implementing-aws-config-rules-for-compliance

Name: implementing-aws-config-rules-for-compliance
Author: mukul975

github.com/mukul975安全35.2k55 次安装8 周前更新

代码仓库

关于 implementing-aws-config-rules-for-compliance

面向 AWS 云安全和合规团队的 AWS Config 规则实施指南，说明如何持续评估资源配置、自动修复违规项，并汇总多账户合规数据。

主要功能

01部署托管合规规则
02用 Lambda 创建自定义规则
03配置自动修复
04跨账户和区域汇总数据
05通过 StackSets 部署规则

适用场景

01持续监控 AWS 资源合规性
02检测并修复配置偏差
03汇总 AWS Organizations 中的合规状态
04为审计提供持续合规证据

安装

复制下面的命令，在终端中运行。

npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill implementing-aws-config-rules-for-compliance

安装后在 Claude Code 中输入/implementing-aws-config-rules-for-compliance确认已加载。

包含的文件

除 SKILL.md 外，安装时一起下载的参考资料和脚本。

LICENSE

references/

api-reference.md

scripts/

agent.py

详细介绍

为合规性实施 AWS Config 规则

何时使用

当需要针对监管标准对 AWS 资源建立持续合规监控时
当需要实现配置漂移的自动检测和修复时
当需要使用 AWS Organizations 跨多个 AWS 账户构建合规仪表板时
当审计团队要求持续合规的证据而非时间点评估时
当需要部署能在资源创建后几分钟内检测出不合规资源的防护机制时

不要使用于实时威胁检测（请使用 GuardDuty）、应用程序漏洞扫描（请使用 Inspector），或一次性合规评估（请使用 Prowler 进行更快的临时审计）。

前提条件

在所有目标账户和区域中启用 AWS Config 记录
具有 config:*、ssm:* 和 lambda:* 权限的 IAM 角色，用于规则管理
具有 Config 聚合委托管理员的 AWS Organizations
用于 Config 交付渠道的 S3 存储桶和用于通知的 SNS 主题
用于多账户规则部署的 CloudFormation StackSets 或 Terraform

工作流

步骤 1：启用 AWS Config 记录

在每个目标账户中设置 Config 记录器和交付渠道。

# Create S3 bucket for Config data
aws s3api create-bucket \
  --bucket config-compliance-data-ACCOUNT_ID \
  --region us-east-1

# Create Config service role
aws iam create-service-linked-role --aws-service-name config.amazonaws.com

# Start the Config recorder
aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=arn:aws:iam::ACCOUNT:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig \
  --recording-group allSupported=true,includeGlobalResourceTypes=true

# Set up delivery channel
aws configservice put-delivery-channel \
  --delivery-channel '{
    "name": "default",
    "s3BucketName": "config-compliance-data-ACCOUNT_ID",
    "snsTopicARN": "arn:aws:sns:us-east-1:ACCOUNT:config-notifications",
    "configSnapshotDeliveryProperties": {"deliveryFrequency": "TwentyFour_Hours"}
  }'

# Start recording
aws configservice start-configuration-recorder --configuration-recorder-name default

步骤 2：为 CIS 合规部署托管 Config 规则

启用映射到 CIS AWS Foundations Benchmark 控制项的 AWS 托管 Config 规则。

# S3 bucket security rules
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "Source": {"Owner": "AWS", "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"}
}'

aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-bucket-server-side-encryption-enabled",
  "Source": {"Owner": "AWS", "SourceIdentifier": "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"}
}'

aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-bucket-ssl-requests-only",
  "Source": {"Owner": "AWS", "SourceIdentifier": "S3_BUCKET_SSL_REQUESTS_ONLY"}
}'

# IAM security rules
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "iam-root-access-key-check",
  "Source": {"Owner": "AWS", "SourceIdentifier": "IAM_ROOT_ACCESS_KEY_CHECK"}
}'

aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "mfa-enabled-for-iam-console-access",
  "Source": {"Owner": "AWS", "SourceIdentifier": "MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS"}
}'

aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "iam-password-policy",
  "Source": {"Owner": "AWS", "SourceIdentifier": "IAM_PASSWORD_POLICY"},
  "InputParameters": "{\"RequireUppercaseCharacters\":\"true\",\"RequireLowercaseCharacters\":\"true\",\"RequireSymbols\":\"true\",\"RequireNumbers\":\"true\",\"MinimumPasswordLength\":\"14\"}"
}'

# Network security rules
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "restricted-ssh",
  "Source": {"Owner": "AWS", "SourceIdentifier": "INCOMING_SSH_DISABLED"}
}'

aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "vpc-flow-logs-enabled",
  "Source": {"Owner": "AWS", "SourceIdentifier": "VPC_FLOW_LOGS_ENABLED"}
}'

