AnalysisType: policy
Filename: aws_config_recording_no_error.py
PolicyID: "AWS.Config.RecordingNoErrors"
DisplayName: "AWS Config Recording Status"
Enabled: true
ResourceTypes:
- AWS.Config.Recorder
Tags:
- AWS
- Panther
Severity: Medium
Description: >
This policy ensures that the config recorder is operational and capturing changes to
your account without error.
Runbook: >
Check the AWS Config console to understand and resolve the cause of the errors.
Reference: https://docs.aws.amazon.com/config/latest/developerguide/notification-delivery-failed.html
Tests:
- Name: Recording Enabled with No Errors
ExpectedResult: true
Resource:
{
"Recorder":
{
"Name": "default",
"RecordingGroup":
{
"AllSupported": true,
"IncludeGlobalResourceTypes": true,
"ResourceTypes": [],
},
"RoleARN": "arn:aws:iam::112233445566:role/role-name",
},
"Region": "us-west-2",
"Status":
{
"LastErrorCode": null,
"LastErrorMessage": null,
"LastStartTime": "2019-01-01T00:00:00Z",
"LastStatus": "SUCCESS",
"LastStatusChangeTime": "2019-01-01T00:00:00Z",
"LastStopTime": null,
"Name": "default",
"Recording": true,
},
}
- Name: Recording Errored
ExpectedResult: false
Resource:
{
"Recorder":
{
"Name": "default",
"RecordingGroup":
{
"AllSupported": false,
"IncludeGlobalResourceTypes": true,
"ResourceTypes": [],
},
"RoleARN": "arn:aws:iam::112233445566:role/role-name",
},
"Region": "us-west-2",
"Status":
{
"LastErrorCode": "NoSuchBucket",
"LastErrorMessage": "Failed to deliver notification to bucket: bucket-example for account 123456789012 in region us-west-2",
"LastStartTime": "2019-01-01T00:00:00Z",
"LastStatus": "SUCCESS",
"LastStatusChangeTime": "2019-01-01T00:00:00Z",
"LastStopTime": null,
"Name": "default",
"Recording": true,
},
}
# ------ paired body: aws_config_recording_no_error.py ------
from panther_base_helpers import deep_get
def policy(resource):
return deep_get(resource, "Status", "LastErrorCode") is None