added cloudwatch event to MS Teams

examples/2016-10-31/cloudwatch-event-to-msteams/events/event_federated.json

@@ -0,0 +1,68 @@
+{
+    "version": "0",
+    "id": "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+    "detail-type": "AWS API Call via CloudTrail",
+    "source": "aws.ec2",
+    "account": "123456789012",
+    "time": "2018-07-22T09:49:51Z",
+    "region": "ap-southeast-2",
+    "resources": [],
+    "detail": {
+        "eventVersion": "1.05",
+        "userIdentity": {
+            "type": "AssumedRole",
+            "principalId": "xxxxxxxxxxxxxxx:[email protected]",
+            "arn": "arn:aws:sts::xxxxxxxxxxxxxxx:assumed-role/xxxxxxxxxxxxxxx/[email protected]",
+            "accountId": "xxxxxxxxxxxxxxx",
+            "accessKeyId": "xxxxxxxxxxxxxxx",
+            "sessionContext": {
+                "attributes": {
+                    "mfaAuthenticated": "false",
+                    "creationDate": "2018-07-22T09:49:51Z"
+                },
+                "sessionIssuer": {
+                    "type": "Role",
+                    "principalId": "xxxxxxxxxxxxxxx",
+                    "arn": "arn:aws:iam::123456789012:role/xxxxxxxxxxxxxxx",
+                    "accountId": "123456789012",
+                    "userName": "xxxxxxxxxxxxxxx"
+                }
+            }
+        },
+        "eventTime": "2018-07-22T09:49:51Z",
+        "eventSource": "ec2.amazonaws.com",
+        "eventName": "AuthorizeSecurityGroupIngress",
+        "awsRegion": "ap-southeast-2",
+        "sourceIPAddress": "xxxxxxxxxxxxxxx",
+        "userAgent": "console.ec2.amazonaws.com",
+        "requestParameters": {
+            "groupId": "sg-xxxxxxxxxxxxxx",
+            "ipPermissions": {
+                "items": [
+                    {
+                        "ipProtocol": "tcp",
+                        "fromPort": 22,
+                        "toPort": 22,
+                        "groups": {},
+                        "ipRanges": {
+                            "items": [
+                                {
+                                    "cidrIp": "0.0.0.0/0"
+                                }
+                            ]
+                        },
+                        "ipv6Ranges": {},
+                        "prefixListIds": {}
+                    }
+                ]
+            }
+        },
+        "responseElements": {
+            "_return": true
+        },
+        "requestID": "xxxxxxxxxxxxxxx",
+        "eventID": "xxxxxxxxxxxxxxx",
+        "eventType": "AwsApiCall",
+        "recipientAccountId": "xxxxxxxxxxxxxxx"
+    }
+}

examples/2016-10-31/cloudwatch-event-to-msteams/events/event_iam.json

@@ -0,0 +1,64 @@
+{
+    "version": "0",
+    "id": "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+    "detail-type": "AWS API Call via CloudTrail",
+    "source": "aws.ec2",
+    "account": "123456789012",
+    "time": "2018-07-22T09:49:51Z",
+    "region": "ap-southeast-2",
+    "resources": [],
+    "detail": {
+        "eventVersion": "1.05",
+        "userIdentity": {
+            "type": "IAMUser",
+            "principalId": "XXXXXXXXXXXXXXXXXXX",
+            "arn": "arn:aws:iam::123456789012:user/john.doh",
+            "accountId": "123456789012",
+            "accessKeyId": "XXXXXXXXXXXXXXXXXXX",
+            "userName": "john.doh",
+            "sessionContext": {
+                "attributes": {
+                    "mfaAuthenticated": "false",
+                    "creationDate": "2018-07-22T02:00:21Z"
+                }
+            },
+            "invokedBy": "signin.amazonaws.com"
+        },
+        "eventTime": "2018-07-22T09:49:51Z",
+        "eventSource": "ec2.amazonaws.com",
+        "eventName": "AuthorizeSecurityGroupIngress",
+        "awsRegion": "ap-southeast-2",
+        "sourceIPAddress": "192.168.1.1",
+        "userAgent": "signin.amazonaws.com",
+        "requestParameters": {
+            "groupId": "sg-xxxxxxxxxxxxxxx",
+            "ipPermissions": {
+                "items": [
+                    {
+                        "ipProtocol": "tcp",
+                        "fromPort": 22,
+                        "toPort": 22,
+                        "groups": {},
+                        "ipRanges": {
+                            "items": [
+                                {
+                                    "cidrIp": "0.0.0.0/0",
+                                    "description": "to lazy to put correct ip, lets give everyone access"
+                                }
+                            ]
+                        },
+                        "ipv6Ranges": {},
+                        "prefixListIds": {}
+                    }
+                ]
+            }
+        },
+        "responseElements": {
+            "requestId": "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+            "_return": true
+        },
+        "requestID": "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+        "eventID": "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+        "eventType": "AwsApiCall"
+    }
+}

examples/2016-10-31/cloudwatch-event-to-msteams/events/event_security_group.json

@@ -0,0 +1,64 @@
+{
+    "version": "0",
+    "id": "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+    "detail-type": "AWS API Call via CloudTrail",
+    "source": "aws.ec2",
+    "account": "123456789012",
+    "time": "2018-07-28T09:17:52Z",
+    "region": "ap-southeast-2",
+    "resources": [],
+    "detail": {
+        "eventVersion": "1.05",
+        "userIdentity": {
+            "type": "IAMUser",
+            "principalId": "XXXXXXXXXXXXXXXXXXX",
+            "arn": "arn:aws:iam::123456789012:user/john.doh",
+            "accountId": "123456789012",
+            "accessKeyId": "XXXXXXXXXXXXXXXXXXX",
+            "userName": "john.doh",
+            "sessionContext": {
+                "attributes": {
+                    "mfaAuthenticated": "false",
+                    "creationDate": "2018-07-28T02:20:35Z"
+                }
+            },
+            "invokedBy": "signin.amazonaws.com"
+        },
+        "eventTime": "2018-07-28T09:17:52Z",
+        "eventSource": "ec2.amazonaws.com",
+        "eventName": "AuthorizeSecurityGroupIngress",
+        "awsRegion": "ap-southeast-2",
+        "sourceIPAddress": "192.168.1.10",
+        "userAgent": "signin.amazonaws.com",
+        "requestParameters": {
+            "groupId": "sg-xxxxxxxxxxxxxxx",
+            "ipPermissions": {
+                "items": [
+                    {
+                        "ipProtocol": "tcp",
+                        "fromPort": 3389,
+                        "toPort": 3389,
+                        "groups": {
+                            "items": [
+                                {
+                                    "groupId": "sg-zzzzzzzzzzzzzzz",
+                                    "description": "All RDP from front-end security group"
+                                }
+                            ]
+                        },
+                        "ipRanges": {},
+                        "ipv6Ranges": {},
+                        "prefixListIds": {}
+                    }
+                ]
+            }
+        },
+        "responseElements": {
+            "requestId": "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+            "_return": true
+        },
+        "requestID": "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+        "eventID": "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+        "eventType": "AwsApiCall"
+    }
+}

examples/2016-10-31/cloudwatch-event-to-msteams/template.yaml

@@ -0,0 +1,62 @@
+# To deploy with SAM:
+# download and install sam: https://github.com/awslabs/aws-sam-cli
+# sam package --template-file template.yaml --s3-bucket your-s3-bucket --output-template sam-output.yaml
+# sam deploy --template-file sam-output.yaml --stack-name WatchSecurityGroup --capabilities CAPABILITY_IAM
+
+# To test locally: (make sure to modifify the "groupId" with a real security group, add your webhook into vars.json)
+  # sam local invoke -e events/event_iam.json WatchSecurityGroupFunction -n vars.json
+
+Transform: AWS::Serverless-2016-10-31
+Description: Lambda function to watch EC2 Security Group Events to Send to Teams
+
+Parameters:
+
+  WebHook:
+    Description: MS Teams Webhook
+    Type: String
+    Default: https://outlook.office.com/webhook/your/webhook/etc
+
+Resources:
+
+  # Lambda Function
+  WatchSecurityGroupFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      Handler: watch-security-group.lambda_handler
+      Timeout: 10
+      Tracing: Active
+      MemorySize: 128
+      Runtime: python3.6
+      CodeUri: .
+      Description: Detects EC2 Security Group Events to Send to Teams
+      Policies:
+        - AWSLambdaVPCAccessExecutionRole
+        - CloudWatchLogsFullAccess
+        - Version: 2012-10-17
+          Statement:
+            - Effect: Allow
+              Action:
+                  - ec2:DescribeSecurityGroupReferences
+                  - ec2:DescribeSecurityGroups
+                  - ec2:DescribeStaleSecurityGroups
+              Resource: '*'
+      Events:
+        WatchSecurityGroupRule:
+          Type: CloudWatchEvent
+          Description: Detects EC2 Security Group Events to Send to Teams
+          Properties:
+            Pattern:
+              source:
+                - "aws.ec2"
+              detail-type:
+                - "AWS API Call via CloudTrail"
+              detail:
+                eventSource:
+                  - "ec2.amazonaws.com"
+                eventName:
+                  - "AuthorizeSecurityGroupIngress"
+                  - "RevokeSecurityGroupIngress"
+      Environment:
+        Variables:
+          TEAM_WEBHOOK: !Ref WebHook
+

examples/2016-10-31/cloudwatch-event-to-msteams/vars.json

@@ -0,0 +1,5 @@
+{
+    "WatchSecurityGroupFunction": {
+        "TEAM_WEBHOOK": "https://outlook.office.com/webhook/your/webhook/etc"
+    }
+}