1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
|
# ORG policy evaluations =======================================================
# Controls: ORG-001 through ORG-008
#
# Scope guard: all rules require aws_organizations_organization in the plan.
# Workload plans without org resources are unaffected.
package controls.aws.org
import data.common.exemptions as exemptions
import data.common.outputs as outputs
# Scope guard ------------------------------------------------------------------
_org_in_scope if {
some _, rc in input.resource_changes
rc.type == "aws_organizations_organization"
}
# ORG-001 — AWS Organizations must have all features enabled ------------------
deny contains msg if {
policy_id := "ICP-TF-AWS-ORG-001"
_org_in_scope
some _, rc in input.resource_changes
rc.type == "aws_organizations_organization"
rc.change.actions[_] in ["create", "update"]
rc.change.after.feature_set != "ALL"
meta := data.policies[policy_id]
meta.status == "active"
not exemptions.policy_exemption(policy_id)
not exemptions.severity_exemption(meta.severity)
msg := outputs.violation(
policy_id, meta,
sprintf("Organization '%s' does not have all features enabled (feature_set = ALL required)", [rc.name]),
)
}
# ORG-002 — Organizations policy types must be enabled on root ----------------
deny contains msg if {
policy_id := "ICP-TF-AWS-ORG-002"
_org_in_scope
some _, rc in input.resource_changes
rc.type == "aws_organizations_organization"
rc.change.actions[_] in ["create", "update"]
some required in _required_policy_types
not required in rc.change.after.enabled_policy_types
meta := data.policies[policy_id]
meta.status == "active"
not exemptions.policy_exemption(policy_id)
not exemptions.severity_exemption(meta.severity)
msg := outputs.violation(
policy_id, meta,
sprintf("Organization '%s' is missing required policy type '%s'", [rc.name, required]),
)
}
_required_policy_types := {
"TAG_POLICY",
"BACKUP_POLICY",
"AISERVICES_OPT_OUT_POLICY",
}
# ORG-003 — Trusted service access for foundational security services ---------
deny contains msg if {
policy_id := "ICP-TF-AWS-ORG-003"
_org_in_scope
some _, rc in input.resource_changes
rc.type == "aws_organizations_organization"
rc.change.actions[_] in ["create", "update"]
some required in _required_trusted_services
not required in rc.change.after.aws_service_access_principals
meta := data.policies[policy_id]
meta.status == "active"
not exemptions.policy_exemption(policy_id)
not exemptions.severity_exemption(meta.severity)
msg := outputs.violation(
policy_id, meta,
sprintf("Organization '%s' is missing trusted service access for '%s'", [rc.name, required]),
)
}
_required_trusted_services := {
"cloudtrail.amazonaws.com",
"config.amazonaws.com",
"securityhub.amazonaws.com",
"guardduty.amazonaws.com",
"access-analyzer.amazonaws.com",
"ram.amazonaws.com",
}
# ORG-004 — Delegated administrator for security services ---------------------
deny contains msg if {
policy_id := "ICP-TF-AWS-ORG-004"
_org_in_scope
some required in _required_delegated_services
not _delegated_admin_exists(required)
meta := data.policies[policy_id]
meta.status == "active"
not exemptions.policy_exemption(policy_id)
not exemptions.severity_exemption(meta.severity)
msg := outputs.violation(
policy_id, meta,
sprintf("No delegated administrator configured for service '%s'", [required]),
)
}
_required_delegated_services := {
"securityhub.amazonaws.com",
"guardduty.amazonaws.com",
"config.amazonaws.com",
"access-analyzer.amazonaws.com",
}
_delegated_admin_exists(service) if {
some _, rc in input.resource_changes
rc.type == "aws_organizations_delegated_administrator"
rc.change.actions[_] in ["create", "update"]
rc.change.after.service_principal == service
}
# ORG-005 — Account alternate contacts for SECURITY, BILLING, OPERATIONS ------
deny contains msg if {
policy_id := "ICP-TF-AWS-ORG-005"
