Add copyright headers and configure log retention for CloudWatch logs

Author: Bob Strahan

.dsr/.aws-sam-build-BDASAMPLEPROJECT-template/checkov-scan.json

@@ -0,0 +1 @@
+{"check_type": "cloudformation", "results": {"failed_checks": [{"check_id": "CKV_AWS_116", "bc_check_id": "BC_AWS_GENERAL_64", "check_name": "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)", "check_result": {"result": "FAILED", "evaluated_keys": ["Properties/DeadLetterQueue/TargetArn"]}, "code_block": [[82, "  BDAProjectLambda:\n"], [83, "    Type: AWS::Serverless::Function\n"], [84, "    Metadata:\n"], [85, "      SamResourceId: BDAProjectLambda\n"], [86, "      cfn_nag:\n"], [87, "        rules_to_suppress:\n"], [88, "        - id: W89\n"], [89, "          reason: This Lambda function does not require VPC access as it only interacts\n"], [90, "            with AWS services via AWS APIs\n"], [91, "        - id: W92\n"], [92, "          reason: Function does not require concurrent execution limits as it is designed\n"], [93, "            to scale based on demand\n"], [94, "    Properties:\n"], [95, "      CodeUri: s3://bobs-artifacts-us-west-2/idp-dev-private/0.3.12-wip/91ebd3e583d7bd86a029e827e40034b2\n"], [96, "      Handler: index.handler\n"], [97, "      Role:\n"], [98, "        Fn::GetAtt:\n"], [99, "        - LambdaExecutionRole\n"], [100, "        - Arn\n"], [101, "      Runtime: python3.12\n"], [102, "      Timeout: 300\n"], [103, "      MemorySize: 256\n"], [104, "      Environment:\n"], [105, "        Variables:\n"], [106, "          LOG_LEVEL:\n"], [107, "            Ref: LogLevel\n"]], "file_path": "/template.yaml", "file_abs_path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "repo_file_path": "/template.yaml", "file_line_range": [82, 107], "resource": "AWS::Serverless::Function.BDAProjectLambda", "evaluations": {}, "check_class": "checkov.cloudformation.checks.resource.aws.LambdaDLQConfigured", "fixed_definition": null, "entity_tags": null, "caller_file_path": null, "caller_file_line_range": null, "resource_address": null, "severity": null, "bc_category": null, "benchmarks": null, "description": null, "short_description": null, "vulnerability_details": null, "connected_node": null, "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq", "details": [], "check_len": null, "definition_context_file_path": null, "breadcrumbs": {"Environment.Variables.LOG_LEVEL": [{"type": "parameters", "name": "LogLevel", "path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "attribute_key": "Default"}], "Environment.Variables": [{"type": "parameters", "name": "LogLevel", "path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "attribute_key": "Default"}]}}, {"check_id": "CKV_AWS_173", "bc_check_id": "BC_AWS_SERVERLESS_5", "check_name": "Check encryption settings for Lambda environment variable", "check_result": {"result": "FAILED", "evaluated_keys": ["Properties/KmsKeyArn"]}, "code_block": [[82, "  BDAProjectLambda:\n"], [83, "    Type: AWS::Serverless::Function\n"], [84, "    Metadata:\n"], [85, "      SamResourceId: BDAProjectLambda\n"], [86, "      cfn_nag:\n"], [87, "        rules_to_suppress:\n"], [88, "        - id: W89\n"], [89, "          reason: This Lambda function does not require VPC access as it only interacts\n"], [90, "            with AWS services via AWS APIs\n"], [91, "        - id: W92\n"], [92, "          reason: Function does not require concurrent execution limits as it is designed\n"], [93, "            to scale based on demand\n"], [94, "    Properties:\n"], [95, "      CodeUri: s3://bobs-artifacts-us-west-2/idp-dev-private/0.3.12-wip/91ebd3e583d7bd86a029e827e40034b2\n"], [96, "      Handler: index.handler\n"], [97, "      Role:\n"], [98, "        Fn::GetAtt:\n"], [99, "        - LambdaExecutionRole\n"], [100, "        - Arn\n"], [101, "      Runtime: python3.12\n"], [102, "      Timeout: 300\n"], [103, "      MemorySize: 256\n"], [104, "      Environment:\n"], [105, "        Variables:\n"], [106, "          LOG_LEVEL:\n"], [107, "            Ref: LogLevel\n"]], "file_path": "/template.yaml", "file_abs_path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "repo_file_path": "/template.yaml", "file_line_range": [82, 107], "resource": "AWS::Serverless::Function.BDAProjectLambda", "evaluations": {}, "check_class": "checkov.cloudformation.checks.resource.aws.LambdaEnvironmentEncryptionSettings", "fixed_definition": null, "entity_tags": null, "caller_file_path": null, "caller_file_line_range": null, "resource_address": null, "severity": null, "bc_category": null, "benchmarks": null, "description": null, "short_description": null, "vulnerability_details": null, "connected_node": null, "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5", "details": [], "check_len": null, "definition_context_file_path": null, "breadcrumbs": {"Environment.Variables.LOG_LEVEL": [{"type": "parameters", "name": "LogLevel", "path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "attribute_key": "Default"}], "Environment.Variables": [{"type": "parameters", "name": "LogLevel", "path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "attribute_key": "Default"}]}}, {"check_id": "CKV_AWS_115", "bc_check_id": "BC_AWS_GENERAL_63", "check_name": "Ensure