avatarTeri Radichel

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

6616

Abstract

  <div>
          <div>
            <h2>VPC Flow Logs Governance</h2>
            <div><h3>ACM.63 Enforce the existence of VPC Flow Logs on All VPCs</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*UMlMQi6ZexHzw-m4Lx-3Gw.png)"></div>
          </div>
        </div>
      </a>
    </div><div id="bd98" class="link-block">
      <a href="https://readmedium.com/deploy-a-kms-key-and-key-policy-with-cloudformation-41bf0e00240d">
        <div>
          <div>
            <h2>Deploy A KMS Key and Key Policy with CloudFormation</h2>
            <div><h3>ACM.27 Testing our generic KMS Key template with the roles we created for encrypt, decryption, and administration</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*VcD6I8ylB77-RG-Zv2icPQ.png)"></div>
          </div>
        </div>
      </a>
    </div><ul><li>If people use a common template blessed by security and compliant with your organization’s security standards they won’t deploy misconfigured resources.</li></ul><div id="90fb" class="link-block">
      <a href="https://readmedium.com/how-a-cloudformation-template-can-secure-your-s3-buckets-738cd293c23f">
        <div>
          <div>
            <h2>How a CloudFormation Template Can Secure Your S3 Buckets</h2>
            <div><h3>ACM.193 Secure templates depend on a secure deployment pipeline</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*bGOT6OdAfl7V2Ial.png)"></div>
          </div>
        </div>
      </a>
    </div><ul><li>Separate stacks for separate resources allows and organization to assign responsibility for different resource types to different teams. For example, you may have a separate team that manages roles and trust policies and a team that deploys encryption and a team that deploys networking.</li></ul><div id="b858" class="link-block">
      <a href="https://readmedium.com/why-you-should-consider-separate-iam-administrators-d3f03710e7ec">
        <div>
          <div>
            <h2>Why You Should Consider Separate IAM Administrators</h2>
            <div><h3>AC.25 Refactoring IAM for centralized management to reduce the cost of a data breach</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*qffxz-A78CoFMX4cdotOgA.png)"></div>
          </div>
        </div>
      </a>
    </div><div id="1e1e" class="link-block">
      <a href="https://readmedium.com/letting-governance-teams-govern-49d9854d7ebb">
        <div>
          <div>
            <h2>Letting Governance Teams Govern</h2>
            <div><h3>ACM.138 Preventing the riskiest actions and most egregious mistakes with cloud organizational policies</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*31Yi7RPv3y9Lt56RhksX9w.png)"></div>
          </div>
        </div>
      </a>
    </div><div id="078b" class="link-block">
      <a href="https://readmedium.com/defining-aws-accounts-and-organizational-units-537cff5fc297">
        <div>
          <div>
            <h2>Defining AWS Accounts and Organizational Units</h2>
            <div><h3>ACM.180 Defining accounts and organizational units based on by trust boundaries and roles to protect critical assets</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*RZ3Oj78vssbTg_Mut7LxSQ.png)"></div>
          </div>
        </div>
      </a>
    </div><ul><li>Segregating resources into different templates allows you to store different types of resources in different code repositories. That allows you to ensure that people aren’t changing code they shouldn’t be allowed to change. If you have all your code in a single repository for an application, including networking, IAM, and encryption configuration, you risk the chance that a junior developer or a malicious insider inadvertently or purposefully changes something they should not.</li></ul><div id="50a2" class="link-block">
      <a href="https://readmedium.com/git-and-github-security-8728bef0a057">
        <div>
          <div>
            <h2>Git and GitHub Security</h2>
            <div><h3>Stories about securing git, GitHub, and your code</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*LQ5l21ueAnPOGOnhukzTCQ.png)"></div>
          </div>
        </div>
      </a>
    </div><ul><li>You can troubleshoot and restore single resources in production having issues without the complexity of redeploying an entire stack of resources. Separate templates make troubleshooting easier and faster. You know exactly which resource failed when a stack failed because it’s the only resource s in the stack. It’s easier to find the error because there’s less code to sort out compared to a monolithic template.</li></ul><div id="fd66" class="link-block">
      <a href="https://readmedium.com/troubleshooting-cloudformation-d33c664dbf70">
        <div>
          <div>
            <h2>Troubleshooting CloudFormation</h2>
            <div><h3>ACM.69 When you go to bed and your code works and wake up to find it doesn’t anymore ~ what it’s like to troubleshoot…</h3></div>
            <div><p>medium.com</p></div>
          </div>
          <div>
            <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*AUfSpcvnY3vQrjAWaPGTmw.png)"></div>
          </div>
        </div>
      </a>
    </div><div id="892a" class="link-block">
      <a href="https://readmedium.com/automatically-displaying-the-reason-a-cloudformation-stack-failed-using-aw

