Class: Terrafying::Components::Auditd

Inherits:
Object
  • Object
show all
Defined in:
lib/terrafying/components/auditd.rb

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.fluentd_conf(ignition, role, tags = []) ⇒ Object 



6
7
8
 
# File 'lib/terrafying/components/auditd.rb', line 6

def self.fluentd_conf(ignition, role, tags = [])
  new.fluentd_conf(ignition, role, tags)
end

Instance Method Details

#allow_assume(role) ⇒ Object 



58
59
60
61
62
63
64
 
# File 'lib/terrafying/components/auditd.rb', line 58

def allow_assume(role)
  {
    Effect: 'Allow',
    Action: ['sts:AssumeRole'],
    Resource: [role]
  }
end

#allow_describe_instances ⇒ Object 



50
51
52
53
54
55
56
 
# File 'lib/terrafying/components/auditd.rb', line 50

def allow_describe_instances
  {
    Effect: 'Allow',
    Action: %w[ec2:DescribeInstances ec2:DescribeTags ec2:DescribeRouteTables],
    Resource: ['*']
  }
end

#custom_tags(tags) ⇒ Object 



28
29
30
 
# File 'lib/terrafying/components/auditd.rb', line 28

def custom_tags(tags)
  tags.map { |t| [t, wrap_tag(t)] }.to_h
end

#default_tags ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
48
 
# File 'lib/terrafying/components/auditd.rb', line 37

def default_tags
  {
    name: 'tagset_name',
    instance_id: 'instance_id',
    instance_type: 'instance_type',
    private_ip: 'private_ip',
    az: 'availability_zone',
    vpc_id: 'vpc_id',
    ami_id: 'image_id',
    account_id: 'account_id'
  }
end

#ec2_filter(ignition, tags) ⇒ Object 



106
107
108
109
110
111
112
113
114
115
116
117
118
119
 
# File 'lib/terrafying/components/auditd.rb', line 106

def ec2_filter(ignition, tags)
  file_of(
    '20_auditd_filter_ec2',
    <<~EC2_FILTER
      <filter auditd>
        @type ec2_metadata
        metadata_refresh_seconds 300
        <record>
          #{map_tags(ignition, tags)}
        </record>
      </filter>
    EC2_FILTER
  )
end

#file_of(name, content) ⇒ Object 



66
67
68
69
70
71
72
 
# File 'lib/terrafying/components/auditd.rb', line 66

def file_of(name, content)
  {
    path: "/etc/fluentd/conf.d/#{name}.conf",
    mode: 0o644,
    contents: content
  }
end

#fluentd_conf(ignition, role, tags) ⇒ Object 



10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
 
# File 'lib/terrafying/components/auditd.rb', line 10

def fluentd_conf(ignition, role, tags)
  tags = default_tags.merge(
    custom_tags(tags)
  )

  {
    files: [
      systemd_input,
      ec2_filter(ignition, tags),
      s3_output(ignition, role)
    ],
    iam_policy_statements: [
      allow_describe_instances,
      allow_assume(role)
    ]
  }
end

#map_tags(ignition, tags) ⇒ Object 



121
122
123
124
125
126
127
128
 
# File 'lib/terrafying/components/auditd.rb', line 121

def map_tags(ignition, tags)
  if ignition == false
    return tags.map { |k, v| "#{k} $${#{v}}" }
            .reduce { |out, e| +out << "\n    #{e}" }
  end
  return tags.map { |k, v| "#{k} ${#{v}}" }
            .reduce { |out, e| +out << "\n    #{e}" }
end

#s3_output(ignition, audit_role) ⇒ Object 



130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
 
# File 'lib/terrafying/components/auditd.rb', line 130

def s3_output(ignition, audit_role)
  if ignition == false
      return file_of(
           '30_auditd_output_s3',
           <<~S3_OUTPUT
             <match auditd>
               @type s3
               <assume_role_credentials>
                 role_arn #{audit_role}
                 role_session_name "auditd-logging-\#{Socket.gethostname}"
               </assume_role_credentials>
               auto_create_bucket false
               s3_bucket uswitch-auditd-logs
               s3_region eu-west-1
               acl bucket-owner-full-control
               path auditd/%Y/%m/%d/
               s3_object_key_format "\%%{path}\%%{time_slice}_\#{Socket.gethostname}.\%%{file_extension}"
               <buffer time>
                 @type file
                 path /fluent/var/s3
                 timekey 300 # 5 minute partitions
                 timekey_wait 0s
                 timekey_use_utc true
               </buffer>
               <format>
                 @type json
               </format>
             </match>
           S3_OUTPUT
         )
  end
    return file_of(
           '30_auditd_output_s3',
           <<~S3_OUTPUT
             <match auditd>
               @type s3
               <assume_role_credentials>
                 role_arn #{audit_role}
                 role_session_name "auditd-logging-\#{Socket.gethostname}"
               </assume_role_credentials>
               auto_create_bucket false
               s3_bucket uswitch-auditd-logs
               s3_region eu-west-1
               acl bucket-owner-full-control
               path auditd/%Y/%m/%d/
               s3_object_key_format "\%{path}\%{time_slice}_\#{Socket.gethostname}.\%{file_extension}"
               <buffer time>
                 @type file
                 path /fluent/var/s3
                 timekey 300 # 5 minute partitions
                 timekey_wait 0s
                 timekey_use_utc true
               </buffer>
               <format>
                 @type json
               </format>
             </match>
           S3_OUTPUT
         )
end

#systemd_input ⇒ Object 



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
 
# File 'lib/terrafying/components/auditd.rb', line 74

def systemd_input
  file_of(
    '10_auditd_input_systemd',
    <<~'SYSTEMD_INPUT'
      <source>
        @type systemd
        tag auditd
        filters [{ "_TRANSPORT": "audit" }, { "_COMM": "sshd" }]
        path /fluentd/log/journal
        read_from_head false
        <storage>
          @type local
          persistent false
          path /fluentd/var/audit.pos
        </storage>
        <entry>
          field_map {
            "MESSAGE": "log",
            "_PID": ["process", "pid"],
            "_CMDLINE": "process",
            "_COMM": "cmd",
            "_AUDIT_SESSION": "audit_session",
            "_AUDIT_LOGINUID": "audit_loginuid"
          }
          fields_strip_underscores true
          fields_lowercase true
        </entry>
      </source>
    SYSTEMD_INPUT
  )
end

#wrap_tag(t) ⇒ Object 



32
33
34
35
 
# File 'lib/terrafying/components/auditd.rb', line 32

def wrap_tag(t)
  t = "tagset_#{t}" unless t.to_s.start_with? 'tagset_'
  t.downcase
end