AWS Config Records All Resource Types

AnalysisType: policy
Filename: aws_config_all_resource_types.py
PolicyID: "AWS.Config.RecordAllResourceTypes"
DisplayName: "AWS Config Records All Resource Types"
Enabled: true
ResourceTypes:
  - AWS.Config.Recorder
Tags:
  - AWS
  - Panther
Severity: Low
Description: >
  This policy ensurers that you have a comprehensive configuration audit in place for
  all resource types in AWS.
Runbook: >
  Update AWS Config to record changes to all supported resource types.
Reference: https://aws.amazon.com/blogs/mt/aws-config-best-practices/
Tests:
  - Name: All Resources Supported
    ExpectedResult: true
    Resource:
      {
        "Name": "default",
        "RecordingGroup":
          {
            "AllSupported": true,
            "IncludeGlobalResourceTypes": true,
            "ResourceTypes": [],
          },
        "RoleARN": "arn:aws:iam::112233445566:role/role-name",
        "Region": "us-west-2",
        "Status":
          {
            "LastErrorCode": null,
            "LastErrorMessage": null,
            "LastStartTime": "2019-01-01T00:00:00Z",
            "LastStatus": "SUCCESS",
            "LastStatusChangeTime": "2019-01-01T00:00:00Z",
            "LastStopTime": null,
            "Name": "default",
            "Recording": true,
          },
      }
  - Name: All Resources Not Supported
    ExpectedResult: false
    Resource:
      {
        "Name": "default",
        "RecordingGroup":
          {
            "AllSupported": false,
            "IncludeGlobalResourceTypes": true,
            "ResourceTypes": [],
          },
        "RoleARN": "arn:aws:iam::112233445566:role/role-name",
        "Region": "us-west-2",
        "Status":
          {
            "LastErrorCode": null,
            "LastErrorMessage": null,
            "LastStartTime": "2019-01-01T00:00:00Z",
            "LastStatus": "SUCCESS",
            "LastStatusChangeTime": "2019-01-01T00:00:00Z",
            "LastStopTime": null,
            "Name": "default",
            "Recording": true,
          },
      }


# ------ paired body: aws_config_all_resource_types.py ------

from panther_base_helpers import deep_get


def policy(resource):
    return bool(deep_get(resource, "RecordingGroup", "AllSupported"))