qualys_cf_aws_connector.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: Template to automatically setup Qualys AWS Connector for Asset Scanning
Metadata:
  Author: "Sean Nicholson"
  Version: "1.3"
  Updated: "06/17/2019"
  Version Comments: "Added ability to create CloudView and AssetView AWS Connectors from the same CloudFormation Template. Initial release, based off https://github.com/snicholson-qualys/aws-ec2-cloudformation-connector"
Parameters:
  UserName:
    Default: <supply_Qualys_user_name>
    Description: User Authorized to Create a Qualys AWS Connector
    Type: String
  Password:
    Default: <supply_Qualys_user_password>
    Description: Password of the User Authorized to Create an Qualys AWS Connector
    Type: String
    NoEcho: true
  BaseUrl:
    Default: <supply_Qualys_CloudView_API_URL>
    Description: Base URL of the Qualys Cloud View API Server
    Type: String
  PortalBaseUrl:
    Default: <supply_Qualys_AssetView_API_URL>
    Description: Base URL of the Qualys Cloud View API Server
    Type: String
  ExternalId:
    Default: Empty
    Description: Specify a unique number from 9-90 digits, or one will be generated for you
    Type: String
  RoleName:
    Default: CF-QualysAWSConnectorRole
    Description: Name of the Role to Create
    Type: String
  AssetViewConnector:
    Default: "true"
    Description: Create AssetView Connector with same AWS ARN
    Type: String
    AllowedValues: [
      "true",
      "false"
    ]

Resources:
  ConnectorFunction:
    Type: AWS::Lambda::Function
    Properties:
      Environment:
        Variables:
          BASEURL: !Ref BaseUrl
          EXTERNALID: !Ref ExternalId
          USERNAME: !Ref UserName
          PASSWORD: !Ref Password
          ROLENAME: !Ref RoleName
          ASSETVIEWCONNECTOR: !Ref AssetViewConnector
      Code:
        ZipFile: !Sub |
          import json
          import traceback
          import os
          import urllib3
          import cfnresponse
          from random import randint
          import time
          import boto3

          def lambda_handler(event,context):
              EXTERNALID = os.getenv('EXTERNALID')
              ROLENAME = os.getenv('ROLENAME')
              dataConnectorId = 1 #setting variable type - variable set for logging
              qualysAccountId = 1 #setting variable type - account ID for trust relationship is set by create connector API response
              ASSETVIEWCONNECTOR = os.getenv('ASSETVIEWCONNECTOR')

              try:
                api_endpoint="{}/cloudview-api/rest/v1/aws/connectors".format(os.getenv('BASEURL'))
                ACCOUNT_ID = context.invoked_function_arn.split(":")[4]
                print("Create Asset View Connector: {}".format(ASSETVIEWCONNECTOR))
                client = boto3.client('iam')
                paginator = client.get_paginator('list_account_aliases')
                for response in paginator.paginate():
                  if 'AccountAliases' in response:
                    print(response['AccountAliases'])
                    accountName = str(response['AccountAliases'][0])
                  else:
                    accountName = ACCOUNT_ID


                EXTERNALID = randint(1000000000000000000,999999999999999999999999999999999) if EXTERNALID == "Empty" else EXTERNALID
                print("API_ENDPOINT: {}".format(api_endpoint))
                print("ACCOUNT_ID: {}".format(ACCOUNT_ID))
                print("EXTERNALID: {}".format(EXTERNALID))
                data= {
                    "arn":"arn:aws:iam::{}:role/{}".format(ACCOUNT_ID, ROLENAME),
                    "name":"{}".format(accountName),
                    "description": "Account Name: {0} AWS Account ID {1} - Implemented with CloudFormation".format(accountName, ACCOUNT_ID),
                    "externalId":"{}".format(EXTERNALID),
                    "isPortalConnector":"{}".format(ASSETVIEWCONNECTOR)
                    }

                auth=os.getenv('USERNAME')+":"+os.getenv('PASSWORD')
                headers = urllib3.make_headers(basic_auth=auth)
                print("DATA: {}".format(data))
                # print("AUTH: {}".format(auth))
                encoded_data = json.dumps(data).encode('utf-8')
                headers['X-Requested-With'] = 'Qualys CloudFormation (python)'
                headers['Accept'] = 'application/json'
                headers['Content-Type'] = 'application/json'
                http = urllib3.PoolManager()
                #r = requests.post(api_endpoint, json=data, auth=auth, headers=headers)
                r = http.request('POST', api_endpoint, body=encoded_data, headers=headers, timeout=180)
                print("Status: {}".format(r.status))
                data = json.loads(r.data.decode('utf-8'))


                responseData = {}
                if r.status == 200 or r.status == 201:
                  responseData['responseCode'] = r.status

                  if 'error' in data:
                    if data['error']:
                      responseData['responseErrorDetails'] = data['error']
                      cfnresponse.send(event, context, cfnresponse.FAILED, responseData)


                  if 'connectorId' in data:
                    dataConnectorId = data['connectorId']
                    if 'qualysAccountId' in data:
                      qualysAccountId = data['qualysAccountId']
                    print("ResponseData collection: {}".format(responseData))
                    callconnectorId = data['connectorId']



              except Exception as e:
                responseData = {}
                traceback.print_exc()
                print("Response - {}".format(e))
                responseData['responseErrorDetails'] = e
                cfnresponse.send(event, context, cfnresponse.FAILED, responseData)

              responseData['DataConnectorId'] = dataConnectorId
              responseData['AccountId'] = qualysAccountId
              responseData['ExternalId'] = EXTERNALID
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)

