Skip to content
This repository was archived by the owner on Nov 10, 2025. It is now read-only.

Commit d326563

Browse files
groverlalitgroverlalit
authored
Merge pull request #18 from aws-solutions/feature/v2.0.4
Updated to version v2.0.4
2 parents 965620b + 71e6dfc commit d326563

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+19478
-12172
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ reports
2121

2222
# Node dependencies
2323
node_modules
24+
*.js
25+
!jest.config.js
26+
*.d.ts
2427

2528

2629
# CDK asset staging directory

‎CHANGELOG.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
66
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
77

8+
## [2.0.4] - 2023-04-21
9+
10+
### Changed
11+
12+
- Fix npm json5 vulnerabilites [CVE-2022-46175](https://nvd.nist.gov/vuln/detail/CVE-2022-46175)
13+
- Upgrade AWS CDK dependencies to version 2
14+
- Changed the Object Ownership for logging bucket from 'Object writer' to 'Bucket owner enforced' to mitigate the impact caused by new S3 default settings.
15+
- Updated S3 bucket policy to support access logging.
16+
817
## [2.0.3] - 2022-12-14
918

1019
### Changed

‎deployment/aws-fms-automations.template‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"Description": "(SO0134) - The AWS CloudFormation template for deployment of the aws-firewall-manager-automations-for-aws-organizations. Version v2.0.3",
2+
"Description": "(SO0134) - The AWS CloudFormation template for deployment of the aws-firewall-manager-automations-for-aws-organizations. Version v2.0.4",
33
"AWSTemplateFormatVersion": "2010-09-09",
44
"Metadata": {
55
"AWS::CloudFormation::Interface": {
@@ -38,7 +38,7 @@
3838
},
3939
"Solution": {
4040
"SolutionId": "SO0134",
41-
"SolutionVersion": "v2.0.3"
41+
"SolutionVersion": "v2.0.4"
4242
}
4343
}
4444
},
@@ -286,7 +286,7 @@
286286
"S3Bucket": {
287287
"Fn::Sub": "solutions-${AWS::Region}"
288288
},
289-
"S3Key": "aws-firewall-manager-automations-for-aws-organizations/v2.0.3/asset54a12c7d450d721fedbaa133a5a32cdea47192567f7d4d08b792bb889ff747f8.zip"
289+
"S3Key": "aws-firewall-manager-automations-for-aws-organizations/v2.0.4/asset24842558b9c75d96211d69797ccc4f45a68b0202cdad21acedf6f2e97515a608.zip"
290290
},
291291
"Role": {
292292
"Fn::GetAtt": [
@@ -463,7 +463,7 @@
463463
"S3Bucket": {
464464
"Fn::Sub": "solutions-${AWS::Region}"
465465
},
466-
"S3Key": "aws-firewall-manager-automations-for-aws-organizations/v2.0.3/asset3b263c2ad043fd069ef446753788c36e595c82b51a70478e58258c8ef7471671.zip"
466+
"S3Key": "aws-firewall-manager-automations-for-aws-organizations/v2.0.4/asset1eabd374284db340b74179e3429008132f5b6b0b7b28d472d852807d7f5f9746.zip"
467467
},
468468
"Role": {
469469
"Fn::GetAtt": [
@@ -788,7 +788,7 @@
788788
"S3Bucket": {
789789
"Fn::Sub": "solutions-${AWS::Region}"
790790
},
791-
"S3Key": "aws-firewall-manager-automations-for-aws-organizations/v2.0.3/asset9beecce4339c9851978aae9af0c33c0e9ba2465e683752b88b71112398b517fa.zip"
791+
"S3Key": "aws-firewall-manager-automations-for-aws-organizations/v2.0.4/assetaffb1a48bf50e8217e27ad04a18c084f4333ab82cce043250c7db971ef92de29.zip"
792792
},
793793
"Role": {
794794
"Fn::GetAtt": [
@@ -901,7 +901,7 @@
901901
"CDKMetadata": {
902902
"Type": "AWS::CDK::Metadata",
903903
"Properties": {
904-
"Analytics": "v2:deflate64:H4sIAAAAAAAA/2WQwU7DMAyGn2X31KOagCusGjdE6XiBNDFT1iYpcVI0RX13mhSVSlziz47t33YJ5eMB7nZP/JsKIbt9FNYhxLPnomPVp6m54xo9uuS88mFQ5pKwskYqr6xhz0To5/xL/rGGvAvCsyqQt7pBssEJTCUrb4Or0FvwQ/ATS4PEnutWcogvwYgsMiesfBrR+HPusBnof3RiimuIje0X+WRr2ytxy4tlmhgdCp42IMiLzD4cg+jQHzkhkzfDtZUtxA/eLn0yzHVfBPE9YMjBBfKb6zL9iW3caWIin6Zwv2cgqJ0dlUQ3MWMlwpX2Y/kA5T2UuyspVbhgvNIIzWJ/AH5YZtS1AQAA"
904+
"Analytics": "v2:deflate64:H4sIAAAAAAAA/2VRTU/DMAz9LdzTwECAOLIJbojSca/cxJuytkmJk6Kp6n8ncVGZxCV+z/bzV27l4728uYJvKpRui840ctoHUK3YHWwJHnoM6DN5g2Ew9pjhzlltgnFWJF09ddA3GuT0Gq1ib0pZ8cuINuxd9AovKvz3zsJAL6fKdZgT2JauM+rMkzCaBd3VQISB5HM2icttVC2GLRAKfbbQO51W+IRmqcMg6b5ITh8RIzsXwC/rGP01u6DzLCoknlNwx3SbY95BRQqur/1vkGTp3Wh0PhVHVlXe5QKvt32PYYhhFtZplCe6HjcPcvOUvuJExhQ+2mB6lNVifwARyTzapgEAAA=="
905905
},
906906
"Metadata": {
907907
"aws:cdk:path": "CommonResourceStack/CDKMetadata/Default"
@@ -911,7 +911,7 @@
911911
"ComplianceStack": {
912912
"Type": "AWS::CloudFormation::Stack",
913913
"Properties": {
914-
"TemplateURL": "https://solutions-reference.s3.amazonaws.com/aws-firewall-manager-automations-for-aws-organizations/v2.0.3/aws-fms-compliance.template",
914+
"TemplateURL": "https://solutions-reference.s3.amazonaws.com/aws-firewall-manager-automations-for-aws-organizations/v2.0.4/aws-fms-compliance.template",
915915
"Parameters": {
916916
"MetricsQueue": {
917917
"Fn::GetAtt": [
@@ -939,7 +939,7 @@
939939
"PolicyStack": {
940940
"Type": "AWS::CloudFormation::Stack",
941941
"Properties": {
942-
"TemplateURL": "https://solutions-reference.s3.amazonaws.com/aws-firewall-manager-automations-for-aws-organizations/v2.0.3/aws-fms-policy.template",
942+
"TemplateURL": "https://solutions-reference.s3.amazonaws.com/aws-firewall-manager-automations-for-aws-organizations/v2.0.4/aws-fms-policy.template",
943943
"Parameters": {
944944
"PolicyTable": {
945945
"Ref": "FMSTable84B8646C"

