new: added policy ecc-aws-552-dynamodb_tables_unused

anna-shcherbak · Sep 20, 2023 · 11ef8ce · 11ef8ce
1 parent 96802fe
commit 11ef8ce
Show file tree

Hide file tree

Showing 24 changed files with 343 additions and 42 deletions.
diff --git a/iam/All-permissions.json b/iam/All-permissions.json
@@ -27,6 +27,7 @@
                 "cloudtrail:DescribeTrails",
                 "cloudtrail:GetEventSelectors",
                 "cloudtrail:GetTrailStatus",
+                "cloudwatch:GetMetricStatistics",
                 "cloudwatch:DescribeAlarms",
                 "codebuild:BatchGetProjects",
                 "codebuild:ListProjects",

diff --git a/policies/ecc-aws-552-dynamodb_tables_unused.yml b/policies/ecc-aws-552-dynamodb_tables_unused.yml
@@ -0,0 +1,46 @@
+# Copyright (c) 2023 EPAM Systems, Inc.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+
+policies:
+  - name: ecc-aws-552-dynamodb_tables_unused
+    comment: '010002062000'
+    description: |
+      Unused Amazon DynamoDB tables
+    resource: aws.dynamodb-table
+    filters:
+    - and:
+      - type: value
+        key: ProvisionedThroughput.ReadCapacityUnits
+        op: ne
+        value: 0
+      - type: value
+        key: TableStatus
+        value: ACTIVE
+      - type: value
+        key: CreationDateTime
+        value_type: age
+        value: 60
+        op: ge
+      - or:
+        - type: value
+          key: ItemCount
+          value: 0
+        - and:
+          - type: metrics
+            name: ConsumedWriteCapacityUnits
+            namespace: AWS/DynamoDB
+            statistics: Maximum
+            days: 60
+            value: 0
+            op: equal
+          - type: metrics
+            name: ConsumedReadCapacityUnits
+            namespace: AWS/DynamoDB
+            statistics: Maximum
+            days: 60
+            value: 0
+            op: equal
diff --git a/terraform/ecc-aws-552-dynamodb_tables_unused/green/dynamodb.tf b/terraform/ecc-aws-552-dynamodb_tables_unused/green/dynamodb.tf
@@ -0,0 +1,28 @@
+resource "aws_dynamodb_table" "this" {
+  name         = "552_dynamodb_table_green"
+  hash_key     = "GreenTableHashKey"
+  billing_mode = "PROVISIONED"
+  read_capacity  = 1
+  write_capacity = 1
+
+
+  attribute {
+    name = "GreenTableHashKey"
+    type = "S"
+  }
+}
+
+resource "aws_dynamodb_table_item" "this" {
+  table_name = aws_dynamodb_table.this.name
+  hash_key   = aws_dynamodb_table.this.hash_key
+
+  item = <<ITEM
+{
+  "GreenTableHashKey": {"S": "something"},
+  "one": {"N": "11111"},
+  "two": {"N": "22222"},
+  "three": {"N": "33333"},
+  "four": {"N": "44444"}
+}
+ITEM
+}
diff --git a/...bal_rulegroup_not_empty/green/provider.tf → ...-dynamodb_tables_unused/green/provider.tf b/...bal_rulegroup_not_empty/green/provider.tf → ...-dynamodb_tables_unused/green/provider.tf
@@ -13,7 +13,7 @@ provider "aws" {
 
   default_tags {
     tags = {
-      CustodianRule    = "ecc-aws-916-waf_global_rulegroup_not_empty"
+      CustodianRule    = "ecc-aws-552-dynamodb_tables_unused"
       ComplianceStatus = "Green"
     }
   }

diff --git a/...ulegroup_not_empty/green/terraform.tfvars → ...modb_tables_unused/green/terraform.tfvars b/...ulegroup_not_empty/green/terraform.tfvars → ...modb_tables_unused/green/terraform.tfvars
diff --git a/...al_rulegroup_not_empty/green/variables.tf → ...dynamodb_tables_unused/green/variables.tf b/...al_rulegroup_not_empty/green/variables.tf → ...dynamodb_tables_unused/green/variables.tf
diff --git a/...l_rulegroup_not_empty/iam/916-policy.json → ...ynamodb_tables_unused/iam/552-policy.json b/...l_rulegroup_not_empty/iam/916-policy.json → ...ynamodb_tables_unused/iam/552-policy.json
@@ -4,8 +4,10 @@
         {
             "Effect": "Allow",
             "Action": [
-                "waf:ListActivatedRulesInRuleGroup",
-                "waf:ListRuleGroups"
+                "dynamodb:ListTables",
+                "dynamodb:DescribeTable",
+                "tag:GetResources",
+                "cloudwatch:GetMetricStatistics"
             ],
             "Resource": "*"
         }

