config

Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​

Overview

​

Lab details

1. This lab walks you through the steps to deploy Auditing Resource Compliance with AWS config
2. You will practice it using AWS config
3. Duration : 45 Minutes
4. AWS Region: US East (N. Virginia)

​

Introduction

​

AWS config

• AWS config is a service that enables you to audit and evaluate the configuration of your AWS resource.
• It continuously able to monitor and record your AWS resource configuration and provides you alert whenever there is change in your configuration.
• It will also automatically deliver a configuration history file to the Amazon S3 bucket you specify conformance packs help you manage compliance of your AWS resource configuration
• It will send you Mail using SNS topic for the update or change in AWS config Rule.

​

Architecture Diagram :

​

Lab task

1. First setup AWS config.
2. Create an EC2 server with the desired security group.
3. Create config rule in AWS config to add configuration.
4. Create and subscribe SNS topic and verify email ID
5. Monitoring the complaint status in Conformance packs and verify mail complaints
6. Validation Of The Lab

​

Summary of Lab session:

1. You will be provided with an EC2 server named Config_server followed by some random number.
2. EC2 server will be attached with config_server_SG security group with ports 22 and 80 allowed to handle the traffic
3. Creating AWS config rule in AWS config dashboard.
4. Creating and subscribing to SNS topic.
5. Modifying the security group config_server_SG to add some custom or new port range.
6. Checking for AWS non compliance resource in AWS config dashboard.
7. Getting Alert from AWS regarding founding non compliance resource in AWS config.
8. Reverting the changes by removing the custom or new port added to the security group.
9. AWS will send Alert that the resources are under compliance.

​

Launching the lab environment

1. To launch the lab environment, Click on the Launch lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.

Note : You can only start one lab at any given time

​

Lab guide

​

Lab steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
   • Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
   • Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

​

Task 2: Create S3 and SNS

1. Click on services and type config and navigate to AWS Config dashboard.
2. Make sure you are in the N.Virginia Region.
3. Click on Get Started.
4. Now complete the settings using below details

• Recording strategy:
  • Select : All resource types with customizable overrides
  • Keep rest things as default

• Delivery Method:
  • Select the Create a bucket and enter your bucket name.
  • Bucket name : Enter Unique bucket name ( Ex: whizlabs34567)
• Amazon SNS topic:
  • Check the box Stream configuration changes and then configure the SNS topic
  • Select the Create a Topic
  • Topic name : config_for_securitygroup_change

• Click on Next button.

5. In the next screen, leave as default and then click on Next.
6. Finally, review your config setup and click on Confirm. It will take a few seconds to complete the config rule setup.

​

Task 3: Setting of AWS config Rules

1. Go to AWS Config Dashboard in the left panel.
2. Click on Rules under conformance packs.
3. Then click on Add rule on the right top.

4. Configure Rule type using below details

• Select rule type:
  • Select Add AWS managed rule
• AWS Managed Rules:
  • Type sg in the filter box and then select vpc-sg-open-only-to-authorized-ports as shown in the below screenshot.

5. Once provided the above details click on Next.
6. In the next screen customize the rule with the below details

• Name : SgauthorizingRule
• Description : Leave default

7. Trigger:

• Scope of changes: select Resources

8. Resources: Leave the default AWS EC2 SecurityGroup.
9. Parameters: select the ports you need to add in the rule. In your existing security group you will be added with the ports 22 and 80.

• In case of adding a new rule, you can click on Add another row.

10. After providing above details, click on Next.
11. Finally Click on Save.
12. It will take 4 to 5 minutes for the rule to become available.

​

Task 4: Creating and subscribe SNS topic

1. Click on services and navigate to Simple Notification Service.
2. Click on Topics in the left panel.
3. Click on the config rule i.e, config_for_securitygroup_change created in the earlier step.
4. Click on Create Subscription in the right bottom.
5. Complete the subscription using below details

• Topic ARN : Leave Default
• Protocol : Select Email in the drop down.
• Endpoint : Enter the Email address for subscription ( ex: test@gmail.com)
• Finally click on Create Subscription .

6. Now go to the Inbox of the email provided in the above step and click on confirm subscription to get the alerts as shown below

​

Task 5: Checking the status of AWS config

1. To check the status of your config rule navigate to AWS config dashboard.
2. Click on Rules under conformance packs and click on the rule create by you.
3. Now, scroll down to the Resources in scope and select Compliant in filter, and you will see one security group with Compliant status.

4. Thus the above screenshot states that the ports opened in the Security group attached with our running instance satisfy the rule given in the config.

​

Task 6: Testing the working of AWS config

1. Now click on Services and then navigate to the EC2 dashboard.
2. Click on Security Groups and select the security group named Config_server_SG.
3. Click on Inbound rules and then Edit inbound rules to add some custom ports. ( Ex: 20-21)

4. Now add the new port with below details

• Type : Select Custom TCP
• Protocol : TCP
• Port Range : Enter 20-21
• Source : 0.0.0.0/0
• Click on Save rules.

5. Now navigate to AWS config dashboard and then click on Rules, wait for 1 or 2 minutes, and you could see the status of your rule as Noncompliant resource(s) as shown below

6. To check the detailed status, click on the SgauthorizingRule and scroll down a bit and then click on Resources in scope and then click on your security group ID of your noncompliant security group
7. In the next step click Resource Timeline in the right corner.
8. To confirm Alert via SNS topic, navigate to the inbox of the email provided at the time of creating SNS topic, and you could see the Alert email from AWS regarding change in your AWS config rule.

9. Now click on Services and then navigate to the EC2 dashboard and click on Security Groups and select the security group named Config_server_SG and remove the port number 20-21 from the security group and save.
10. Once removed navigate to AWS config dashboard and then click on rule, and you could see the status as Compliant.
11. Now navigate to the Inbox of your email and you could see AWS have sent the email that the rules are under complaint

​

Task 7 : Validation of the Lab

1. Once The Lab Steps Are Completed, Please Click On The Validation Button On The Left Side Panel.
2. This Will Validate The Resources In The AWS Account And Displays Whether You Have Completed This Lab Successfully Or Not.
3. Sample Output :

​

Completion and conclusion

1. You have successfully created the Config rule along with the SNS topic.
2. Modified the security group by adding custom port to get the alert from AWS regarding change in config rule.
3. Successfully tested the working of config rule.
4. Revert back the changes by removing the ports added to make the rule complaint.
5. Successfully received the email from AWS stating the AWS config rules with non compliant. resources.

​

End lab

1. Sign out from the AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps click on End lab in the IP Lab Portal

​

What gets checked

When you press Check my work, the platform verifies each of these:

• Create Private S3 bucket — Check whether a private S3 bucket is created or not
• Create an Amazon SNS Topic — Check If SNS Topic created or not
• AWS config rule — check whether AWS config rule is created or not

​

Related help

• FAQs and Troubleshooting