Support Organizations that do not use AWS Control Tower

.project_automation/functional_tests/entrypoint.sh

@@ -5,11 +5,12 @@
 # managed and local tasks always use these variables for the project and project type path
 PROJECT_PATH=${BASE_PATH}/project
 PROJECT_TYPE_PATH=${BASE_PATH}/projecttype
-
+export REGION=$(grep -A1 regions: .taskcat.yml | awk '/ - / {print $NF}' |sort | uniq -c |sort -k1| head -1 |awk '{print $NF}')
 cd ${PROJECT_PATH}
-
+NON_CT_ENV="211125739641"
 # Retrieve the AWS account ID and store it in a variable
 AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query "Account" --output text)
+echo "Account ID: $AWS_ACCOUNT_ID"
 
 cleanup_region() {
     echo "Cleanup running in region: $1"
@@ -18,7 +19,7 @@ cleanup_region() {
 }
 
 cleanup_all_regions() {
-    export AWS_DEFAULT_REGION=us-east-1
+    export AWS_DEFAULT_REGION=$REGION
     regions=($(aws ec2 describe-regions --query "Regions[*].RegionName" --output text))
     for region in ${regions[@]}
     do
@@ -32,14 +33,26 @@ run_test() {
     echo $AWS_DEFAULT_REGION
     unset AWS_DEFAULT_REGION
     echo $AWS_DEFAULT_REGION
-    taskcat test run -t $1
+    taskcat -d test run -n -t $1
     #.project_automation/functional_tests/scoutsuite/scoutsuite.sh
 }
-# Run taskcat e2e test
-run_test "cfn-abi-lacework-polygraph-multi-org-multi-sub-mapping"
-run_test "cfn-abi-lacework-polygraph-multi-org-sra-enabled"
-run_test "cfn-abi-lacework-polygraph-multi-org-sra-gdonly"
-run_test "cfn-abi-lacework-polygraph-multi-org-sra-shonly"
+
+
+# if account id is xxxx do this
+if [ "$AWS_ACCOUNT_ID" == ${NON_CT_ENV} ]; then
+    # Run taskcat e2e test for Non-Control Tower environment
+    run_test "cfn-abi-lacework-polygraph-non-controltower"
+else
+    # Run taskcat e2e test for Control Tower environment
+    echo "Account ID: $AWS_ACCOUNT_ID"
+    run_test "cfn-abi-lacework-polygraph-multi-org-multi-sub-mapping"
+    run_test "cfn-abi-lacework-polygraph-multi-org-sra-enabled"
+    run_test "cfn-abi-lacework-polygraph-multi-org-sra-gdonly"
+    run_test "cfn-abi-lacework-polygraph-multi-org-sra-shonly"
+    run_test "cfn-abi-lacework-polygraph-multi-org-sra-cloudtrailonly"
+fi
+
+
 
 ## Executing ash tool
 

.project_automation/functional_tests/scoutsuite/scoutsuite.sh

@@ -19,7 +19,7 @@ run_scoutsuite() {
     # Upload Scoutsuite security scan results to S3 bucket named scoutsuite-results-aws-AWS-ACCOUNT-ID
     python3 .project_automation/functional_tests/scoutsuite/process-scoutsuite-report.py
     # Delete taskcat e2e test resources
-    taskcat test clean ALL
+    taskcat test clean ALL -w -r $REGION
     process_scoutsuite_report
 }
 

