hacktricks-cloud/src/pentesting-cloud/aws-security/aws-services/aws-security-and-detection-services/aws-config-enum.md

AWS - Config Enum

{{#include ../../../../banners/hacktricks-training.md}}

AWS Config

AWS Config huchukua mabadiliko ya resource, hivyo mabadiliko yoyote kwa resource inayoungwa mkono na Config yanaweza kurekodiwa, ambayo itarekodi kilichobadilika pamoja na metadata nyingine muhimu, vyote vikihifadhiwa ndani ya faili linalojulikana kama configuration item, CI. Service hii ni maalum kwa region.

A configuration item au CI kama inavyojulikana, ni sehemu muhimu ya AWS Config. Inajumuisha faili la JSON ambalo huhifadhi configuration information, relationship information na metadata nyingine kama snapshot ya point-in-time ya resource inayoungwa mkono. Taarifa zote ambazo AWS Config inaweza kurekodi kwa resource hukamatwa ndani ya CI. CI huundwa kila mara resource inayoungwa mkono inapopata mabadiliko kwenye configuration yake kwa namna yoyote. Mbali na kurekodi maelezo ya resource iliyoathirika, AWS Config pia itarekodi CIs kwa resources zozote zilizo na uhusiano wa moja kwa moja ili kuhakikisha mabadiliko hayakuathiri hizo resources pia.

• Metadata: Ina maelezo kuhusu configuration item yenyewe. Version ID na configuration ID, ambavyo hutambulisha CI kwa kipekee. Taarifa nyingine zinaweza kujumuisha MD5Hash inayokuwezesha kulinganisha CIs nyingine zilizorekodiwa tayari dhidi ya resource hiyo hiyo.
• Attributes: Hii huhifadhi taarifa za kawaida za attribute dhidi ya resource halisi. Ndani ya sehemu hii, pia tuna unique resource ID, na key value tags zozote zilizounganishwa na resource. Resource type pia huorodheshwa. Kwa mfano, ikiwa hiki kingekuwa CI cha EC2 instance, resource types zilizoorodheshwa zinaweza kuwa network interface, au elastic IP address ya EC2 instance hiyo
• Relationships: Hii huhifadhi taarifa kwa relationship yoyote iliyounganishwa ambayo resource inaweza kuwa nayo. Hivyo ndani ya sehemu hii, ingeonyesha maelezo wazi ya relationship yoyote na resources nyingine ambayo resource hii ilikuwa nayo. Kwa mfano, ikiwa CI kilikuwa cha EC2 instance, sehemu ya relationship inaweza kuonyesha muunganisho kwa VPC pamoja na subnet ambamo EC2 instance inapatikana.
• Current configuration: Hii itaonyesha taarifa zilezile ambazo zingeundwa ikiwa ungefanya describe au list API call iliyofanywa na AWS CLI. AWS Config hutumia API calls zilezile kupata taarifa zilezile.
• Related events: Hii inahusiana na AWS CloudTrail. Hii itaonyesha AWS CloudTrail event ID ambayo inahusiana na mabadiliko yaliyosababisha kuundwa kwa CI hiki. Kuna CI jipya linaloundwa kwa kila mabadiliko yanayofanywa dhidi ya resource. Matokeo yake, different CloudTrail event IDs zitaundwa.

Configuration History: Inawezekana kupata configuration history ya resources kwa msaada wa configurations items. Configuration history hutolewa kila baada ya masaa 6 na inajumuisha CI's zote kwa resource type fulani.

Configuration Streams: Configuration items hutumwa kwa SNS Topic ili kuwezesha uchambuzi wa data.

Configuration Snapshots: Configuration items hutumiwa kuunda point in time snapshot ya resources zote zinazoungwa mkono.

S3 is used to store Configuration History files na Configuration snapshots zozote za data yako ndani ya bucket moja, ambayo inafafanuliwa ndani ya Configuration recorder. Ikiwa una AWS accounts nyingi unaweza kutaka kujumlisha configuration history files zako kwenye bucket moja ya S3 kwa primary account yako. Hata hivyo, utahitaji kutoa write access kwa service principle hii, config.amazonaws.com, na secondary accounts zako zenye write access kwa S3 bucket katika primary account yako.

Functioning

• When make changes, for example to security group or bucket access control list —> fire off as an Event picked up by AWS Config
• Stores everything in S3 bucket
• Depending on the setup, as soon as something changes it could trigger a lambda function OR schedule lambda function to periodically look through the AWS Config settings
• Lambda feeds back to Config
• If rule has been broken, Config fires up an SNS

Config Rules

Config rules are a great way to help you enforce specific compliance checks and controls across your resources, and allows you to adopt an ideal deployment specification for each of your resource types. Each rule is essentially a lambda function that when called upon evaluates the resource and carries out some simple logic to determine the compliance result with the rule. Each time a change is made to one of your supported resources, AWS Config will check the compliance against any config rules that you have in place.
AWS have a number of predefined rules that fall under the security umbrella that are ready to use. For example, Rds-storage-encrypted. This checks whether storage encryption is activated by your RDS database instances. Encrypted-volumes. This checks to see if any EBS volumes that have an attached state are encrypted.

• AWS Managed rules: Set of predefined rules that cover a lot of best practices, so it's always worth browsing these rules first before setting up your own as there is a chance that the rule may already exist.
• Custom rules: You can create your own rules to check specific customconfigurations.

Limit of 50 config rules per region before you need to contact AWS for an increase.
Non compliant results are NOT deleted.

{{#include ../../../../banners/hacktricks-training.md}}