# Encryption rules
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "rds-storage-encrypted",
  "Source": {"Owner": "AWS", "SourceIdentifier": "RDS_STORAGE_ENCRYPTED"}
}'

aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "encrypted-volumes",
  "Source": {"Owner": "AWS", "SourceIdentifier": "ENCRYPTED_VOLUMES"}
}'

步骤 3：使用 Lambda 创建自定义 Config 规则

为组织特定的合规要求构建自定义规则。

# custom_config_rule.py - Ensure EC2 instances have required tags
import json
import boto3

config = boto3.client('config')

REQUIRED_TAGS = ['Environment', 'Owner', 'CostCenter', 'Project']

def lambda_handler(event, context):
    invoking_event = json.loads(event['invokingEvent'])
    configuration_item = invoking_event.get('configurationItem', {})

    if configuration_item['resourceType'] != 'AWS::EC2::Instance':
        return

    tags = {t['key']: t['value'] for t in configuration_item.get('tags', [])}
    missing_tags = [tag for tag in REQUIRED_TAGS if tag not in tags]

    if missing_tags:
        compliance = 'NON_COMPLIANT'
        annotation = f"Missing required tags: {', '.join(missing_tags)}"
    else:
        compliance = 'COMPLIANT'
        annotation = 'All required tags present'

    config.put_evaluations(
        Evaluations=[{
            'ComplianceResourceType': configuration_item['resourceType'],
            'ComplianceResourceId': configuration_item['resourceId'],
            'ComplianceType': compliance,
            'Annotation': annotation,
            'OrderingTimestamp': configuration_item['configurationItemCaptureTime']
        }],
        ResultToken=event['resultToken']
    )

# Deploy the custom rule
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "ec2-required-tags",
  "Source": {
    "Owner": "CUSTOM_LAMBDA",
    "SourceIdentifier": "arn:aws:lambda:us-east-1:ACCOUNT:function:config-required-tags",
    "SourceDetails": [{
      "EventSource": "aws.config",
      "MessageType": "ConfigurationItemChangeNotification"
    }]
  },
  "Scope": {"ComplianceResourceTypes": ["AWS::EC2::Instance"]}
}'

步骤 4：配置自动修复

为不合规资源的自动修复设置 SSM Automation 文档。

# Auto-remediate public S3 buckets
aws configservice put-remediation-configurations --remediation-configurations '[{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "TargetType": "SSM_DOCUMENT",
  "TargetId": "AWS-DisableS3BucketPublicReadWrite",
  "Parameters": {
    "S3BucketName": {"ResourceValue": {"Value": "RESOURCE_ID"}},
    "AutomationAssumeRole": {"StaticValue": {"Values": ["arn:aws:iam::ACCOUNT:role/ConfigRemediationRole"]}}
  },
  "Automatic": true,
  "MaximumAutomaticAttempts": 3,
  "RetryAttemptSeconds": 60
}]'

# Auto-remediate unencrypted EBS volumes
aws configservice put-remediation-configurations --remediation-configurations '[{
  "ConfigRuleName": "encrypted-volumes",
  "TargetType": "SSM_DOCUMENT",
  "TargetId": "AWS-EnableEBSEncryptionByDefault",
  "Parameters": {
    "AutomationAssumeRole": {"StaticValue": {"Values": ["arn:aws:iam::ACCOUNT:role/ConfigRemediationRole"]}}
  },
  "Automatic": true,
  "MaximumAutomaticAttempts": 1,
  "RetryAttemptSeconds": 300
}]'

# Auto-remediate security groups allowing SSH from 0.0.0.0/0
aws configservice put-remediation-configurations --remediation-configurations '[{
  "ConfigRuleName": "restricted-ssh",
  "TargetType": "SSM_DOCUMENT",
  "TargetId": "AWS-DisablePublicAccessForSecurityGroup",
  "Parameters": {
    "GroupId": {"ResourceValue": {"Value": "RESOURCE_ID"}},
    "AutomationAssumeRole": {"StaticValue": {"Values": ["arn:aws:iam::ACCOUNT:role/ConfigRemediationRole"]}}
  },
  "Automatic": true,
  "MaximumAutomaticAttempts": 3,
  "RetryAttemptSeconds": 60
}]'

步骤 5：设置多账户聚合

将所有组织账户的合规数据聚合到集中视图中。

# Create a Config aggregator for the organization
aws configservice put-configuration-aggregator \
  --configuration-aggregator-name org-compliance-aggregator \
  --organization-aggregation-source '{
    "RoleArn": "arn:aws:iam::ACCOUNT:role/ConfigAggregatorRole",
    "AllAwsRegions": true
  }'

