Skip to content

Commit c49a545

Browse files
author
Lucas-Irvine
authored
aws - cw log-group kms-key filter (cloud-custodian#6460)
1 parent b8308a3 commit c49a545

File tree

10 files changed

+161
-0
lines changed

10 files changed

+161
-0
lines changed

‎c7n/resources/cw.py‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
from c7n.filters import Filter, MetricsFilter
99
from c7n.filters.core import parse_date
1010
from c7n.filters.iamaccess import CrossAccountAccessFilter
11+
from c7n.filters.kms import KmsRelatedFilter
1112
from c7n.query import QueryResourceManager, ChildResourceManager, TypeInfo
1213
from c7n.manager import resources
1314
from c7n.resolver import ValuesFrom
@@ -437,6 +438,29 @@ def process_resource_set(self, client, accounts, resources):
437438
return results
438439

439440

441+
@LogGroup.filter_registry.register('kms-key')
442+
class KmsFilter(KmsRelatedFilter):
443+
"""
444+
Filter a resource by its associcated kms key and optionally the aliasname
445+
of the kms key by using 'c7n:AliasName'
446+
447+
:example:
448+
449+
.. code-block:: yaml
450+
451+
policies:
452+
- name: cw-log-group-kms-key-filter
453+
resource: log-group
454+
filters:
455+
- type: kms-key
456+
key: c7n:AliasName
457+
value: "^(alias/cw)"
458+
op: regex
459+
"""
460+
461+
RelatedIdsExpression = 'kmsKeyId'
462+
463+
440464
@LogGroup.action_registry.register('set-encryption')
441465
class EncryptLogGroup(BaseAction):
442466
"""Encrypt/Decrypt a log group

‎tests/data/placebo/test_log_group_kms_filter/kms.DescribeKey_1.json‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"KeyMetadata": {
5+
"AWSAccountId": "123456789012",
6+
"KeyId": "beedfd51-5158-44ae-a95f-d514f61abfb3",
7+
"Arn": "arn:aws:kms:us-east-1:123456789012:key/beedfd51-5158-44ae-a95f-d514f61abfb3",
8+
"Enabled": true,
9+
"Description": "",
10+
"KeyUsage": "ENCRYPT_DECRYPT",
11+
"KeyState": "Enabled",
12+
"Origin": "AWS_KMS",
13+
"KeyManager": "CUSTOMER",
14+
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
15+
"EncryptionAlgorithms": [
16+
"SYMMETRIC_DEFAULT"
17+
]
18+
},
19+
"ResponseMetadata": {}
20+
}
21+
}

‎tests/data/placebo/test_log_group_kms_filter/kms.DescribeKey_2.json‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"KeyMetadata": {
5+
"AWSAccountId": "123456789012",
6+
"KeyId": "beedfd51-5158-44ae-a95f-d514f61abfb3",
7+
"Arn": "arn:aws:kms:us-east-1:123456789012:key/beedfd51-5158-44ae-a95f-d514f61abfb3",
8+
"Enabled": true,
9+
"Description": "",
10+
"KeyUsage": "ENCRYPT_DECRYPT",
11+
"KeyState": "Enabled",
12+
"Origin": "AWS_KMS",
13+
"KeyManager": "CUSTOMER",
14+
"CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
15+
"EncryptionAlgorithms": [
16+
"SYMMETRIC_DEFAULT"
17+
]
18+
},
19+
"ResponseMetadata": {}
20+
}
21+
}

‎tests/data/placebo/test_log_group_kms_filter/kms.ListAliases_1.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"Aliases": [
5+
{
6+
"AliasName": "alias/cw",
7+
"AliasArn": "arn:aws:kms:us-east-1:123456789012:alias/cw",
8+
"TargetKeyId": "beedfd51-5158-44ae-a95f-d514f61abfb3"
9+
}
10+
],
11+
"Truncated": false,
12+
"ResponseMetadata": {}
13+
}
14+
}

‎tests/data/placebo/test_log_group_kms_filter/kms.ListAliases_2.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"Aliases": [
5+
{
6+
"AliasName": "alias/cw",
7+
"AliasArn": "arn:aws:kms:us-east-1:123456789012:alias/cw",
8+
"TargetKeyId": "beedfd51-5158-44ae-a95f-d514f61abfb3"
9+
}
10+
],
11+
"Truncated": false,
12+
"ResponseMetadata": {}
13+
}
14+
}

‎tests/data/placebo/test_log_group_kms_filter/kms.ListAliases_3.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"Aliases": [
5+
{
6+
"AliasName": "alias/cw",
7+
"AliasArn": "arn:aws:kms:us-east-1:123456789012:alias/cw",
8+
"TargetKeyId": "beedfd51-5158-44ae-a95f-d514f61abfb3"
9+
}
10+
],
11+
"Truncated": false,
12+
"ResponseMetadata": {}
13+
}
14+
}

‎tests/data/placebo/test_log_group_kms_filter/logs.DescribeLogGroups_1.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"logGroups": [
5+
{
6+
"logGroupName": "test",
7+
"metricFilterCount": 0,
8+
"arn": "arn:aws:logs:us-east-1:123456789012:log-group:test:*",
9+
"storedBytes": 0,
10+
"kmsKeyId": "arn:aws:kms:us-east-1:123456789012:key/beedfd51-5158-44ae-a95f-d514f61abfb3"
11+
}
12+
],
13+
"ResponseMetadata": {}
14+
}
15+
}

‎tests/data/placebo/test_log_group_kms_filter/tagging.GetResources_1.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"PaginationToken": "",
5+
"ResourceTagMappingList": [],
6+
"ResponseMetadata": {}
7+
}
8+
}

‎tests/data/placebo/test_log_group_kms_filter/tagging.GetResources_2.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"status_code": 200,
3+
"data": {
4+
"PaginationToken": "",
5+
"ResourceTagMappingList": [],
6+
"ResponseMetadata": {}
7+
}
8+
}

‎tests/test_cwl.py‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,28 @@ def test_cross_account(self):
4747
self.assertEqual(len(resources), 1)
4848
self.assertEqual(resources[0]["c7n:CrossAccountViolations"], ["1111111111111"])
4949

50+
def test_kms_filter(self):
51+
session_factory = self.replay_flight_data('test_log_group_kms_filter')
52+
kms = session_factory().client('kms')
53+
p = self.load_policy(
54+
{
55+
'name': 'test-log-group-kms-filter',
56+
'resource': 'log-group',
57+
'filters': [
58+
{
59+
'type': 'kms-key',
60+
'key': 'c7n:AliasName',
61+
'value': 'alias/cw'
62+
}
63+
]
64+
},
65+
session_factory=session_factory
66+
)
67+
resources = p.run()
68+
self.assertTrue(len(resources), 1)
69+
aliases = kms.list_aliases(KeyId=resources[0]['kmsKeyId'])
70+
self.assertEqual(aliases['Aliases'][0]['AliasName'], 'alias/cw')
71+
5072
def test_age_normalize(self):
5173
factory = self.replay_flight_data("test_log_group_age_normalize")
5274
p = self.load_policy({

0 commit comments

Comments
 (0)