FMS Shield Resource Policy Should Be Enabled

More Info:

Checks whether an Application Load Balancer, Amazon CloudFront distributions, Elastic Load Balancer or Elastic IP has AWS Shield protection. It also checks if they have web ACL associated for Application Load Balancer and Amazon CloudFront distributions.

Risk Level

Medium

Address

Security

Compliance Standards

CBP

Triage and Remediation

Remediation

Using Console

Using CLI

To enable FMS Shield Resource Policy for AWS CloudWatch using AWS CLI, follow these steps:

Open your terminal and ensure that you have the AWS CLI installed and configured with the necessary permissions to make changes to AWS resources.
Run the following AWS CLI command to enable FMS Shield Resource Policy for AWS CloudWatch:

aws fms put-policy --policy-id AWSManagedRulesCommonFWRuleSet --resource-type RESOURCE_TYPE --resource-id RESOURCE_ID

Replace RESOURCE_TYPE with the type of AWS resource you want to protect (e.g., AWS::CloudWatch::Alarm) and RESOURCE_ID with the specific resource ID you want to apply the policy to.

Verify that the FMS Shield Resource Policy has been successfully enabled for AWS CloudWatch by running the following command:

aws fms list-policies

You should see the newly created policy in the list of policies returned by this command.By following these steps, you should be able to remediate the misconfiguration and enable FMS Shield Resource Policy for AWS CloudWatch using AWS CLI.

Using Python

To remediate the misconfiguration of FMS Shield Resource Policy not being enabled for AWS CloudWatch using Python, you can use the AWS SDK for Python (Boto3) to update the resource policy. Here are the step-by-step instructions:

Install Boto3: If you haven’t already installed Boto3, you can install it using pip:
```
pip install boto3
```
Create a Python script with the following code to enable the FMS Shield Resource Policy for CloudWatch:

import boto3

def enable_fms_shield_policy():
    # Create a CloudWatch client
    cloudwatch_client = boto3.client('cloudwatch')

    # Enable the FMS Shield Resource Policy for CloudWatch
    response = cloudwatch_client.put_metric_policy(
        PolicyName='FMS-Shield-Policy',
        PolicyDocument='{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"Service": "shield.amazonaws.com"},"Action": "cloudwatch:PutMetricData","Resource": "*"}]}'
    )

    print('FMS Shield Resource Policy has been enabled for CloudWatch.')

if __name__ == '__main__':
    enable_fms_shield_policy()

Run the Python script: Save the Python script with a .py extension and run it using the Python interpreter. Make sure your AWS credentials are properly configured on your system.
```
python enable_fms_shield_policy.py
```
Verify the policy: After running the script, verify that the FMS Shield Resource Policy has been successfully enabled for CloudWatch by checking the CloudWatch console or by listing the CloudWatch resource policies using the AWS CLI:
```
aws cloudwatch list-metric-policies
```

By following these steps, you can remediate the misconfiguration of the FMS Shield Resource Policy not being enabled for AWS CloudWatch using Python and Boto3.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

FMS Shield Resource Policy Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation