I'm trying to activate the AWS IoT security audit using a CDK stack, but I'm encountering some issues.
Initially, I referred to this documentation for the interfaceAuditCheckConfigurationProperty
and implemented the following CDK code to enable the IoT security audit:
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as sqs from 'aws-cdk-lib/aws-sqs';
import { aws_iot as iot } from 'aws-cdk-lib';
export class CdkIotDeviceDefenderStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
const auditCheckConfigurationProperty: iot.CfnAccountAuditConfiguration.AuditCheckConfigurationProperty = {
enabled: true,
};
//https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_iot.CfnAccountAuditConfiguration.AuditCheckConfigurationsProperty.html
const auditCheckConfigurationsProperty: iot.CfnAccountAuditConfiguration.AuditCheckConfigurationsProperty = {
deviceCertificateExpiringCheck: {
enabled: true,
}
};
}
}
However, this approach did not yield the desired results. Subsequently, I attempted another method by integrating the AWS SDK within the CDK to create resources in cloudformation. Here is the complete code:
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { IoTClient, UpdateAccountAuditConfigurationCommand } from " @aws-sdk/client-iot ";
import * as sns from 'aws-cdk-lib/aws-sns';
import * as subscriptions from 'aws-cdk-lib/aws-sns-subscriptions';
export class CdkIotDeviceDefenderStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
const expiredDeviceCertificateSNTopic = new sns.Topic(this, "SNSDeviceDefender", {
displayName: 'Device Defender Expired Certificate SNS',
fifo: false
});
const clientIoT = new IoTClient({ region: "us-west-2" });
const auditCheckConfigParams: any = {
roleArn: "arn:aws:iam::996242555412:role/Role_AWSIoTDeviceDefenderAudit",
auditNotificationTargetConfigurations: {
"SNS": {
"targetArn": expiredDeviceCertificateSNTopic.topicArn,
"roleArn": "arn:aws:iam::996242555412:role/Role_AWSIoTDeviceDefenderAudit",
"enabled": true
}
},
auditCheckConfigurations: {
"DEVICE_CERTIFICATE_EXPIRING_CHECK": {
enabled: true,
}
}
};
(async () => {
try {
const iotUpdateCmd = new UpdateAccountAuditConfigurationCommand(auditCheckConfigParams);
const iotUpdateResponse = await clientIoT.send(iotUpdateCmd);
} catch { }
})();
}
}
In this approach, I set up an SNS topic to receive the device defender audit results.
Despite these efforts, I have not been able to achieve the desired outcome. When running the CDK, the expected result should show both the Device Defender audit settings and Device certificate expiring as enabled (as seen here: https://i.stack.imgur.com/lPgei.png). However, what I am currently experiencing with both methods is that the Device Defender audit settings remain disabled - indicating that the IoT security audit is off (https://i.stack.imgur.com/iubm0.png).
I am at a loss and would appreciate any insights or suggestions on what might be missing in my implementation.