# Query aggregate compliance across all accounts
aws configservice get-aggregate-compliance-details-by-config-rule \
  --configuration-aggregator-name org-compliance-aggregator \
  --config-rule-name s3-bucket-public-read-prohibited \
  --compliance-type NON_COMPLIANT \
  --query 'AggregateEvaluationResults[*].[AccountId,AwsRegion,EvaluationResultIdentifier.EvaluationResultQualifier.ResourceId,ComplianceType]' \
  --output table

# Get compliance summary by account
aws configservice get-aggregate-compliance-summary-by-source \
  --configuration-aggregator-name org-compliance-aggregator \
  --query 'AggregateComplianceCounts[*].[GroupName,ComplianceSummary.CompliantResourceCount.CappedCount,ComplianceSummary.NonCompliantResourceCount.CappedCount]' \
  --output table

关键概念

术语	定义
AWS Config 规则	一种合规检查，用于评估 AWS 资源配置是否满足指定要求，可以持续进行或按计划进行
托管规则	AWS 提供的预构建 Config 规则，具有标准化逻辑，用于加密和公共访问等常见合规检查
自定义规则	由 Lambda 函数支持的组织特定 Config 规则，用于评估自定义合规逻辑
修复操作	触发的 SSM Automation 文档或 Lambda 函数，用于自动修复不合规资源
配置聚合器	AWS Config 功能，将多个账户和区域的合规数据收集到集中视图中
合规包	打包为可部署单元的 Config 规则和修复操作集合，用于特定合规框架

工具与系统

AWS Config：针对 AWS 资源的持续配置记录和合规评估服务
SSM Automation：用于对不合规资源执行自动修复操作的 AWS Systems Manager 文档
Config 合规包：用于 CIS、PCI DSS、NIST 800-53 和 HIPAA 合规的预构建规则集合
CloudFormation StackSets：跨 AWS Organizations 的 Config 规则多账户部署机制
Config 聚合器：跨账户和跨区域的合规数据整合

常见场景

场景：跨 30 个 AWS 账户部署 CIS 合规监控

背景：一家金融服务公司需要在其年度 SOC 2 审计中，展示全部 30 个生产账户持续符合 CIS AWS Foundations Benchmark 的情况。

方法：

通过 CloudFormation StackSets 在所有账户中启用 AWS Config 记录
使用 StackSets 将 CIS 合规包部署到所有账户
在安全账户中设置 Config 聚合器，以实现组织范围内的可见性
为可安全修复的规则配置自动修复（公开的 S3、未加密的卷）
创建 EventBridge 规则，在新的 NON_COMPLIANT 评估结果出现时发出告警
构建每周合规报告，汇总所有账户的评分
将 Config 快照存储在 S3 中，并配置生命周期策略以用于审计留存

陷阱：Config 记录会按记录的每个配置项产生费用。在资源众多的账户中，费用可能相当可观。使用目标记录组，专注于与合规相关的资源类型，而不是记录所有资源。如果网络规则（安全组）原本就是有意放宽的，对其自动修复可能会中断应用程序。

输出格式

AWS Config Compliance Report
===============================
Organization: Acme Financial (30 accounts)
Framework: CIS AWS Foundations 1.4
Report Date: 2026-02-23
Config Rules Active: 48

COMPLIANCE SUMMARY:
  Overall Compliance: 87%
  Compliant Resources:     4,234
  Non-Compliant Resources:   612
  Not Applicable:            189

TOP NON-COMPLIANT RULES:
  encrypted-volumes:              89 resources (14 accounts)
  vpc-flow-logs-enabled:          67 resources (12 accounts)
  mfa-enabled-for-iam-console:    45 resources (8 accounts)
  s3-bucket-ssl-requests-only:    34 resources (6 accounts)
  restricted-ssh:                 28 resources (5 accounts)

AUTO-REMEDIATION (Last 30 Days):
  Public S3 buckets remediated:    12
  Security groups restricted:       8
  EBS default encryption enabled:   6
  Total auto-remediated:           26
  Failed remediation attempts:      3

ACCOUNT COMPLIANCE RANKING:
  1. prod-core (account-001):     96% compliant
  2. prod-data (account-002):     94% compliant
  ...
  30. dev-sandbox (account-030):  68% compliant

支持 Markdown

登录后评论

基本信息

作者: mukul975
仓库: mukul975/anthropic-cybersecurity-skills
分类: 安全
安装次数: 55
GitHub Stars: 35,191

报告问题