diff --git a/terraform/ecc-aws-552-dynamodb_tables_unused/red/dynamodb.tf b/terraform/ecc-aws-552-dynamodb_tables_unused/red/dynamodb.tf
@@ -0,0 +1,13 @@
+resource "aws_dynamodb_table" "this" {
+  name         = "552_dynamodb_table_red"
+  hash_key     = "GreenTableHashKey"
+  billing_mode = "PROVISIONED"
+  read_capacity  = 1
+  write_capacity = 1
+
+
+  attribute {
+    name = "GreenTableHashKey"
+    type = "S"
+  }
+}
diff --git a/...lobal_rulegroup_not_empty/red/provider.tf → ...52-dynamodb_tables_unused/red/provider.tf b/...lobal_rulegroup_not_empty/red/provider.tf → ...52-dynamodb_tables_unused/red/provider.tf
@@ -13,7 +13,7 @@ provider "aws" {
 
   default_tags {
     tags = {
-      CustodianRule     = "ecc-aws-916-waf_global_rulegroup_not_empty"
+      CustodianRule    = "ecc-aws-552-dynamodb_tables_unused"
       ComplianceStatus = "Red"
     }
   }

diff --git a/..._rulegroup_not_empty/red/terraform.tfvars → ...namodb_tables_unused/red/terraform.tfvars b/..._rulegroup_not_empty/red/terraform.tfvars → ...namodb_tables_unused/red/terraform.tfvars
diff --git a/...obal_rulegroup_not_empty/red/variables.tf → ...2-dynamodb_tables_unused/red/variables.tf b/...obal_rulegroup_not_empty/red/variables.tf → ...2-dynamodb_tables_unused/red/variables.tf
diff --git a/terraform/ecc-aws-916-waf_global_rulegroup_not_empty/green/waf.tf b/terraform/ecc-aws-916-waf_global_rulegroup_not_empty/green/waf.tf
diff --git a/terraform/ecc-aws-916-waf_global_rulegroup_not_empty/red/waf.tf b/terraform/ecc-aws-916-waf_global_rulegroup_not_empty/red/waf.tf
diff --git a/tests/ecc-aws-552-dynamodb_tables_unused/placebo-green/dynamodb.DescribeTable_1.json b/tests/ecc-aws-552-dynamodb_tables_unused/placebo-green/dynamodb.DescribeTable_1.json
@@ -0,0 +1,42 @@
+{
+    "status_code": 200,
+    "data": {
+        "Table": {
+            "AttributeDefinitions": [
+                {
+                    "AttributeName": "GreenTableHashKey",
+                    "AttributeType": "S"
+                }
+            ],
+            "TableName": "552_dynamodb_table_green",
+            "KeySchema": [
+                {
+                    "AttributeName": "GreenTableHashKey",
+                    "KeyType": "HASH"
+                }
+            ],
+            "TableStatus": "ACTIVE",
+            "CreationDateTime": {
+                "__class__": "datetime",
+                "year": 2023,
+                "month": 3,
+                "day": 14,
+                "hour": 16,
+                "minute": 44,
+                "second": 5,
+                "microsecond": 334000
+            },
+            "ProvisionedThroughput": {
+                "NumberOfDecreasesToday": 0,
+                "ReadCapacityUnits": 1,
+                "WriteCapacityUnits": 1
+            },
+            "TableSizeBytes": 57,
+            "ItemCount": 1,
+            "TableArn": "arn:aws:dynamodb:us-east-1:123456789012:table/552_dynamodb_table_green",
+            "TableId": "352e6eb5-5243-487d-8b54-8d99a47658ad",
+            "DeletionProtectionEnabled": false
+        },
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/ecc-aws-552-dynamodb_tables_unused/placebo-green/dynamodb.ListTables_1.json b/tests/ecc-aws-552-dynamodb_tables_unused/placebo-green/dynamodb.ListTables_1.json
@@ -0,0 +1,9 @@
+{
+    "status_code": 200,
+    "data": {
+        "TableNames": [
+            "552_dynamodb_table_green"
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/ecc-aws-552-dynamodb_tables_unused/placebo-green/monitoring.GetMetricStatistics_1.json b/tests/ecc-aws-552-dynamodb_tables_unused/placebo-green/monitoring.GetMetricStatistics_1.json
@@ -0,0 +1,23 @@
+{
+    "status_code": 200,
+    "data": {
+        "Label": "ConsumedWriteCapacityUnits",
+        "Datapoints": [
+            {
+                "Timestamp": {
+                    "__class__": "datetime",
+                    "year": 2023,
+                    "month": 6,
+                    "day": 17,
+                    "hour": 7,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "Maximum": 1.0,
+                "Unit": "Count"
