secure-cdk

Security abstraction for AWS CDK library. Create AWS resources with best security practices applied for you.

Description

The purpose of this package is to enforce best security practices for AWS services. It uses AWS CDK under the hood to create resources and won't work without it.

You may find that some of the rules are too strict for your use cases, but you always have a possibility of explicitly overriding them. If you do that, you will get a warning that will remind you about the security violations.

Installation

npm i secure-cdk --save-dev

or

yarn add secure-cdk -D

Usage

S3 Bucket

By using SecureBucket class instead of the AWS's Bucket construct, you are getting the following properties set by default.

Property	Value	Description	AWS CDK Default
enforceSSL	true	Enforces SSL for requests.	false
publicReadAccess	false	Grants public read access to all objects in the bucket.	false
encryption	Encrypted (S3 managed)	The kind of server-side encryption to apply to this bucket.	Unencrypted

import { SecureBucket } from 'secure-cdk';

const mySiteBucket = new SecureBucket(this, 'my-bucket', {
  bucketName: 'my-bucket-name',
  websiteIndexDocument: 'index.html'
});

CloudFront Distribution

Security wrapper for Distribution construct.

Property	Value	Description	AWS CDK Default
minimumProtocolVersion	TLS_V1_2_2021	The minimum version of the SSL protocol that you want CloudFront to use for HTTPS connections.	TLS_V1_2_2021

createSecureBehavior is a function used to create preconfigured behaviors for CloudFront distributions.

Property	Value	Description	AWS CDK Default
viewerProtocolPolicy	HTTPS_ONLY	The protocol that viewers can use to access the files controlled by this behavior.	ALLOW_ALL

import { createSecureBehavior, SecureDistribution } from 'secure-cdk';

const distribution = new SecureDistribution(this, 'my-distribution', {
  defaultBehavior: createSecureBehavior({
    origin: new S3Origin(mySiteBucket)
  })
});

IAM Role (PolicyStatement)

Security wrapper for PolicyStatement construct. Does not set default properties, however warns when:

• * passed in actions property;
• <resource>:* passed in actions property;
• * passed in resources property;
• .addResources called with *;
• .addActions called with * or <resource>:*;

import { Effect } from '@aws-cdk/aws-iam';
import { SecurePolicyStatement } from 'secure-cdk';

const policyStatement = new SecurePolicyStatement(this, 'my-policy-statement', {
  actions: ['cloudfront:*'],
  resources: ['*'],
  effect: Effect.ALLOW
});
// or
policyStatement.addActions('*');
policyStatement.addResources('*');

TODO

• Alternative automatic checker (extensions of a Stack);
• Centralized warning system to awoid warning duplication;
• Inclusion of resource identifier in warning;