Options

s-cli-85791a1f398"> <div> <div> <h2>Automatically Displaying the Reason A CloudFormation Stack Failed Using AWS CLI</h2> <div><h3>ACM.251 Develop CloudFormation faster by getting information you need to resolve errors more quickly</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*pG1gn-km5AHK1IaI0Ml6yg.png)"></div> </div> </div> </a> </div><ul><li>You can redeploy a single resource instead of redeploying a template with a whole bunch of resources in it. This avoids potential errors and problems due to unnecessary redeployments.</li><li>When making changes to a smaller bit of code you don’t have as much risk where you might inadvertently break something else you didn’t mean to change.</li></ul><p id="0108">Single purpose stacks just make sense to me. I didn’t realize a lot more people are doing things that way, but it became apparent during discussions as the AWS Heroes event. I remember when I hired a very, very smart DevOps person and he told me he hated CloudFormation. When I showed him my method of a single resource per stack he instantly didn’t think CloudFormation was as bad. It can still be challenging to deal with CloudFormation at times, as I have demonstrated throughout this series.</p><h1 id="ceef">😆</h1><p id="c208">However limiting the resources in a stack makes things a whole lot easier as far as I can tell. There are a few places where I included more than one resource in a stack like this post on creating a password for a resource:</p><div id="cfc0" class="link-block"> <a href="https://readmedium.com/autogenerated-passwords-in-cloudformation-for-aws-console-access-aef6c783a695"> <div> <div> <h2>Autogenerated Passwords in CloudFormation for AWS Console Access</h2> <div><h3>ACM.91 Granting AWS Console access for Secrets Manager Secrets to address IAM Policy Limitations</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*ITJ87vjn1y5NCCgND9NqsA.png)"></div> </div> </div> </a> </div><p id="b834">But beyond that, I almost always put one resource in one stack. And that’s why I can easily search for all the CloudFormation stacks that contain a particular resource in the AWS console. I can enforce a naming convention. (And no, don’t get me started on tags.) I can enforce policies that only allow people to edit their own stacks. I wrote about all those things in the last two posts linked to above.</p><p id="3c45">There is one other potential downtime. I don’t know if this problem still exists but years ago when I worked at Capital One the CloudFormation console was painfully slow when you had too many stacks. One of the ways around that is to put different types of resources in different accounts and environments. More on that to come.</p><p id="0001">I think to really get the gist of it, it might help to review the code. I have a consistent structure, naming convention, and I can deploy a lot of resources with fewer templates using this approach. I need ot check in some of my recent changes but you can still get the idea based on what is currently checked in here:</p><div id="8d02" class="link-block"> <a href="https://github.com/tradichel/SecurityMetricsAutomation"> <div> <div> <h2>GitHub - tradichel/SecurityMetricsAutomation</h2> <div><h3>Contribute to tradichel/SecurityMetricsAutomation development by creating an account on GitHub.</h3></div> <div><p>github.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/0*k_06BFyPMF4ON8pZ)"></div> </div> </div> </a> </div><p id="895d">At some point, I’ll probably start from the top and explain how to deploy an organization step by step as this has been a bit meandering, but you can see the progress as I work through these posts:</p><div id="a7e6" class="link-block"> <a href="https://readmedium.com/automating-cybersecurity-metrics-890dfabb6198"> <div> <div> <h2>Automating Cybersecurity Metrics (ACM)</h2> <div><h3>A series of blog posts on cybersecurity metrics and security automation</h3></div> <div><p>medium.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/1*L9lEIsaWt6xm2Op2ww-G5w.png)"></div> </div> </div> </a> </div><p id="437d">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2023</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="5a42"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="faf5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

CloudFormation Micro-Templates

ACM.285 Why I put a single resource in each CloudFormation template

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics | Code.

🔒 Related Stories: AWS Secruity | CloudFormation | Application Security

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In the last post I wrote about how to make CloudFormation faster, since that was the source of a problem that caused someone to ask me how to avoid using CloudFormation altogether.

I have just one more follow up post from the AWS Heroes event at the moment. I’ve written about this concept before but I’m going to summarize it in a single post so I can refer to it if needed. I realized as I was trying to explain the concept and why I do it that I don’t have any single post on the topic. I just started doing what I always do when I began writing this now somewhat lengthy series.