.taskcat.yml

@@ -8,61 +8,113 @@ project:
 tests:
   cfn-abi-lacework-polygraph-multi-org-multi-sub-mapping:
     regions:
-      - us-east-1 # Control Tower Home region for Pilot
+      - us-east-1 
     template: templates/cfn-abi-lacework-polygraph.template.yaml
     parameters:
       pSRAStagingS3KeyPrefix: $[taskcat_project_name]
       pSRASourceS3BucketName: $[taskcat_autobucket]
       pSRAS3BucketRegion: $[taskcat_current_region]
-      LaceworkURL: laceworkalliances.lacework.net
+      LaceworkAccountName: $[taskcat_ssm_/lacework/LaceworkAccountName]
       LaceworkAccessKeyID: $[taskcat_ssm_/lacework/LaceworkAccessKeyID]
       LaceworkSecretKey: $[taskcat_ssm_/lacework/LaceworkSecretKey]
-      pCreateAWSControlTowerExecutionRole: 'true'
+      KMSKeyIdentifierARN: $[taskcat_ssm_/lacework/CloudTrailKMSARN]
+      pConfigureGuardDuty: 'Yes'
+      pDisableGuardDuty: 'Yes'
+      pConfigureSecurityHub: 'Yes'
+      pDisableSecurityHub: 'Yes'
+  cfn-abi-lacework-polygraph-non-controltower:
+    regions:
+      - us-east-1
+    template: templates/cfn-abi-lacework-polygraph.template.yaml
+    parameters:
+      pSRAStagingS3KeyPrefix: $[taskcat_project_name]
+      pSRASourceS3BucketName: $[taskcat_autobucket]
+      pSRAS3BucketRegion: $[taskcat_current_region]
+      LaceworkAccountName: $[taskcat_ssm_/lacework/LaceworkAccountName]
+      LaceworkAccessKeyID: $[taskcat_ssm_/lacework/LaceworkAccessKeyID]
+      LaceworkSecretKey: $[taskcat_ssm_/lacework/LaceworkSecretKey]
+      pConfigureGuardDuty: 'Yes'
+      pDisableGuardDuty: 'Yes'
+      pConfigureSecurityHub: 'Yes'
+      pDisableSecurityHub: 'Yes'
+      pCreateAWSControlTowerExecutionRole: 'false'
+      pCreateSRAOrgTrail: 'Yes'
+      pControlTower: 'false'
+      pLogArchiveAccountId: $[taskcat_ssm_/nonct/log-archive-account-id]
+      pSecurityAccountId: $[taskcat_ssm_/nonct/audit-account-id]
+      pGovernedRegions: 'us-east-1'
   cfn-abi-lacework-polygraph-multi-org-sra-enabled:
     regions:
-      - us-east-1 # Control Tower Home region for Pilot
+      - us-east-1
     template: templates/cfn-abi-lacework-polygraph.template.yaml
     parameters:
       pSRAStagingS3KeyPrefix: $[taskcat_project_name]
       pSRASourceS3BucketName: $[taskcat_autobucket]
       pSRAS3BucketRegion: $[taskcat_current_region]
-      LaceworkURL: laceworkalliances.lacework.net
+      LaceworkAccountName: $[taskcat_ssm_/lacework/LaceworkAccountName]
       LaceworkAccessKeyID: $[taskcat_ssm_/lacework/LaceworkAccessKeyID]
       LaceworkSecretKey: $[taskcat_ssm_/lacework/LaceworkSecretKey]
       pDisableGuardDuty: 'Yes'
       pCreateAWSControlTowerExecutionRole: 'true'
       pConfigureGuardDuty: 'Yes'
+      pDisableGuardDuty: 'Yes'
       pConfigureSecurityHub: 'Yes'
       pDisableSecurityHub: 'Yes'
   cfn-abi-lacework-polygraph-multi-org-sra-gdonly:
     regions:
-      - us-east-1 # Control Tower Home region for Pilot
+      - us-east-1
     template: templates/cfn-abi-lacework-polygraph.template.yaml
     parameters:
       pSRAStagingS3KeyPrefix: $[taskcat_project_name]
       pSRASourceS3BucketName: $[taskcat_autobucket]
       pSRAS3BucketRegion: $[taskcat_current_region]
-      LaceworkURL: laceworkalliances.lacework.net
+      LaceworkAccountName: $[taskcat_ssm_/lacework/LaceworkAccountName]
       LaceworkAccessKeyID: $[taskcat_ssm_/lacework/LaceworkAccessKeyID]
       LaceworkSecretKey: $[taskcat_ssm_/lacework/LaceworkSecretKey]
       pDisableGuardDuty: 'Yes'
+      pControlTower: 'false'
+      pLogArchiveAccountId: $[taskcat_ssm_/nonct/log-archive-account-id]
+      pSecurityAccountId: $[taskcat_ssm_/nonct/audit-account-id]
+      pGovernedRegions: 'us-east-1'
+      LaceworkAccount: $[taskcat_ssm_/lacework/LaceworkAccount]
+      OrganizationID: $[taskcat_ssm_/lacework/OrganizationID]
+      OrganizationalUnit: $[taskcat_ssm_/lacework/OrgOrganizationalUnitanizationID]
+      ExistingCloudTrail: $[taskcat_ssm_/lacework/ExistingCloudTrail]
+      KMSKeyIdentifierARN: $[taskcat_ssm_/lacework/CloudTrailKMSARN]
       pCreateAWSControlTowerExecutionRole: 'true'
       pConfigureGuardDuty: 'Yes'
       pConfigureSecurityHub: 'No'
       pDisableSecurityHub: 'No'
   cfn-abi-lacework-polygraph-multi-org-sra-shonly:
     regions:
-      - us-east-1 # Control Tower Home region for Pilot
+      - us-east-1
     template: templates/cfn-abi-lacework-polygraph.template.yaml
     parameters:
       pSRAStagingS3KeyPrefix: $[taskcat_project_name]
       pSRASourceS3BucketName: $[taskcat_autobucket]
       pSRAS3BucketRegion: $[taskcat_current_region]
-      LaceworkURL: laceworkalliances.lacework.net
+      LaceworkAccountName: $[taskcat_ssm_/lacework/LaceworkAccountName]
       LaceworkAccessKeyID: $[taskcat_ssm_/lacework/LaceworkAccessKeyID]
       LaceworkSecretKey: $[taskcat_ssm_/lacework/LaceworkSecretKey]
       pDisableGuardDuty: 'No'
       pCreateAWSControlTowerExecutionRole: 'true'
       pConfigureGuardDuty: 'No'
       pConfigureSecurityHub: 'Yes'
-      pDisableSecurityHub: 'Yes'
+      pDisableSecurityHub: 'Yes'
+  cfn-abi-lacework-polygraph-multi-org-sra-cloudtrailonly:
+    regions:
+      - us-east-1
+    template: templates/cfn-abi-lacework-polygraph.template.yaml
+    parameters:
+      pSRAStagingS3KeyPrefix: $[taskcat_project_name]
+      pSRASourceS3BucketName: $[taskcat_autobucket]
+      pSRAS3BucketRegion: $[taskcat_current_region]
+      LaceworkAccountName: $[taskcat_ssm_/lacework/LaceworkAccountName]
+      LaceworkAccessKeyID: $[taskcat_ssm_/lacework/LaceworkAccessKeyID]
+      LaceworkSecretKey: $[taskcat_ssm_/lacework/LaceworkSecretKey]
+      pDisableGuardDuty: 'No'
+      pCreateAWSControlTowerExecutionRole: 'true'
+      pConfigureGuardDuty: 'No'
+      pConfigureSecurityHub: 'No'
+      pCreateSRAOrgTrail: 'Yes'
+