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/ecc-aws-552-dynamodb_tables_unused/placebo-green/monitoring.GetMetricStatistics_2.json b/tests/ecc-aws-552-dynamodb_tables_unused/placebo-green/monitoring.GetMetricStatistics_2.json
@@ -0,0 +1,23 @@
+{
+    "status_code": 200,
+    "data": {
+        "Label": "ConsumedReadCapacityUnits",
+        "Datapoints": [
+            {
+                "Timestamp": {
+                    "__class__": "datetime",
+                    "year": 2023,
+                    "month": 6,
+                    "day": 17,
+                    "hour": 7,
+                    "minute": 0,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "Maximum": 0.5,
+                "Unit": "Count"
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/ecc-aws-552-dynamodb_tables_unused/placebo-green/tagging.GetResources_1.json b/tests/ecc-aws-552-dynamodb_tables_unused/placebo-green/tagging.GetResources_1.json
@@ -0,0 +1,22 @@
+{
+    "status_code": 200,
+    "data": {
+        "PaginationToken": "",
+        "ResourceTagMappingList": [
+            {
+                "ResourceARN": "arn:aws:dynamodb:us-east-1:123456789012:table/552_dynamodb_table_green",
+                "Tags": [
+                    {
+                        "Key": "CustodianRule",
+                        "Value": "ecc-aws-552-dynamodb_tables_unused"
+                    },
+                    {
+                        "Key": "ComplianceStatus",
+                        "Value": "Green"
+                    }
+                ]
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/ecc-aws-552-dynamodb_tables_unused/placebo-red/dynamodb.DescribeTable_1.json b/tests/ecc-aws-552-dynamodb_tables_unused/placebo-red/dynamodb.DescribeTable_1.json
@@ -0,0 +1,42 @@
+{
+    "status_code": 200,
+    "data": {
+        "Table": {
+            "AttributeDefinitions": [
+                {
+                    "AttributeName": "GreenTableHashKey",
+                    "AttributeType": "S"
+                }
+            ],
+            "TableName": "552_dynamodb_table_red",
+            "KeySchema": [
+                {
+                    "AttributeName": "GreenTableHashKey",
+                    "KeyType": "HASH"
+                }
+            ],
+            "TableStatus": "ACTIVE",
+            "CreationDateTime": {
+                "__class__": "datetime",
+                "year": 2023,
+                "month": 2,
+                "day": 15,
+                "hour": 10,
+                "minute": 30,
+                "second": 45,
+                "microsecond": 876000
+            },
+            "ProvisionedThroughput": {
+                "NumberOfDecreasesToday": 0,
+                "ReadCapacityUnits": 1,
+                "WriteCapacityUnits": 1
+            },
+            "TableSizeBytes": 0,
+            "ItemCount": 0,
+            "TableArn": "arn:aws:dynamodb:us-east-1:123456789012:table/552_dynamodb_table_red",
+            "TableId": "0918e866-a87a-42fd-be35-f8d7b4f29632",
+            "DeletionProtectionEnabled": false
+        },
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/ecc-aws-552-dynamodb_tables_unused/placebo-red/dynamodb.ListTables_1.json b/tests/ecc-aws-552-dynamodb_tables_unused/placebo-red/dynamodb.ListTables_1.json
@@ -0,0 +1,9 @@
+{
+    "status_code": 200,
+    "data": {
+        "TableNames": [
+            "552_dynamodb_table_red"
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/ecc-aws-552-dynamodb_tables_unused/placebo-red/monitoring.GetMetricStatistics_1.json b/tests/ecc-aws-552-dynamodb_tables_unused/placebo-red/monitoring.GetMetricStatistics_1.json
@@ -0,0 +1,23 @@
+{
+    "status_code": 200,
+    "data": {
+        "Label": "ConsumedWriteCapacityUnits",
+        "Datapoints": [
+            {
+                "Timestamp": {
+                    "__class__": "datetime",
+                    "year": 2023,
+                    "month": 7,
+                    "day": 17,
+                    "hour": 7,
+                    "minute": 35,
+                    "second": 0,
+                    "microsecond": 0
+                },
+                "Maximum": 0.0,
+                "Unit": "Count"
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}