that AWS Lambda function is configured for function-level concurrent execution limit", "check_result": {"result": "FAILED", "evaluated_keys": ["Properties/ReservedConcurrentExecutions"]}, "code_block": [[82, "  BDAProjectLambda:\n"], [83, "    Type: AWS::Serverless::Function\n"], [84, "    Metadata:\n"], [85, "      SamResourceId: BDAProjectLambda\n"], [86, "      cfn_nag:\n"], [87, "        rules_to_suppress:\n"], [88, "        - id: W89\n"], [89, "          reason: This Lambda function does not require VPC access as it only interacts\n"], [90, "            with AWS services via AWS APIs\n"], [91, "        - id: W92\n"], [92, "          reason: Function does not require concurrent execution limits as it is designed\n"], [93, "            to scale based on demand\n"], [94, "    Properties:\n"], [95, "      CodeUri: s3://bobs-artifacts-us-west-2/idp-dev-private/0.3.12-wip/91ebd3e583d7bd86a029e827e40034b2\n"], [96, "      Handler: index.handler\n"], [97, "      Role:\n"], [98, "        Fn::GetAtt:\n"], [99, "        - LambdaExecutionRole\n"], [100, "        - Arn\n"], [101, "      Runtime: python3.12\n"], [102, "      Timeout: 300\n"], [103, "      MemorySize: 256\n"], [104, "      Environment:\n"], [105, "        Variables:\n"], [106, "          LOG_LEVEL:\n"], [107, "            Ref: LogLevel\n"]], "file_path": "/template.yaml", "file_abs_path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "repo_file_path": "/template.yaml", "file_line_range": [82, 107], "resource": "AWS::Serverless::Function.BDAProjectLambda", "evaluations": {}, "check_class": "checkov.cloudformation.checks.resource.aws.LambdaFunctionLevelConcurrentExecutionLimit", "fixed_definition": null, "entity_tags": null, "caller_file_path": null, "caller_file_line_range": null, "resource_address": null, "severity": null, "bc_category": null, "benchmarks": null, "description": null, "short_description": null, "vulnerability_details": null, "connected_node": null, "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit", "details": [], "check_len": null, "definition_context_file_path": null, "breadcrumbs": {"Environment.Variables.LOG_LEVEL": [{"type": "parameters", "name": "LogLevel", "path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "attribute_key": "Default"}], "Environment.Variables": [{"type": "parameters", "name": "LogLevel", "path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "attribute_key": "Default"}]}}, {"check_id": "CKV_AWS_117", "bc_check_id": "BC_AWS_GENERAL_65", "check_name": "Ensure that AWS Lambda function is configured inside a VPC", "check_result": {"result": "FAILED", "evaluated_keys": ["Properties/VpcConfig"]}, "code_block": [[82, "  BDAProjectLambda:\n"], [83, "    Type: AWS::Serverless::Function\n"], [84, "    Metadata:\n"], [85, "      SamResourceId: BDAProjectLambda\n"], [86, "      cfn_nag:\n"], [87, "        rules_to_suppress:\n"], [88, "        - id: W89\n"], [89, "          reason: This Lambda function does not require VPC access as it only interacts\n"], [90, "            with AWS services via AWS APIs\n"], [91, "        - id: W92\n"], [92, "          reason: Function does not require concurrent execution limits as it is designed\n"], [93, "            to scale based on demand\n"], [94, "    Properties:\n"], [95, "      CodeUri: s3://bobs-artifacts-us-west-2/idp-dev-private/0.3.12-wip/91ebd3e583d7bd86a029e827e40034b2\n"], [96, "      Handler: index.handler\n"], [97, "      Role:\n"], [98, "        Fn::GetAtt:\n"], [99, "        - LambdaExecutionRole\n"], [100, "        - Arn\n"], [101, "      Runtime: python3.12\n"], [102, "      Timeout: 300\n"], [103, "      MemorySize: 256\n"], [104, "      Environment:\n"], [105, "        Variables:\n"], [106, "          LOG_LEVEL:\n"], [107, "            Ref: LogLevel\n"]], "file_path": "/template.yaml", "file_abs_path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "repo_file_path": "/template.yaml", "file_line_range": [82, 107], "resource": "AWS::Serverless::Function.BDAProjectLambda", "evaluations": {}, "check_class": "checkov.cloudformation.checks.resource.aws.LambdaInVPC", "fixed_definition": null, "entity_tags": null, "caller_file_path": null, "caller_file_line_range": null, "resource_address": null, "severity": null, "bc_category": null, "benchmarks": null, "description": null, "short_description": null, "vulnerability_details": null, "connected_node": null, "guideline": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1", "details": [], "check_len": null, "definition_context_file_path": null, "breadcrumbs": {"Environment.Variables.LOG_LEVEL": [{"type": "parameters", "name": "LogLevel", "path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "attribute_key": "Default"}], "Environment.Variables": [{"type": "parameters", "name": "LogLevel", "path": "/home/ec2-user/projects/genaiic-idp-accelerator-2/.aws-sam/build/BDASAMPLEPROJECT/template.yaml", "attribute_key": "Default"}]}}]}, "summary": {"passed": 11, "failed": 4, "skipped": 0, "parsing_errors": 0, "resource_count": 3, "checkov_version": "3.2.461"}}