scripts/cleanup_config.json

@@ -4,6 +4,10 @@
         "Filter" : "sra-guardduty-org-delivery-",
         "Account" : "log_account"
     },
+    {
+        "Type" : "S3_BUCKET",
+        "Filter" : "sra-org-trail-logs-"
+    },
     {
         "Type" : "S3_BUCKET",
         "Filter" : "cfn-abi-amazon-guardduty-"
@@ -65,12 +69,7 @@
     },
     {
         "Type" : "SSM_PARAMETER",
-        "Filter" : "/sra/"
-    },
-    {
-        "Type" : "S3_BUCKET",
-        "Filter" : "sra-guardduty-org-delivery-",
-        "Account" : "log_account"
+        "Filter" : "/sra/staging-s3-bucket-name"
     },
     {
         "Type" : "S3_BUCKET",
@@ -89,11 +88,6 @@
         "Filter": "sra-org-trail-logs-",
         "Account": "log_account"
     },
-    {
-        "Type" : "S3_BUCKET",
-        "Filter" : "sra-guardduty-org-delivery-",
-        "Account" : "log_account"
-    },
     {
         "Type" : "S3_BUCKET",
         "Filter" : "cfn-abi-amazon-guardduty-"
@@ -123,6 +117,10 @@
         "Filter" : "/sra/gd/",
         "Account" : "log_account"
     },
+    {
+        "Type" : "LOG_GROUP",
+        "Filter" : "sra/sra-org-trail"
+    },
     {
         "Type" : "LOG_GROUP",
         "Filter" : "/aws/lambda/sra-gd-s3",
@@ -174,6 +172,26 @@
         "Type" : "STACK_SET",
         "Filter" : "sra-stackset-execution-role"
     },
+    {
+        "Type" : "STACK_SET",
+        "Filter" : "sra-staging-s3-bucket-management-account-regions"
+    },
+    {
+        "Type" : "STACK_SET",
+        "Filter" : "sra-guardduty-org-delivery-s3-bucket"
+    },
+    {
+        "Type" : "STACK_SET",
+        "Filter" : "sra-common-prerequisites-secrets-kms"
+    },
+    {
+        "Type" : "STACK_SET",
+        "Filter" : "sra-cloudtrail-org-kms"
+    },
+    {
+        "Type" : "STACK_SET",
+        "Filter" : "sra-guardduty-org-delivery-kms-key"
+    },
     {
         "Type" : "STACK",
         "Filter" : "sra-common-prerequisites-staging-s3-bucket"