AWS/FredsCloudMonitor: Event Driven Guardrails for AWS @ cf0ca5c397275ee3b90eb7dab9e44b32d96de81e

Architecture

Input->SNS->(1 or more) SQS->Analysis Function->Reporting SNS->(1 or more) Reporting SQS->Reporting Function
                                              |
                                              +->Remediation SQS->Remediation Function->Reporting SNS->(1 or more) Reporting SQS->Reporting Function

Inputs

Inputs put things in motion.

Naming Convention: None

Features:

CloudWatch Events Rules
- Can be API calls or responses to AWS Config
- From external accounts, puts the event on the main account's event bus.
"Custom" entry (Message sent to SNS topic), such as a request to scan for an issue.

SNS Distribution

There are SNS Topics to distribute from the inputs:

Naming Convention: fcm-input-[eventName] or fcm-input-custom-[typename]

Features:

For each API eventName, named fcm-input-[eventName]
For each custom type, named fcm-input-custom-[typename]

SQS Queues for Analysis:

SQS queues allow a many-to-one relationship between analysis functions and inputs. A single event/input can fan out to multiple functions.

Naming Convention: fcm-analysis-[functionname].

Function Name:

Each analysis function, there is an sqs queue named fcm-analysis-[functionname].
This SQS queue can be subscribed to one or more SNS topic. It is up to the function to determine what it is able to process.

Analysis Functions:

Provide a read-only analysis of the input event.

Naming convention: fcm-analysis-[functionname]

Lambda functions process the analysis SQS queues.
As output, they report result of analysis to the Reporting SNS Topic.
If remediation is warranted and possible, send entry to appropriate Remediation SQS Topic.

SQS Queues for Remediation

Provide a queue for remediation, if applicable.

Naming Convention: fcm-remediation-[functionname]

Lambda function to process output from analysis function and remediate.
Report output to Reporting SNS Topic.

Reporting SNS Topic

Allows fanout of the reporting, or direct subscription based reporting.

Naming Convention: fcm-reporting

Reporter SQS Queue

One or more queues, subscribed to the reporting SNS topic. Each queue goes to an individual reporter function.

Naming Convention: fcm-reporting-[functionname]

Reporter Function

A function that formats and records the results.