使用Cloudwach筛选模式查找具有cidrIp = "0.0.0.0/0“的安全组

Question

我想要创建一个Cloudwatch筛选模式，它是寻找安全组规则，每当有人创建它们时，它们都具有CIDR ="0.0.0.0/0“。

"eventName": "AuthorizeSecurityGroupIngress",
"awsRegion": "eu-central-1",
"userAgent": "EC2ConsoleFrontend, aws-internal/3 aws-sdk-java/1.12.150 Linux/5.4.172-100.336.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.322-b06 java/1.8.0_322 vendor/Oracle_Corporation cfg/retry-mode/standard",
"requestParameters": {
    "groupId": "sg-7f1ca612",
    "ipPermissions": {
        "items": [
            {
                "ipProtocol": "tcp",
                "fromPort": 389,
                "toPort": 389,
                "groups": {},
                "ipRanges": {
                    "items": [
                        {
                            "cidrIp": "0.0.0.0/0"
                        }
                    ]
                },
                "ipv6Ranges": {},
                "prefixListIds": {}
            },
            {
                "ipProtocol": "udp",
                "fromPort": 53,
                "toPort": 53,
                "groups": {},
                "ipRanges": {
                    "items": [
                        {
                            "cidrIp": "0.0.0.0/0"
                        }
                    ]
                },
                "ipv6Ranges": {},
                "prefixListIds": {}
            }
        ]
    }
},
"responseElements": {
    "requestId": "1dfe243d-24b3-47c2-acc1-12131f4feb40",
    "_return": true,
    "securityGroupRuleSet": {
        "items": [
            {
                "groupOwnerId": "030563857246",
                "groupId": "sg-7f1ca612",
                "securityGroupRuleId": "sgr-0811c8cc4768b7c30",
                "isEgress": false,
                "ipProtocol": "tcp",
                "fromPort": 389,
                "toPort": 389,
                "cidrIpv4": "0.0.0.0/0"
            },
            {
                "groupOwnerId": "030563857246",
                "groupId": "sg-7f1ca612",
                "securityGroupRuleId": "sgr-0a0527ecab37548b0",
                "isEgress": false,
                "ipProtocol": "udp",
                "fromPort": 53,
                "toPort": 53,
                "cidrIpv4": "0.0.0.0/0"
            }
        ]
    }
},

我尝试了下面的查询，但是它不正确，因为responseElements.securityGroupRuleSet.items列表可能有多个元素。

{(($.eventName=AuthorizeSecurityGroupIngress) && ($.responseElements.securityGroupRuleSet.items[0].cidrIpv4 = "0.0.0.0/0"))}

我试图将条目更改为items*，但是语法无效，您知道吗？

Answer 1

文档中提供的另一种方法是使用CloudTrail + EventBridge + SNS来实现您想要的结果。CloudTrail将记录所有帐户更改。事件桥将过滤这些更改，SNS将触发通知。

类似用例的示例实现如下所示：https://aws.amazon.com/premiumsupport/knowledge-center/monitor-security-group-changes-ec2/