@richkang/cdk-construct-lambda-custom-config-rule

AWS Config Custom Lambda Rule: RDS Subnet Internet Route Detector

This AWS Config custom Lambda rule is designed to check whether an Amazon RDS subnet has an internet route in its associated route tables. The rule uses a Lambda function written in Node.js to evaluate the compliance of RDS subnets.

Lambda Function Structure

The Lambda function responsible for evaluating RDS subnets consists of the following components:

1. Lambda Function Code (rds_public_subnet_rule.ts): The Lambda function code is written in TypeScript and utilizes the AWS SDK to invoke services from AWS EC2, Amazon RDS and AWS Config. It parses the AWS Config event to determine the resource type (AWS::RDS::RDSInstance), retrieves the associated subnets and route tables, and checks if any of them have an internet route (0.0.0.0/0). The compliance result is then reported back to AWS Config.

2. Event Input (event: AWSConfig.Event): The Lambda function receives input from AWS Config, which includes information about the evaluated resource and the rule parameters, such as the route table IDs to check.

3. AWS SDK Integration (AWS from 'aws-sdk'): The function uses the AWS SDK to describe the RDS Instance, subnets, and route tables, subnets. This allows it to check for internet routes.

4. Compliance Reporting: Depending on the evaluation result, the Lambda function reports compliance as either 'COMPLIANT' or 'NON_COMPLIANT' to AWS Config. If the rule does not apply to the resource type, it reports 'NOT_APPLICABLE'.

Infrastructure Components

This AWS Config Custom Lambda Rule leverages AWS CDK (Cloud Development Kit) to define and deploy the necessary infrastructure components. The components include:

1. AWS CDK Construct (cdk-construct-lambda-config-custom-rule.ts): A CDK construct that deploys the Lambda function using NodejsFunction.

Usage

1. Creates a AWS CDK stack to instantiate the construct. Example of usage can be found in test/testApp.ts.

Prerequisites

• AWS CDK installed and configured.
• Appropriate IAM permissions to deploy AWS CDK stacks and create Lambda functions.

License

This project is licensed under the MIT License - see the LICENSE file for details.