‎deployment/aws-fms-compliance.template‎

Lines changed: 140 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"Description": "(SO0134-cr) - The AWS CloudFormation template for deployment of the aws-firewall-manager-automations-for-aws-organizations compliance reporter resources. Version v2.0.3",
2+
"Description": "(SO0134-cr) - The AWS CloudFormation template for deployment of the aws-firewall-manager-automations-for-aws-organizations compliance reporter resources. Version v2.0.4",
33
"AWSTemplateFormatVersion": "2010-09-09",
44
"Metadata": {
55
"AWS::CloudFormation::Interface": {
@@ -41,15 +41,14 @@
4141
},
4242
"Solution": {
4343
"SolutionId": "SO0134",
44-
"SolutionVersion": "v2.0.3"
44+
"SolutionVersion": "v2.0.4"
4545
}
4646
}
4747
},
4848
"Resources": {
4949
"AccessLogsBucket83982689": {
5050
"Type": "AWS::S3::Bucket",
5151
"Properties": {
52-
"AccessControl": "LogDeliveryWrite",
5352
"BucketEncryption": {
5453
"ServerSideEncryptionConfiguration": [
5554
{
@@ -104,6 +103,92 @@
104103
}
105104
}
106105
},
106+
"AccessLogsBucketPolicy7F77476F": {
107+
"Type": "AWS::S3::BucketPolicy",
108+
"Properties": {
109+
"Bucket": {
110+
"Ref": "AccessLogsBucket83982689"
111+
},
112+
"PolicyDocument": {
113+
"Statement": [
114+
{
115+
"Action": "s3:*",
116+
"Condition": {
117+
"Bool": {
118+
"aws:SecureTransport": "false"
119+
}
120+
},
121+
"Effect": "Deny",
122+
"Principal": {
123+
"AWS": "*"
124+
},
125+
"Resource": [
126+
{
127+
"Fn::GetAtt": [
128+
"AccessLogsBucket83982689",
129+
"Arn"
130+
]
131+
},
132+
{
133+
"Fn::Join": [
134+
"",
135+
[
136+
{
137+
"Fn::GetAtt": [
138+
"AccessLogsBucket83982689",
139+
"Arn"
140+
]
141+
},
142+
"/*"
143+
]
144+
]
145+
}
146+
]
147+
},
148+
{
149+
"Action": "s3:PutObject",
150+
"Condition": {
151+
"ArnLike": {
152+
"aws:SourceArn": {
153+
"Fn::GetAtt": [
154+
"ComplianceReportBucketC209518B",
155+
"Arn"
156+
]
157+
}
158+
},
159+
"StringEquals": {
160+
"aws:SourceAccount": {
161+
"Ref": "AWS::AccountId"
162+
}
163+
}
164+
},
165+
"Effect": "Allow",
166+
"Principal": {
167+
"Service": "logging.s3.amazonaws.com"
168+
},
169+
"Resource": {
170+
"Fn::Join": [
171+
"",
172+
[
173+
{
174+
"Fn::GetAtt": [
175+
"AccessLogsBucket83982689",
176+
"Arn"
177+
]
178+
},
179+
"/*"
180+
]
181+
]
182+
}
183+
}
184+
],
185+
"Version": "2012-10-17"
186+
}
187+
},
188+
"Metadata": {
189+
"aws:cdk:path": "CommonResourceStack/ComplianceGeneratorStack/AccessLogsBucket/Policy/Resource"
190+
}
191+
},
107192
"ComplianceReportBucketC209518B": {
108193
"Type": "AWS::S3::Bucket",
109194
