From a94970271cabb5a0e3bbd773b2694d7dbbc8e21d Mon Sep 17 00:00:00 2001 From: Mohamed Zeidan <81834882+mohamedzeidan2021@users.noreply.github.com> Date: Tue, 6 Aug 2024 11:25:57 -0700 Subject: [PATCH 1/3] added security-monitoring --- .github/workflows/security-monitoring.yml | 122 ++++++++++++++++++++++ 1 file changed, 122 insertions(+) create mode 100644 .github/workflows/security-monitoring.yml diff --git a/.github/workflows/security-monitoring.yml b/.github/workflows/security-monitoring.yml new file mode 100644 index 0000000000..06b20be4f6 --- /dev/null +++ b/.github/workflows/security-monitoring.yml @@ -0,0 +1,122 @@ +name: Security Monitoring + +on: + schedule: + - cron: '0 9 * * *' + +concurrency: + group: ${{ github.workflow }}-${{ github.run_id }} + cancel-in-progress: true + +permissions: + id-token: write + +jobs: + check-code-scanning-alerts: + runs-on: ubuntu-latest + outputs: + code_scanning_alert_status: ${{ steps.check-code-scanning-alerts.outputs.code_scanning_alert_status }} + steps: + - name: Check for security alerts + id: check-code-scanning-alerts + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea + with: + github-token: ${{ secrets.GH_PAT }} + script: | + async function checkAlerts() { + const owner = '${{ github.repository_owner }}'; + const repo = '${{ github.event.repository.name }}'; + const ref = 'refs/heads/master'; + + const codeScanningAlerts = await github.rest.codeScanning.listAlertsForRepo({ + owner, + repo, + ref: ref + }); + const activeCodeScanningAlerts = codeScanningAlerts.data.filter(alert => alert.state === 'open'); + core.setOutput('code_scanning_alert_status', activeCodeScanningAlerts.length > 0 ? '1': '0'); + } + await checkAlerts(); + + check-dependabot-alerts: + runs-on: ubuntu-latest + outputs: + dependabot_alert_status: ${{ steps.check-dependabot-alerts.outputs.dependabot_alert_status }} + steps: + - name: Check for dependabot alerts + id: check-dependabot-alerts + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea + with: + github-token: ${{ secrets.GH_PAT }} + script: | + async function checkAlerts() { + const owner = '${{ github.repository_owner }}'; + const repo = '${{ github.event.repository.name }}'; + + const dependabotAlerts = await github.rest.dependabot.listAlertsForRepo({ + owner, + repo, + headers: { + 'accept': 'applications/vnd.github+json' + } + }); + const activeDependabotAlerts = dependabotAlerts.data.filter(alert => alert.state === 'open'); + core.setOutput('dependabot_alert_status', activeDependabotAlerts.length > 0 ? '1': '0'); + } + await checkAlerts(); + + check-secret-scanning-alerts: + runs-on: ubuntu-latest + outputs: + secret_scanning_alert_status: ${{ steps.check-secret-scanning-alerts.outputs.secret_scanning_alert_status }} + steps: + - name: Check for secret scanning alerts + id: check-secret-scanning-alerts + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea + with: + github-token: ${{ secrets.GH_PAT }} + script: | + async function checkAlerts() { + const owner = '${{ github.repository_owner }}'; + const repo = '${{ github.event.repository.name }}'; + + const secretScanningAlerts = await github.rest.secretScanning.listAlertsForRepo({ + owner, + repo, + }); + const activeSecretScanningAlerts = secretScanningAlerts.data.filter(alert => alert.state === 'open'); + core.setOutput('secret_scanning_alert_status', activeSecretScanningAlerts.length > 0 ? '1': '0'); + console.log("Active Secret Scanning Alerts", activeSecretScanningAlerts); + } + await checkAlerts(); + + put-metric-data: + runs-on: ubuntu-latest + needs: [check-code-scanning-alerts, check-dependabot-alerts, check-secret-scanning-alerts] + steps: + - name: Configure AWS Credentials + uses: aws-actions/configure-aws-credentials@12e3392609eaaceb7ae6191b3f54bbcb85b5002b + with: + role-to-assume: ${{ secrets.SECURITY_VULNERABILITY_ROLE_ARN }} + aws-region: us-west-2 + - name: Put Code Scanning Alert Metric Data + run: | + if [ "${{ needs.check-code-scanning-alerts.outputs.code_scanning_alert_status }}" == "1" ]; then + aws cloudwatch put-metric-data --metric-name CodeScanningAlert --namespace CodeScanningMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk + else + aws cloudwatch put-metric-data --metric-name CodeScanningAlert --namespace CodeScanningMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk + fi + - name: Put Dependabot Alert Metric Data + run: | + if [ "${{ needs.check-dependabot-alerts.outputs.dependabot_alert_status }}" == "1" ]; then + aws cloudwatch put-metric-data --metric-name DependabotAlert --namespace DependabotMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk + else + aws cloudwatch put-metric-data --metric-name DependabotAlert --namespace DependabotMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk + fi + - name: Put Secret Scanning Alert Metric Data + run: | + if [ "${{ needs.check-secret-scanning-alerts.outputs.secret_scanning_alert_status }}" == "1" ]; then + aws cloudwatch put-metric-data --metric-name SecretScanningAlert --namespace SecretScanningMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk + else + aws cloudwatch put-metric-data --metric-name SecretScanningAlert --namespace SecretScanningMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk + fi \ No newline at end of file From 602745ebe3a4ecc6cab905c943aefa0215bad511 Mon Sep 17 00:00:00 2001 From: Mohamed Zeidan <81834882+mohamedzeidan2021@users.noreply.github.com> Date: Tue, 6 Aug 2024 14:27:13 -0700 Subject: [PATCH 2/3] changed role name --- .github/workflows/security-monitoring.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-monitoring.yml b/.github/workflows/security-monitoring.yml index 06b20be4f6..9c88e6ad1f 100644 --- a/.github/workflows/security-monitoring.yml +++ b/.github/workflows/security-monitoring.yml @@ -97,7 +97,7 @@ jobs: - name: Configure AWS Credentials uses: aws-actions/configure-aws-credentials@12e3392609eaaceb7ae6191b3f54bbcb85b5002b with: - role-to-assume: ${{ secrets.SECURITY_VULNERABILITY_ROLE_ARN }} + role-to-assume: ${{ secrets.MONITORING_ROLE_ARN }} aws-region: us-west-2 - name: Put Code Scanning Alert Metric Data run: | From ed1228df8e0ec8d4eb9920d646b587bb57bd5cab Mon Sep 17 00:00:00 2001 From: Mohamed Zeidan <81834882+mohamedzeidan2021@users.noreply.github.com> Date: Tue, 6 Aug 2024 16:50:01 -0700 Subject: [PATCH 3/3] all metrics under same namespace --- .github/workflows/security-monitoring.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/security-monitoring.yml b/.github/workflows/security-monitoring.yml index 9c88e6ad1f..d8461bf00b 100644 --- a/.github/workflows/security-monitoring.yml +++ b/.github/workflows/security-monitoring.yml @@ -102,21 +102,21 @@ jobs: - name: Put Code Scanning Alert Metric Data run: | if [ "${{ needs.check-code-scanning-alerts.outputs.code_scanning_alert_status }}" == "1" ]; then - aws cloudwatch put-metric-data --metric-name CodeScanningAlert --namespace CodeScanningMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk + aws cloudwatch put-metric-data --metric-name CodeScanningAlert --namespace SecurityMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk else - aws cloudwatch put-metric-data --metric-name CodeScanningAlert --namespace CodeScanningMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk + aws cloudwatch put-metric-data --metric-name CodeScanningAlert --namespace SecurityMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk fi - name: Put Dependabot Alert Metric Data run: | if [ "${{ needs.check-dependabot-alerts.outputs.dependabot_alert_status }}" == "1" ]; then - aws cloudwatch put-metric-data --metric-name DependabotAlert --namespace DependabotMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk + aws cloudwatch put-metric-data --metric-name DependabotAlert --namespace SecurityMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk else - aws cloudwatch put-metric-data --metric-name DependabotAlert --namespace DependabotMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk + aws cloudwatch put-metric-data --metric-name DependabotAlert --namespace SecurityMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk fi - name: Put Secret Scanning Alert Metric Data run: | if [ "${{ needs.check-secret-scanning-alerts.outputs.secret_scanning_alert_status }}" == "1" ]; then - aws cloudwatch put-metric-data --metric-name SecretScanningAlert --namespace SecretScanningMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk + aws cloudwatch put-metric-data --metric-name SecretScanningAlert --namespace SecurityMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk else - aws cloudwatch put-metric-data --metric-name SecretScanningAlert --namespace SecretScanningMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk + aws cloudwatch put-metric-data --metric-name SecretScanningAlert --namespace SecurityMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk fi \ No newline at end of file