AWS Config Service Disabled

AnalysisType: rule
Filename: aws_config_service_disabled_deleted.py
RuleID: "AWS.ConfigService.DisabledDeleted"
DisplayName: "AWS Config Service Disabled"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Security Control
  - Defense Evasion:Impair Defenses
Reports:
  CIS:
    - 3.9
  MITRE ATT&CK:
    - TA0005:T1562
Severity: Medium
Description: >
  An AWS Config Recorder or Delivery Channel was disabled or deleted
Runbook: >
  Verify that the Config Service changes were authorized. If not, revert them and investigate who caused the change. Consider altering permissions to prevent this from happening again in the future.
Reference: https://aws.amazon.com/config/
SummaryAttributes:
  - eventName
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: Config Recorder Delivery Channel Created
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "1111:tester",
            "arn": "arn:aws:sts::123456789012:assumed-role/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "sessionContext":
              {
                "sessionIssuer":
                  {
                    "type": "Role",
                    "principalId": "1111",
                    "arn": "arn:aws:iam::123456789012:role/tester",
                    "accountId": "123456789012",
                    "userName": "tester",
                  },
                "webIdFederationData": {},
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
              },
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "config.amazonaws.com",
        "eventName": "PutDeliveryChannel",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "console.amazonaws.com",
        "requestParameters": { "configurationRecorderName": "default" },
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }
  - Name: Config Recorder Deleted
    ExpectedResult: true
    Log:
      {
        "eventVersion": "1.05",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "1111:tester",
            "arn": "arn:aws:sts::123456789012:assumed-role/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "sessionContext":
              {
                "sessionIssuer":
                  {
                    "type": "Role",
                    "principalId": "1111",
                    "arn": "arn:aws:iam::123456789012:role/tester",
                    "accountId": "123456789012",
                    "userName": "tester",
                  },
                "webIdFederationData": {},
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
              },
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "config.amazonaws.com",
        "eventName": "DeleteDeliveryChannel",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "console.amazonaws.com",
        "requestParameters": { "configurationRecorderName": "default" },
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }
  - Name: Error Deleting Config Recorder
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.05",
        "errorCode": "NoSuchDeliveryChannelException",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "1111:tester",
            "arn": "arn:aws:sts::123456789012:assumed-role/tester",
            "accountId": "123456789012",
            "accessKeyId": "1",
            "sessionContext":
              {
                "sessionIssuer":
                  {
                    "type": "Role",
                    "principalId": "1111",
                    "arn": "arn:aws:iam::123456789012:role/tester",
                    "accountId": "123456789012",
                    "userName": "tester",
                  },
                "webIdFederationData": {},
                "attributes":
                  {
                    "mfaAuthenticated": "true",
                    "creationDate": "2019-01-01T00:00:00Z",
                  },
              },
          },
        "eventTime": "2019-01-01T00:00:00Z",
        "eventSource": "config.amazonaws.com",
        "eventName": "DeleteDeliveryChannel",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "console.amazonaws.com",
        "requestParameters": { "configurationRecorderName": "default" },
        "responseElements": null,
        "requestID": "1",
        "eventID": "1",
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
      }


# ------ paired body: aws_config_service_disabled_deleted.py ------

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context

# API calls that are indicative of an AWS Config Service change
CONFIG_SERVICE_DISABLE_DELETE_EVENTS = {
    "StopConfigurationRecorder",
    "DeleteDeliveryChannel",
}


def rule(event):
    return (
        aws_cloudtrail_success(event)
        and event.get("eventName") in CONFIG_SERVICE_DISABLE_DELETE_EVENTS
    )


def alert_context(event):
    return aws_rule_context(event)