Merge pull request #103 from andywick-aws/checkov-rule-suppressions

Added Checkov rule suppressions, dependency updates, Macie Lambda updates

Author: andywick-aws

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## Table of Contents<!-- omit in toc -->
 
 - [Introduction](#introduction)
+- [2022-07-15](#2022-07-15)
 - [2022-05-23](#2022-05-23)
 - [2022-05-15](#2022-05-15)
 - [2022-04-25](#2022-04-25)
@@ -29,6 +30,18 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## 2022-07-15
+
+### Changed<!-- omit in toc -->
+
+- Added Checkov Lambda Function suppressions for CKV_AWS_115 (Reserved Concurrent Executions) and CKV_AWS_117 (Run within a VPC) to all solution templates with Lambda Function configurations.
+- Updated Lambda python files to fix mypy finding for log_level to always be a string value.
+- Updated the [customizations-for-aws-control-tower.template](aws_sra_examples/solutions/common/common_cfct_setup/templates/customizations-for-aws-control-tower.template) to the latest version v2.4.0 and added Checkov suppressions.
+- Updated pyproject.toml dependencies to the latest versions.
+- Updated [Macie](aws_sra_examples/solutions/macie/macie_org) solution to increase retries and handle API errors when creating existing members.
+- Updated [EC2 Default EBS Encryption](aws_sra_examples/solutions/ec2/ec2_default_ebs_encryption) to include default string value for the pExcludeEC2DefaultEBSEncryptionTags parameter.
+- Updated [Account Alternate Contacts](aws_sra_examples/solutions/account/account_alternate_contacts) to include default string value for the pExcludeAlternateContactAccountTags parameter.
+
 ## 2022-05-23
 
 ### Changed<!-- omit in toc -->
@@ -117,7 +130,6 @@ All notable changes to this project will be documented in this file.
 ### Removed<!-- omit in toc -->
 
 - Removed the sra-common-cfct-setup-main-ssm.yaml template as it was the same as the other main template.
-  > > > > > > > 035d75801d00b0f08affe2bf91d7cbfeade1820f
 
 ## 2022-03-16
 

aws_sra_examples/solutions/account/account_alternate_contacts/lambda/src/app.py

@@ -32,7 +32,7 @@
 
 # Setup Default Logger
 LOGGER = logging.getLogger("sra")
-log_level = os.environ.get("LOG_LEVEL", logging.ERROR)
+log_level: str = os.environ.get("LOG_LEVEL", "ERROR")
 LOGGER.setLevel(log_level)
 
 # Global Variables

aws_sra_examples/solutions/account/account_alternate_contacts/templates/sra-account-alternate-contacts-main-ssm.yaml

@@ -169,6 +169,7 @@ Parameters:
     Type: String
   pExcludeAlternateContactAccountTags:
     AllowedPattern: '^$|.*'
+    Default: ''
     Description:
       '(Optional) Resource Tags that denote an Account should be excluded from this solution in JSON format: [{"Key": "string", "Value": "string"},
       ... ]. For example, [{"Key": "exclude-alternate-contacts", "Value": "true"}].'

aws_sra_examples/solutions/account/account_alternate_contacts/templates/sra-account-alternate-contacts-main.yaml

@@ -168,6 +168,7 @@ Parameters:
     Type: String
   pExcludeAlternateContactAccountTags:
     AllowedPattern: '^$|.*'
+    Default: ''
     Description:
       '(Optional) Resource Tags that denote an Account should be excluded from this solution in JSON format: [{"Key": "string", "Value": "string"},
       ... ]. For example, [{"Key": "exclude-alternate-contacts", "Value": "true"}].'

aws_sra_examples/solutions/account/account_alternate_contacts/templates/sra-account-alternate-contacts.yaml

@@ -487,6 +487,10 @@ Resources:
             reason: Lambda does not need reserved concurrent executions.
       checkov:
         skip:
+          - id: CKV_AWS_115
+            comment: Lambda does not need reserved concurrent executions.
+          - id: CKV_AWS_117
+            comment: Lambda does not need to communicate with VPC resources.
           - id: CKV_AWS_173
             comment: Environment variables are not sensitive
     Properties:

aws_sra_examples/solutions/cloudtrail/cloudtrail_org/lambda/src/app.py

@@ -25,7 +25,7 @@
 
 # Setup Default Logger
 LOGGER = logging.getLogger(__name__)
-log_level = os.environ.get("LOG_LEVEL", logging.ERROR)
+log_level: str = os.environ.get("LOG_LEVEL", "ERROR")
 LOGGER.setLevel(log_level)
 
 # Initialize the helper

aws_sra_examples/solutions/cloudtrail/cloudtrail_org/templates/sra-cloudtrail-org.yaml

@@ -383,8 +383,12 @@ Resources:
             reason: Lambda does not need reserved concurrent executions.
       checkov:
         skip:
+          - id: CKV_AWS_115
+            comment: Lambda does not need reserved concurrent executions.
           - id: CKV_AWS_116
             comment: DLQ not needed, as Lambda function only triggered by CloudFormation events.
+          - id: CKV_AWS_117
+            comment: Lambda does not need to communicate with VPC resources.
           - id: CKV_AWS_173
             comment: Environment variables are not sensitive
     Properties: