Skip to content
shield

GitHub Action

guard-action

1.0 Latest version

guard-action

shield

guard-action

Guard ShiftLeft

Installation

Copy and paste the following snippet into your .yml file.

              

- name: guard-action

uses: grolston/guard-action@1.0

Learn more about this action in grolston/guard-action

Choose a version

Guard-Action

A simple GitHub Action for AWS CloudFormation static code analysis to improve infrastructure-as-code security using AWS cfn-guard.

The Action does not require AWS credentials!

It gets better: Guard Rules in this github action can be suppressed at the resource-level! See Guard Rule Suppression to learn how to leverage in your code.

Inputs

data_directory

The directory of the repo to scan the cloudformation templates.

rule_set

The AWS Guard rule set used to run security test. Options are:

Example Managed Rule Set rule_set parameter
ABS Cloud Computing Implementation Guide 2.0 - Material Workloads ABS-CCIGv2-Material
ABS Cloud Computing Implementation Guide 2.0 - Standard Workloads ABS-CCIGv2-Standard
Australian Cyber Security Centre (ACSC) Essential Eight Maturity Model acsc-essential-8
Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) 2020-06 acsc-ism
Australian Prudential Regulation Authority (APRA) CPG 234 apra-cpg-234
Bank Negara Malaysia (BNM) Risk Management in Technology (RMiT) bnm-rmit
Center for Internet Security (CIS) Amazon Web Services Foundation v1.4 Level 1 cis-aws-benchmark-level-1
Center for Internet Security (CIS) Amazon Web Services Foundation v1.4 Level2 cis-aws-benchmark-level-2
Center for Internet Security (CIS) Critical Security Controls v8 IG1 cis-critical-security-controls-v8-ig1
Center for Internet Security (CIS) Critical Security Controls v8 IG2 cis-critical-security-controls-v8-ig2
Center for Internet Security (CIS) Critical Security Controls v8 IG3 cis-critical-security-controls-v8-ig3
Center for Internet Security (CIS) Top 20 Critical Security Controls cis-top-20
Cybersecurity & Infrastructure Security Agency (CISA) Cyber Essentials (CE) cisa-ce
Cybersecurity Maturity Model Certification (CMMC) Level 1 cmmc-level-1
Cybersecurity Maturity Model Certification (CMMC) Level 2 cmmc-level-2
Cybersecurity Maturity Model Certification (CMMC) Level 3 cmmc-level-3
Cybersecurity Maturity Model Certification (CMMC) Level 4 cmmc-level-4
Cybersecurity Maturity Model Certification (CMMC) Level 5 cmmc-level-5
European Union Agency for Cybersecurity (ENISA) Cybersecurity guide for SMEs enisa-cybersecurity-guide-for-smes
Spain Esquema Nacional de Seguridad (ENS) High framework controls ens-high
Spain Esquema Nacional de Seguridad (ENS) Low framework controls ens-low
Spain Esquema Nacional de Seguridad (ENS) Medium framework controls ens-medium
Title 21 of the Code of Federal Regulations (CFR) Part 11 FDA-21CFR-Part-11
Federal Risk and Authorization Management Program (FedRAMP) Moderate fedramp-moderate
Federal Risk and Authorization Management Program (FedRAMP) Low fedramp-low
Federal Financial Institutions Examination Council (FFIEC) Cyber Security Assessment Tool domains ffiec
Health Insurance Portability and Accountability Act (HIPAA) hipaa-security
Korea – Information Security Management System (ISMS) k-isms
Monetary Authority of Singapore (MAS) Notice 655 – Cyber Hygiene mas-notice-655
Monetary Authority of Singapore (MAS) Technology Risk Management Guidelines (TRMG) January 2021 mas-trmg
National Bank of Cambodia’s (NBC) Technology Risk Management (TRM) Guidelines framework nbc-trmg
UK National Cyber Security Centre (NCSC) Cyber Assessment Framework (CAF) controls ncsc-cafv3
K National Cyber Security Centre (NCSC) Cloud Security Principles ncsc
North American Electric Reliability Corporation Critical Infrastructure Protection Standards (NERC CIP) for BES Cyber System Information (BCSI), CIP-004-7 & CIP-011-3 nerc
NIST 1800-25 nist-1800-25
NIST 800-171 nist-800-171
NIST 800-172 nist-800-172
NIST 800-181 nist-800-181
NIST 800-53 Revision 4 NIST800-53Rev4
NIST 800-53 Revision 5 NIST800-53Rev5
NIST Cyber Security Framework (CSF) nist-csf
NIST Privacy Framework nist-privacy-framework
New Zealand Government Communications Security Bureau (GCSB) Information Security Manual (NZISM) nzism
Payment Card Industry Data Security Standard (PCI DSS) 3.2.1 PCI-DSS-3-2-1
Reserve Bank of India (RBI) Cyber Security Framework for Urban Cooperative Banks (UCBs) rbi-bcsf-ucb
Reserve Bank of India (RBI) Master Direction – Information Technology Framework rbi-md-itf
New York State Department Of Financial Services (NYDFS) cybersecurity requirements for financial services companies (23 NYCRR 500) us-nydfs
Amazon Web Services' Well-Architected Framework Reliability Pillar wa-Reliability-Pillar
AWS Guard rule set for Amazon Web Services' Well-Architected Framework Security Pillar wa-Security-Pillar

Usage

To get started simply add a workflow .yml file (name it whatever you would like) to your .github/workflows folder. Refer to the documentation on workflow YAML syntax here..

Example

The following example tests CloudFormation with the FedRAMP-Moderate example rule set:

name: sast

on: [push]

jobs:
  ## Guard rule set FedRAMP-Moderate
  sast-guard:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - uses: grolston/guard-action@main
      with:
        data_directory: './cloudformation/' ## change to your template directory
        rule_set: "FedRAMP-Moderate"

The following example tests CloudFormation with the cis-aws-benchmark-level-1 example rule set:

name: sast

on: [push]

jobs:
  ## Guard rule set cis-aws-benchmark-level-1
  sast-guard:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - uses: grolston/guard-action@main
      with:
        data_directory: './cloudformation/' ## change to your template directory
        rule_set: "cis-aws-benchmark-level-1"

Guard Rule Suppression

The rules build in guard-action support resource-level rule suppression. Suppressed Rules are marked as SKIP in the validation process. To suppress a rule add in to the resource metadata the following Metadata:

YAML: Suppressing rule EC2_INSTANCE_PROFILE_ATTACHED

Resources:
  ExampleEC2:
    Type: AWS::EC2::Instance
    Metadata:
      guard:
        SuppressedRules:
        - EC2_INSTANCE_PROFILE_ATTACHED

JSON: Suppressing rule ELASTICSEARCH_ENCRYPTED_AT_REST

"Resources": {
  "ElasticsearchDomain": {
    "Type": "AWS::Elasticsearch::Domain",
    "Metadata": {
      "guard": {
        "SuppressedRules": ["ELASTICSEARCH_ENCRYPTED_AT_REST"]
      }
    },
    "Properties": {
      "DomainName": "test"
    }
  }
}

License

This project is distributed under the Apache 2.0.