Day 17：Inspector for Lambda（CVE & 脆弱性管理の自動化）

{
  "packageName": "pillow",
  "installedVersion": "9.0.1",
  "vulnerabilityId": "CVE-2022-22817",
  "severity": "HIGH",
  "status": "ACTIVE",
  "fixAvailable": "YES"
}

aws inspector2 enable --resource-types LAMBDA --region ap-northeast-1
# コードスキャンまでやる場合
aws inspector2 enable --resource-types LAMBDA LAMBDA_CODE --region ap-northeast-1

{
  "source": ["aws.inspector2"],
  "detail-type": ["Inspector2 Finding"],
  "detail": {
    "severity": ["HIGH", "CRITICAL"],
    "status": ["ACTIVE"]
  }
}

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: Inspector2 findings -> EventBridge -> SNS notification (minimal)

Parameters:
  NotificationEmail:
    Type: String
    Description: "SNS notification email (subscription confirmation required)"
  EnableNotify:
    Type: String
    AllowedValues: ["true", "false"]
    Default: "true"

Conditions:
  IsNotifyEnabled: !Equals [!Ref EnableNotify, "true"]

Resources:
  InspectorFindingTopic:
    Type: AWS::SNS::Topic
    Condition: IsNotifyEnabled
    Properties:
      TopicName: !Sub "inspector-findings-${AWS::StackName}"

  InspectorFindingSubscription:
    Type: AWS::SNS::Subscription
    Condition: IsNotifyEnabled
    Properties:
      TopicArn: !Ref InspectorFindingTopic
      Protocol: email
      Endpoint: !Ref NotificationEmail

  # EventBridge が SNS に Publish できるようにする
  InspectorFindingTopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Condition: IsNotifyEnabled
    Properties:
      Topics:
        - !Ref InspectorFindingTopic
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: AllowEventBridgePublish
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
            Action: "sns:Publish"
            Resource: !Ref InspectorFindingTopic

  InspectorFindingRule:
    Type: AWS::Events::Rule
    Condition: IsNotifyEnabled
    Properties:
      Name: !Sub "inspector-findings-${AWS::StackName}"
      Description: "Notify Inspector2 findings (HIGH/CRITICAL + ACTIVE)"
      EventPattern:
        source:
          - "aws.inspector2"
        detail-type:
          - "Inspector2 Finding"
        detail:
          status:
            - "ACTIVE"
          severity:
            - "HIGH"
            - "CRITICAL"
      Targets:
        - Id: SnsTarget
          Arn: !Ref InspectorFindingTopic
          # そのまま投げると読みづらいので、最低限整形（任意）
          InputTransformer:
            InputPathsMap:
              severity: "$.detail.severity"
              title: "$.detail.title"
              type: "$.detail.type"
              resourceType: "$.detail.resources[0].type"
              resourceId: "$.detail.resources[0].id"
              vulnId: "$.detail.packageVulnerabilityDetails.vulnerabilityId"
              packageName: "$.detail.packageVulnerabilityDetails.vulnerablePackages[0].name"
              packageVer: "$.detail.packageVulnerabilityDetails.vulnerablePackages[0].version"
              fixAvail: "$.detail.packageVulnerabilityDetails.fixAvailable"
            InputTemplate: |
              "Inspector Finding: <severity>
              - title: <title>
              - type: <type>
              - resource: <resourceType> / <resourceId>
              - vulnerability: <vulnId>
              - package: <packageName> (<packageVer>)
              - fixAvailable: <fixAvail>"

Outputs:
  SnsTopicArn:
    Condition: IsNotifyEnabled
    Value: !Ref InspectorFindingTopic

version: 1
exclusions:
  - target:
      type: lambda
      function_name: "my-prod-function"
      function_arn: "arn:aws:lambda:ap-northeast-1:123456789012:function:my-prod-function"
      scan_type: "standard"   # standard | code
    tag:
      key: "InspectorExclusion"
      value: "LambdaStandardScanning"
    reason:
      summary: "依存がベンダ提供で更新不可。誤検知ではなく既知リスクとして受容。"
      ticket: "SEC-1234"
      compensating_controls:
        - "WAFで該当パス遮断"
        - "機密データ非取り扱い（データ分類: internal）"
    owner:
      team: "platform"
      approved_by: "security-reviewer"
      applied_by: "ci-bot"
    dates:
      applied_at: "2025-12-14"
      expires_at: "2026-03-31"  # 期限を必須化（棚卸し強制）
      next_review_at: "2026-01-31"

#!/usr/bin/env bash
set -euo pipefail

LEDGER="security/inspector-exclusions.yaml"

# 例：InspectorExclusion / InspectorCodeExclusion を持つ関数を列挙
aws lambda list-functions --query 'Functions[].FunctionArn' --output text \
| tr '\t' '\n' \
| while read -r arn; do
    tags_json=$(aws lambda list-tags --resource "$arn" --output json)
    if echo "$tags_json" | jq -e '.Tags.InspectorExclusion=="LambdaStandardScanning"' >/dev/null \
      || echo "$tags_json" | jq -e '.Tags.InspectorCodeExclusion=="LambdaCodeScanning"' >/dev/null; then
        # 台帳に arn が存在しないなら失敗（例：yqで検索）
        if ! yq -e ".exclusions[].target.function_arn == \"$arn\"" "$LEDGER" >/dev/null; then
          echo "ERROR: Exclusion tag found but not recorded in ledger: $arn"
          exit 1
        fi
    fi
  done