The topic seemed to come up a lot in discussions in terms of how to solve various problems and why certain things didn’t work. I can’t remember all the reasons and I probably can’t write about all of them anyway, but I thought a single post covering the pros and cons of the single resource per template might help.

You use micro-services to create containers that do one thing. You can reate classes in object oriented programming to limit the scope of a class to a single type of object. Why not use micro-templates in CloudFormation?

I already explained a lot of this in the last two posts. When you use a single resource per template you lose some of the functionality and benefits that CloudFormation gives you if you don’t really know how to deploy a lot of different resources together properly. CloudFormation tracks dependencies and helps parallelize resource deployment for resources in the same template.

However, by breaking things apart, if you know the order in which things need to be deployed and where all your dependencies lie, you can potentially deploy things faster. I covered that in the post above in more detail showing you how and where you can cut corners, reduce unnecessary resource checks, and possibly control parallel deployments yourself. I also offered some other suggestions for speeding up CloudFormation deployments besides the use of single templates.

In addition to speeding up deployments, a single resource per template provides these additional benefits:

  • Single resource templates allow you to include the AWS resource type in the stack name. That enables you to create a standard naming convention that allows you to quickly find the stacks that deploy a particular resource type. Check out some of the screen shots in these posts. Have you ever had to dig through a multitude of stacks in an enterprise account to find a stack? This might help. Note that the first post was only a starting point. The naming convention is now [Role]-[ResourceType]-[ResourceName] In the case of a Subnet you might need to tack on the AZ to the end of the subnet name if you are deploying multiple. For some resources deployed in multiple regions, you can take the Region name onto the end. All the resources for a specific application may incorporate an application code name into the resource name. You get the idea.

The latest iteration looks something like this:

  • Create a stack for a single resource type allows you to create reusable templates to maintain governance throughout your organization.
  • If people use a common template blessed by security and compliant with your organization’s security standards they won’t deploy misconfigured resources.
  • Separate stacks for separate resources allows and organization to assign responsibility for different resource types to different teams. For example, you may have a separate team that manages roles and trust policies and a team that deploys encryption and a team that deploys networking.
  • Segregating resources into different templates allows you to store different types of resources in different code repositories. That allows you to ensure that people aren’t changing code they shouldn’t be allowed to change. If you have all your code in a single repository for an application, including networking, IAM, and encryption configuration, you risk the chance that a junior developer or a malicious insider inadvertently or purposefully changes something they should not.
  • You can troubleshoot and restore single resources in production having issues without the complexity of redeploying an entire stack of resources. Separate templates make troubleshooting easier and faster. You know exactly which resource failed when a stack failed because it’s the only resource s in the stack. It’s easier to find the error because there’s less code to sort out compared to a monolithic template.
  • You can redeploy a single resource instead of redeploying a template with a whole bunch of resources in it. This avoids potential errors and problems due to unnecessary redeployments.
  • When making changes to a smaller bit of code you don’t have as much risk where you might inadvertently break something else you didn’t mean to change.

Single purpose stacks just make sense to me. I didn’t realize a lot more people are doing things that way, but it became apparent during discussions as the AWS Heroes event. I remember when I hired a very, very smart DevOps person and he told me he hated CloudFormation. When I showed him my method of a single resource per stack he instantly didn’t think CloudFormation was as bad. It can still be challenging to deal with CloudFormation at times, as I have demonstrated throughout this series.

😆

However limiting the resources in a stack makes things a whole lot easier as far as I can tell. There are a few places where I included more than one resource in a stack like this post on creating a password for a resource:

But beyond that, I almost always put one resource in one stack. And that’s why I can easily search for all the CloudFormation stacks that contain a particular resource in the AWS console. I can enforce a naming convention. (And no, don’t get me started on tags.) I can enforce policies that only allow people to edit their own stacks. I wrote about all those things in the last two posts linked to above.

There is one other potential downtime. I don’t know if this problem still exists but years ago when I worked at Capital One the CloudFormation console was painfully slow when you had too many stacks. One of the ways around that is to put different types of resources in different accounts and environments. More on that to come.

I think to really get the gist of it, it might help to review the code. I have a consistent structure, naming convention, and I can deploy a lot of resources with fewer templates using this approach. I need ot check in some of my recent changes but you can still get the idea based on what is currently checked in here:

At some point, I’ll probably start from the top and explain how to deploy an organization step by step as this has been a bit meandering, but you can see the progress as I work through these posts:

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2023

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab
Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation
Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
Cloudformation
Resource
Template
Governance
Naming Convention
Recommended from ReadMedium