1213357 - "Mozilla-Labs" AWS account security audit role not working

Status: RESOLVED FIXED

(Security Assurance :: General, task)

Description

[Gene Wood [:gene]]

Jon,
   It looks like the security audit role you set up for us to be able to audit your "Mozilla-Labs" (119057770964) account stopped working.

Can you take a look at the CloudFormation template that you deployed to see if maybe it was redeployed or deleted?

The IAM Role ARN we have that isn't working is arn:aws:iam::119057770964:role/opsec-security-audit-role-OpSecSecurityAuditRole-EPVWOW3RTW7Q

If the stack has been redeployed you may find in the outputs a new ARN. If so, just provide that to me and we should be good to go.





On Tue, Feb 24, 2015 at 4:43 PM, Gene Wood <[e-mail]> wrote:
Hi, I'm a Cloud Security Engineer in the Mozilla Operations Security team. The OpSec team is working on an effort to provide teams better reporting of security risks in their AWS accounts. We're also working on enabling better incident response (responding to a security issue). In service of these goals we've crafted an AWS Identity and Access Management Role which Mozilla teams can install into their team's AWS account to grant OpSec the ability to both audit their accounts for security risks and to help in the case of a security incident.

The way it works is that your team would deploy this CloudFormation template 

https://github.com/mozilla/security/blob/master/operations/aws-security-auditor/opsec-security-audit-trusting-role-cloudformation.json

into your AWS account : 

119057770964	Simon Wex

which would create a new IAM Role that "trusts" a different OpSec controlled IAM Role in the mozilla-opsec AWS account. This would grant OpSec the permissions laid out in the trusting role to do things like
* look for IAM roles which grant broader access than they intend
* identify CloudTrail log destinations for auditing
* create a forensics instance in the event that you identify a security breach of some kind

You can see the auditing permissions that would be granted here :

https://github.com/mozilla/security/blob/master/operations/aws-security-auditor/opsec-security-audit-trusting-role-cloudformation.json#L29-L63

and the incident response permissions that would be granted here :

https://github.com/mozilla/security/blob/master/operations/aws-security-auditor/opsec-security-audit-trusting-role-cloudformation.json#L72-L143

If this sounds good, here's how to enable this :

1. Deploy the CloudFormation template
2. Report back with the "OpSecSecurityAuditRoleARN" output generated when the CloudFormation stack is created

The detailed instructions are here :

https://github.com/mozilla/security/tree/master/operations/aws-security-auditor#create-a-trusting-account-using-cloudformation

If you've got any questions about how this works, please feel free to ask.
-Gene

Comment 1

[Jon Buckley [:jbuck]]

:gene - hey! I probably ripped this out earlier this week in my panicked half-decommissioning of the account. I received a request from accounting to transfer it over to MoFo or terminate the account, so I did the transfer and deleted almost every resource I could. My intention is to shut it down completely, I just need to find the time to do so.

Comment 2

[Gene Wood [:gene]]

:jbuck, is your plan for MoFo to have no AWS accounts, or are you bringing up a new account that you're moving stuff into? Or is there another MoFo account or accounts that these services are migrating to?

Just want to make sure we can provide security views to MoFo.

Comment 3

[Jon Buckley [:jbuck]]

Just getting rid of this one account

Comment 4

[Gene Wood [:gene]]

Ok, I'll remove it from our records. Let me know if any new accounts come for which we don't have a security auditing role.
Thanks