.dsr/.aws-sam-build-BDASAMPLEPROJECT-template/checkov-summary.json

@@ -0,0 +1,54 @@
+[
+  {
+    "source": "Checkov",
+    "path": "/template.yaml",
+    "line": 82,
+    "issue": "Ensure that AWS Lambda function is configured for a Dead Letter Queue(DLQ)",
+    "check_id": "CKV_AWS_116",
+    "priority": "High",
+    "references": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-a-dead-letter-queue-dlq",
+    "status": "Open",
+    "stack": ".aws-sam-build-BDASAMPLEPROJECT-template",
+    "resourceType": "Serverless Function",
+    "resourceName": "BDAProjectLambda"
+  },
+  {
+    "source": "Checkov",
+    "path": "/template.yaml",
+    "line": 82,
+    "issue": "Check encryption settings for Lambda environment variable",
+    "check_id": "CKV_AWS_173",
+    "priority": "High",
+    "references": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-serverless-policies/bc-aws-serverless-5",
+    "status": "Open",
+    "stack": ".aws-sam-build-BDASAMPLEPROJECT-template",
+    "resourceType": "Serverless Function",
+    "resourceName": "BDAProjectLambda"
+  },
+  {
+    "source": "Checkov",
+    "path": "/template.yaml",
+    "line": 82,
+    "issue": "Ensure that AWS Lambda function is configured for function-level concurrent execution limit",
+    "check_id": "CKV_AWS_115",
+    "priority": "High",
+    "references": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-for-function-level-concurrent-execution-limit",
+    "status": "Open",
+    "stack": ".aws-sam-build-BDASAMPLEPROJECT-template",
+    "resourceType": "Serverless Function",
+    "resourceName": "BDAProjectLambda"
+  },
+  {
+    "source": "Checkov",
+    "path": "/template.yaml",
+    "line": 82,
+    "issue": "Ensure that AWS Lambda function is configured inside a VPC",
+    "check_id": "CKV_AWS_117",
+    "priority": "High",
+    "references": "https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-that-aws-lambda-function-is-configured-inside-a-vpc-1",
+    "status": "Open",
+    "stack": ".aws-sam-build-BDASAMPLEPROJECT-template",
+    "resourceType": "Serverless Function",
+    "resourceName": "BDAProjectLambda"
+  }
+]

