Continuous Delivery of AWS Config Rule in multi-account using Cloudformation or Terraform
By: Ripon Banik
Tags: Cloudformation, Rdk, Continuous Delivery, Terraform, Aws Config

Continuous Delivery of AWS Config Rule in multi-account using Cloudformation or Terraform Ripon Banik Follow Sep 1 · 4 min read

Ensure continuous compliance via pipeline

AWS Rule Development Kit (RDK) supports Compliance as Code workflow to to allow you build and local test config rule from your workstation, deploy it to dev environment and promote it to production.

In this article, I will walk through to deploy it to AWS multi-account configuration where the Evaluation Logic using Lambda is deployed into a central account e.g. Security Account and config rules are deployed in the workload accounts.

Pre-requisites

The AWS Accounts will require AWS Config Bucket, Recorder and Delivery Channel to be configured. rdk is installed in the development workstation and in the Jenkins Pipeline. AWS Credentials are configured in the environment. S3 Bucket is created into the development and security account to deploy the lambda code.

Solution Overview

The following diagram shows the development workflow of AWS Config Rule using RDK.

Here is how it works:

The developer build config rule and unit test in his workstation using rdk.

Developer deploy the rule to the development account and test it.

Developer creates the cloudformation/terraform manifest file.

When the code is pushed to git, Jenkins pipeline kicks in and deploy to the security and workload accounts.

When the config rule works in development environment, it is promoted to deploy the function only to Security Account and config rule in Workload Account.

Develop and Build

Let’s go through an example walkthrough to create a config rule, test and deploy it.

Install the RDK and RDKlib locally

pip3 install rdk

pip3 install rdklib

rdklib is needed only if you would like to use existing lambda layer to build the rules.

Create a Rule and Deploy to development account

Let’s create a rule that checks AWS Security Group compliance.

rdk create SG_CHECK --runtime python3.8 --resource-types AWS::EC2::SecurityGroup

It creates the following files — SG_CHECK.py contains the lambda code, SG_CHECK_test.py contains the unit tests and parameter used by rdk deploy.

Add your custom evaluation logic under “Add your custom logic here” in the SG_CHECK.py

Let’s run a local test and verify that it gives OK.

rdk test-local SG_CHECK

Let’s deploy the resources into the development account.

rdk deploy SG_CHECK --custom-code-bucket my-lambda-bucket

When the deployment is complete, let’s verify from AWS Cloudformation Console that cloudformation stack is completed.

Also verify from AWS Config Console that rule is created.

To cleanup the deployment use the following command -

rdk undeploy SG_CHECK

Deployment

You can either deploy the lambda and config rule via Cloudformation or Terraform. Please follow the steps according to your need.

Create Cloudformation resources for deployment

To make the rule is ready to be deployed via Jenkins pipeline into the Security and Workload account, we need to follow two steps -

Deploy to security account — run the following command to deploy the lambda function into security account.

rdk deploy SG_CHECK --functions-only --custom-code-bucket my-lambda-bucket

Create cloudformation template for workload account — run the follow command to create cloudformation template containing config rule.

rdk create-rule-template SG_CHECK --rules-only -o config-rule-template.json

It will create a json template but will not create the cross account lambda role. Let’s convert it to yaml and add lambda role as well.

You can deploy the above using stackset if you want to deploy it into multiple workload accounts.

Also before pushing the code to git, make sure to change SG_CHECK.py file to asssume role as true. Lambda by default use the IAM role created above called config-role.

ASSUME_ROLE_MODE = True

Create Terraform resources for deployment

rdk also allow you to export the resources as terraform manifest as well. You can use the command below to export it as terraform manifest.

rdk export SG_CHECK -f terraform -v 0.12

You can test this to deploy it to development environment using the command below. But to deploy it into security and workload account, you need to split them.

terraform init terraform plan -var-file=sg_check.tfvars.json --var source_bucket=my-lambda-bucket

You may also need to change the provider in the sg_check_rule.tf file if you are not using default profile.

provider "aws" { profile = "default" }

Conclusion

In summary, rdk provides seamless developer experience while building the config rule in development environment and deploy it to stages. This article will help you to get started with your continuous compliance journey by building config rule at scale.

References