      Description: Lambda Function to Register Qualys AWS Connector and Create associated Role
      Handler: index.lambda_handler
      Role: !GetAtt 'LambdaExecutionRole.Arn'
      Runtime: python3.6
      Timeout: '300'
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
              - Effect: Allow
                Action:
                  - iam:CreateRole
                  - iam:ListAccountAliases
                Resource: '*'
  QualysConnectorRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: !GetAtt 'CustomResource.AccountId'
            Condition:
              StringEquals:
                sts:ExternalId: !GetAtt 'CustomResource.ExternalId'
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit

  ConnectorFunction2:
    DependsOn: QualysConnectorRole
    Type: AWS::Lambda::Function
    Properties:
      Environment:
        Variables:
          BASEURL: !Ref BaseUrl
          PORTALBASEURL: !Ref PortalBaseUrl
          USERNAME: !Ref UserName
          PASSWORD: !Ref Password
          CONNECTORID: !GetAtt 'CustomResource.DataConnectorId'
          ASSETVIEWCONNECTOR: !Ref AssetViewConnector

      Code:
        ZipFile: !Sub |
          import json
          import traceback
          import os
          import urllib3
          import cfnresponse


          def lambda_handler(event,context):
              CONNECTORID = os.getenv('CONNECTORID')
              PORTALBASEURL = os.getenv('PORTALBASEURL')
              ASSETVIEWCONNECTOR = os.getenv('ASSETVIEWCONNECTOR')
              responseData = {}

              try:
                api_endpoint="{}/cloudview-api/rest/v1/aws/connectors/run".format(os.getenv('BASEURL'))
                data = []
                api_endpoint_av_query="{}/qps/rest/2.0/search/am/awsassetdataconnector/".format(PORTALBASEURL)
                api_endpoint_run_av="{}/qps/rest/2.0/run/am/awsassetdataconnector/".format(PORTALBASEURL)
                data.append(CONNECTORID)
                encoded_data = json.dumps(data).encode('utf-8')
                ACCOUNT_ID = context.invoked_function_arn.split(":")[4]
                data2 = '<?xml version="1.0" encoding="UTF-8" ?><ServiceRequest><filters><Criteria field="awsAccountId" operator="EQUALS">{0}</Criteria></filters></ServiceRequest>'.format(str(ACCOUNT_ID))
                auth=os.getenv('USERNAME')+":"+os.getenv('PASSWORD')
                headers = urllib3.make_headers(basic_auth=auth)
                print("DATA: {}".format(data))
                print("URL for run request {}".format(api_endpoint))

                headers['X-Requested-With'] = "Qualys CloudFormation (python)"
                headers['Accept'] = 'application/json'
                headers['Content-Type'] = 'application/json'
                avheaders = headers.copy()
                avheaders['Content-Type'] = "text/xml"
                print("DATA: {}".format(data))
                http = urllib3.PoolManager()
                r = http.request('POST', api_endpoint, body=encoded_data, headers=headers, timeout=180)
                print("Run Connector Response Status: {}".format(r.status))
                if ASSETVIEWCONNECTOR:
                  #print("AV Query URL {}".format(api_endpoint_av_query))
                  #print("AV Query Body {}".format(encoded_data2))
                  #print("AV Query Headers \n {}".format(avheaders))
                  r2 = http.request('POST', api_endpoint_av_query, body=data2, headers=avheaders, timeout=180)
                  print("Status: {}".format(r2.status))
                  data2 = json.loads(r2.data.decode('utf-8'))
                  print("DATA: {}".format(data2))
                  if data2['ServiceResponse']['count'] > 0:
                    for connector in data2['ServiceResponse']['data']:
                      run_connector_url = api_endpoint_run_av + str(connector['AwsAssetDataConnector']['id'])
                      r3 = http.request('POST', run_connector_url, headers=avheaders, timeout=180)
                      print("Run Connector ID: {} status code {}".format(str(connector['AwsAssetDataConnector']['id']),r3.status))

              except Exception as e:
                traceback.print_exc()
                print("Response - {}".format(e))
                responseData['Error Reponse'] = {"r": r.status, "r2": r2.status, "r3": r3.status }
                responseData['responseErrorDetails'] = e
                cfnresponse.send(event, context, cfnresponse.FAILED, responseData)

              responseData['RunConnector'] = r.status
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)

      Description: Lambda Function to run AWS connector after creation of the IAM Role for the connector
      Handler: index.lambda_handler
      Role: !GetAtt 'LambdaExecutionRole.Arn'
      Runtime: python3.6
      Timeout: '600'

  CustomResource:
    Type: Custom::CustomResource
    Properties:
      ServiceToken: !GetAtt 'ConnectorFunction.Arn'

  CustomResource2:
    Type: Custom::CustomResource
    Properties:
      ServiceToken: !GetAtt 'ConnectorFunction2.Arn'

Outputs:
  ExternalId:
    Description: ExternalId generated (or passed) required by the Qualys Role.
    Value: !GetAtt 'CustomResource.ExternalId'
  DataConnectorId:
    Description: The Qualys Id of the configured Connector
    Value: !GetAtt 'CustomResource.DataConnectorId'