.dsr/.aws-sam-build-BDASAMPLEPROJECT-template/diagram.md

@@ -0,0 +1,21 @@
+```mermaid
+flowchart TD
+    User([User])
+    CFN([CloudFormation])
+    BDALambda([BDAProjectLambda])
+    BDAProject([BDAProject])
+    Bedrock([Amazon Bedrock])
+    Blueprints[(Blueprints)]
+    
+    User -->|Deploy Template| CFN
+    CFN -->|Create Custom Resource| BDALambda
+    BDALambda -->|Create Project| Bedrock
+    BDALambda -->|Add Blueprints| Bedrock
+    Bedrock -->|Create Data Automation Project| BDAProject
+    Bedrock -->|Associate| Blueprints
+    BDAProject -->|Process Documents| Blueprints
+    Blueprints -->|Extract Data| BDAProject
+    BDALambda -->|Return Project ARN| CFN
+    BDALambda -->|Return Blueprint ARNs| CFN
+    CFN -->|Outputs| User
+```

.dsr/.aws-sam-build-BDASAMPLEPROJECT-template/security-matrix.json

@@ -0,0 +1,47 @@
+[
+  {
+    "source": "security-matrix",
+    "stack": "AWS GenAI IDP Accelerator - Sample BDA lending package project",
+    "resourceType": "IAM Policy",
+    "resourceName": "BedrockDataAutomationAccess",
+    "issue": "IAM policy uses wildcard resource ('*') which violates principle of least privilege",
+    "priority": "High",
+    "status": "Open"
+  },
+  {
+    "source": "security-matrix",
+    "stack": "AWS GenAI IDP Accelerator - Sample BDA lending package project",
+    "resourceType": "Lambda Function",
+    "resourceName": "BDAProjectLambda",
+    "issue": "Lambda function not configured with VPC access, exposing it to potential network-based attacks",
+    "priority": "Medium",
+    "status": "Open"
+  },
+  {
+    "source": "security-matrix",
+    "stack": "AWS GenAI IDP Accelerator - Sample BDA lending package project",
+    "resourceType": "Lambda Function",
+    "resourceName": "BDAProjectLambda",
+    "issue": "Lambda function has no concurrency limits configured, potentially allowing resource exhaustion",
+    "priority": "Medium",
+    "status": "Open"
+  },
+  {
+    "source": "security-matrix",
+    "stack": "AWS GenAI IDP Accelerator - Sample BDA lending package project",
+    "resourceType": "Lambda Function",
+    "resourceName": "BDAProjectLambda",
+    "issue": "X-Ray tracing not enabled for Lambda function",
+    "priority": "High",
+    "status": "Open"
+  },
+  {
+    "source": "security-matrix",
+    "stack": "AWS GenAI IDP Accelerator - Sample BDA lending package project",
+    "resourceType": "Lambda Function",
+    "resourceName": "BDAProjectLambda",
+    "issue": "Dead letter queue not configured for Lambda function",
+    "priority": "Medium",
+    "status": "Open"
+  }
+]