_org_in_scope
some contact_type in _required_contact_types
not _alternate_contact_exists(contact_type)
meta := data.policies[policy_id]
meta.status == "active"
not exemptions.policy_exemption(policy_id)
not exemptions.severity_exemption(meta.severity)
msg := outputs.violation(
policy_id, meta,
sprintf("No alternate contact configured for contact type '%s'", [contact_type]),
)
}
_required_contact_types := {"SECURITY", "BILLING", "OPERATIONS"}
_alternate_contact_exists(contact_type) if {
some _, rc in input.resource_changes
rc.type == "aws_account_alternate_contact"
rc.change.actions[_] in ["create", "update"]
rc.change.after.alternate_contact_type == contact_type
}
# ORG-006 — Organization Tag Policy must be defined and attached --------------
deny contains msg if {
policy_id := "ICP-TF-AWS-ORG-006"
_org_in_scope
not _org_policy_exists("TAG_POLICY")
meta := data.policies[policy_id]
meta.status == "active"
not exemptions.policy_exemption(policy_id)
not exemptions.severity_exemption(meta.severity)
msg := outputs.violation(
policy_id, meta,
"No aws_organizations_policy of type TAG_POLICY found in plan",
)
}
deny contains msg if {
policy_id := "ICP-TF-AWS-ORG-006"
_org_in_scope
_org_policy_exists("TAG_POLICY")
not _org_policy_attached("TAG_POLICY")
meta := data.policies[policy_id]
meta.status == "active"
not exemptions.policy_exemption(policy_id)
not exemptions.severity_exemption(meta.severity)
msg := outputs.violation(
policy_id, meta,
"TAG_POLICY exists but no aws_organizations_policy_attachment found for it",
)
}
# ORG-007 — Organization Backup Policy must be defined and attached -----------
deny contains msg if {
policy_id := "ICP-TF-AWS-ORG-007"
_org_in_scope
not _org_policy_exists("BACKUP_POLICY")
meta := data.policies[policy_id]
meta.status == "active"
not exemptions.policy_exemption(policy_id)
not exemptions.severity_exemption(meta.severity)
msg := outputs.violation(
policy_id, meta,
"No aws_organizations_policy of type BACKUP_POLICY found in plan",
)
}
deny contains msg if {
policy_id := "ICP-TF-AWS-ORG-007"
_org_in_scope
_org_policy_exists("BACKUP_POLICY")
not _org_policy_attached("BACKUP_POLICY")
meta := data.policies[policy_id]
meta.status == "active"
not exemptions.policy_exemption(policy_id)
not exemptions.severity_exemption(meta.severity)
msg := outputs.violation(
policy_id, meta,
"BACKUP_POLICY exists but no aws_organizations_policy_attachment found for it",
)
}
# ORG-008 — Organization Units must be defined --------------------------------
deny contains msg if {
policy_id := "ICP-TF-AWS-ORG-008"
_org_in_scope
not _ou_exists
meta := data.policies[policy_id]
meta.status == "active"
not exemptions.policy_exemption(policy_id)
not exemptions.severity_exemption(meta.severity)
msg := outputs.violation(
policy_id, meta,
"No aws_organizations_organizational_unit found in plan — flat account structure detected",
)
}
_ou_exists if {
some _, rc in input.resource_changes
rc.type == "aws_organizations_organizational_unit"
rc.change.actions[_] in ["create", "update"]
}
# Helpers ----------------------------------------------------------------------
_org_policy_exists(policy_type) if {
some _, rc in input.resource_changes
rc.type == "aws_organizations_policy"
rc.change.actions[_] in ["create", "update"]
rc.change.after.type == policy_type
}
_org_policy_attached(policy_type) if {
some _, policy_rc in input.resource_changes
policy_rc.type == "aws_organizations_policy"
policy_rc.change.actions[_] in ["create", "update"]
policy_rc.change.after.type == policy_type
some _, attach_rc in input.resource_changes
attach_rc.type == "aws_organizations_policy_attachment"
attach_rc.change.actions[_] in ["create", "update"]
some r in input.configuration.root_module.resources
r.address == attach_rc.address
some ref in r.expressions.policy_id.references
ref == policy_rc.address
}
|