"Properties": {
@@ -144,6 +229,56 @@
144229
}
145230
}
146231
},
232+
"ComplianceReportBucketPolicy00A36248": {
233+
"Type": "AWS::S3::BucketPolicy",
234+
"Properties": {
235+
"Bucket": {
236+
"Ref": "ComplianceReportBucketC209518B"
237+
},
238+
"PolicyDocument": {
239+
"Statement": [
240+
{
241+
"Action": "s3:*",
242+
"Condition": {
243+
"Bool": {
244+
"aws:SecureTransport": "false"
245+
}
246+
},
247+
"Effect": "Deny",
248+
"Principal": {
249+
"AWS": "*"
250+
},
251+
"Resource": [
252+
{
253+
"Fn::GetAtt": [
254+
"ComplianceReportBucketC209518B",
255+
"Arn"
256+
]
257+
},
258+
{
259+
"Fn::Join": [
260+
"",
261+
[
262+
{
263+
"Fn::GetAtt": [
264+
"ComplianceReportBucketC209518B",
265+
"Arn"
266+
]
267+
},
268+
"/*"
269+
]
270+
]
271+
}
272+
]
273+
}
274+
],
275+
"Version": "2012-10-17"
276+
}
277+
},
278+
"Metadata": {
279+
"aws:cdk:path": "CommonResourceStack/ComplianceGeneratorStack/ComplianceReportBucket/Policy/Resource"
280+
}
281+
},
147282
"TopicBFC7AF6E": {
148283
"Type": "AWS::SNS::Topic",
149284
"Properties": {
@@ -320,7 +455,7 @@
320455
"S3Bucket": {
321456
"Fn::Sub": "solutions-${AWS::Region}"
322457
},
323-
"S3Key": "aws-firewall-manager-automations-for-aws-organizations/v2.0.3/asset41a5407bca18500cf7b553e770434e9d34140172c609dfc3e73ac0427410c36b.zip"
458+
"S3Key": "aws-firewall-manager-automations-for-aws-organizations/v2.0.4/asset7ca48ba4c31630e32e9bbd83b4930a1cc50ce235d4df68ede7e2560ed40a09e1.zip"
324459
},
325460
"Role": {
326461
"Fn::GetAtt": [
@@ -629,7 +764,7 @@
629764
"CDKMetadata": {
630765
"Type": "AWS::CDK::Metadata",
631766
"Properties": {
632-
"Analytics": "v2:deflate64:H4sIAAAAAAAA/01Q0W7DIAz8lr4Td1HU7XVrpb5tzdL9ACVeRZNAhqHThPj3AUnbvPju7OOMXEL5UsHT6pX/UiHabu2FNgj+A8lie7RcdGz3rWpu+IAWTRLvfBylOrMGSTsjkL0RoY3ec+pGw8HZ0Vm204qsccKm3t0ceRy00kqtAktrPVXgt050mJ0zm2DLCQMjReC/9ChFMkwk11r3Uvzdm7M8uhMJI8e0Is2WOob9xLBPhy7/ZSK5PsIWMrCeD6eWg987JW6JS16jGSRRzpZ8AN/oPkdnfITe8qgqeDoYQb4bwyuqKHzj5mcRQwhM6RbhQutr+QzlBsrVhaQsjFNWDgjNhP/ayCChwAEAAA=="
767+
"Analytics": "v2:deflate64:H4sIAAAAAAAA/02RzU7DMBCEn4W7YygVII60EjdoSLlXjrOttkns1GsXISvvjn9Skotnxrv7SV4/8pcn/nAnfqiQTVt0WHP/CWSh2VshW7Y9qlIY0YMFE8OHGAZUJxYGDp7W3G+cbMHG0uSylLpD+TtfTzmHjSAYGSni/lsPKGNbNumcZ5dx72qSBgeLWsXaMgfYJcC+HDiItWzSOcMWcWSd6OtGcP/ulLwRl74E0yNRYqPoua90l9BJZ+iNR+uDIAJL/C0KgyuoEHzlprGg48gqIO2MBJa6wopPcZmhvnN2cGmN/y3Bb7VqMD9Q6Qb4me6vq2e+eg1fdibEwjhlsQdeZf0DWOxBKM4BAAA="
633768
},
634769
"Metadata": {
635770
"aws:cdk:path": "CommonResourceStack/ComplianceGeneratorStack/CDKMetadata/Default"

0 commit comments

Comments
 (0)