[{"data":1,"prerenderedAt":87},["ShallowReactive",2],{"content-svc-lambda-guides-governance-2-proactive-guard":3},{"markdown":4,"frontMatterAttributes":5,"bodyRaw":11,"menu":12,"menuType":81,"isCollapseableMenu":15,"nextDocItem":35,"previousDocItem":17,"contributorPaths":82,"contentName":86,"slug":34,"readingTime":31},"\u003Cp>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcfn-guard\u002Flatest\u002Fug\u002Fwhat-is-guard.html\">AWS CloudFormation Guard\u003C\u002Fa> is an open-source, general-purpose, policy-as-code evaluation tool. This can be used for proactive governance and compliance by validating Infrastructure as Code (IaC) templates and service compositions against policy rules. These rules can be customized based on your team or organizational requirements. For serverless resources like Lambda functions, the CloudFormation Guard rules can be used to control resource creation and configuration updates by defining the required property settings needed while creating or updating a Lambda function.\u003C\u002Fp>\n\u003Cp>Compliance administrators define the list of controls and governance policies that are required for deploying and updating Lambda functions. Platform administrators implement the controls in CI\u002FCD pipelines, as pre-commit validation webhooks with code repositories, and provide developers with command line tools for validating templates and code on local workstations. Developers author code, validate templates with command line tools, and then commit code to repositories, which are then automatically validated via the CI\u002FCD pipelines prior to deployment into an AWS environment.\u003C\u002Fp>\n\u003Cp>CloudFormation Guard allows you to \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcfn-guard\u002Flatest\u002Fug\u002Fwriting-rules.html\">write your rules\u003C\u002Fa> and implement your controls with a domain-specific language as follows.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"\u002Fassets\u002Fexternal\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002Fassets\u002Fimages\u002F2-proactive-guard-rule-dsl.png\" alt=\"2-proactive-guard-rule-dsl\">\u003C\u002Fp>\n\u003Cp>For example, suppose you wanted to ensure that developers choose only the latest runtimes. You could specify two different policies, one to identify \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Flambda\u002Flatest\u002Fdg\u002Flambda-runtimes.html\">runtimes\u003C\u002Fa> that are already deprecated and another to identify runtimes that are to be deprecated soon. To do this, you might write the following \u003Ccode>etc\u002Frules.guard\u003C\u002Fcode> file:\u003C\u002Fp>\n\u003Cpre>\u003Ccode>let lambda_functions = Resources.*[\n    Type == "AWS::Lambda::Function"\n]\n\nrule lambda_already_deprecated_runtime when %lambda_functions !empty {\n    %lambda_functions {\n        Properties {\n            when Runtime exists {\n                Runtime !in ["dotnetcore3.1", "nodejs12.x", "python3.6", "python2.7", "dotnet5.0", "dotnetcore2.1", "ruby2.5", "nodejs10.x", "nodejs8.10", "nodejs4.3", "nodejs6.10", "dotnetcore1.0", "dotnetcore2.0", "nodejs4.3-edge", "nodejs"] <<Lambda function is using a deprecated runtime.>>\n            }\n        }\n    }\n}\n\nrule lambda_soon_to_be_deprecated_runtime when %lambda_functions !empty {\n    %lambda_functions {\n        Properties {\n            when Runtime exists {\n                Runtime !in ["nodejs16.x", "nodejs14.x", "python3.7", "java8", "dotnet7", "go1.x", "ruby2.7", "provided"] <<Lambda function is using a runtime that is targeted for deprecation.>>\n            }\n        }\n    }\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Now suppose you write the following \u003Ccode>iac\u002Flambda.yaml\u003C\u002Fcode> CloudFormation template that defines a Lambda function:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-yaml\">  Fn:\n    Type: AWS::Lambda::Function\n    Properties:\n      Runtime: python3.7\n      CodeUri: src\n      Handler: fn.handler\n      Role: !GetAtt FnRole.Arn\n      Layers:\n        - arn:aws:lambda:us-east-1:580247275435:layer:LambdaInsightsExtension:35\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>After \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcfn-guard\u002Flatest\u002Fug\u002Fsetting-up.html\">installing\u003C\u002Fa> the CloudFormation Guard utility, you could then validate your template as follows:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-bash\">cfn-guard validate --rules etc\u002Frules.guard --data iac\u002Flambda.yaml\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>This would give you an output as follows:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-bash\">lambda.yaml Status = FAIL\nFAILED rules\nrules.guard\u002Flambda_soon_to_be_deprecated_runtime\n---\nEvaluating data lambda.yaml against rules rules.guard\nNumber of non-compliant resources 1\nResource = Fn {\n  Type      = AWS::Lambda::Function\n  Rule = lambda_soon_to_be_deprecated_runtime {\n    ALL {\n      Check =  Runtime not IN  ["nodejs16.x","nodejs14.x","python3.7","java8","dotnet7","go1.x","ruby2.7","provided"] {\n        ComparisonError {\n          Message          = Lambda function is using a runtime that is targeted for deprecation.\n          Error            = Check was not compliant as property [\u002FResources\u002FFn\u002FProperties\u002FRuntime[L:88,C:15]] was not present in [(resolved, Path=[L:0,C:0] Value=["nodejs16.x","nodejs14.x","python3.7","java8","dotnet7","go1.x","ruby2.7","provided"])]\n        }\n          PropertyPath    = \u002FResources\u002FFn\u002FProperties\u002FRuntime[L:88,C:15]\n          Operator        = NOT IN\n          Value           = "python3.7"\n          ComparedWith    = [["nodejs16.x","nodejs14.x","python3.7","java8","dotnet7","go1.x","ruby2.7","provided"]]\n          Code:\n               86.  Fn:\n               87.    Type: AWS::Lambda::Function\n               88.    Properties:\n               89.      Runtime: python3.7\n               90.      CodeUri: src\n               91.      Handler: fn.handler\n\n      }\n    }\n  }\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>CloudFormation Guard allows your developers to see from their local developer workstations that they need to update the template to use a runtime that is allowed by the organization. This happens prior to committing to a code repository and subsequently failing checks within a CI\u002FCD pipeline. As a result, your developers get this feedback on how to develop compliant templates and shift his or her time to writing code that delivers business value. This control can be applied on the local developer workstation, in a pre-commit validation webhook, and\u002For in the CI\u002FCD pipeline prior to deployment.\u003C\u002Fp>\n\u003Ch3>Caveats\u003C\u002Fh3>\n\u003Cp>Serverless developers who are using AWS SAM templates to define Lambda functions, be aware that you need to update the CloudFormation Guard rule to search for the \u003Ccode>AWS::Serverless::Function\u003C\u002Fcode> resource type as follows.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>let lambda_functions = Resources.*[\n    Type == "AWS::Serverless::Function"\n]\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>CloudFormation Guard also expects the properties to be included within the resource definition. Meanwhile, AWS SAM templates allow for properties to be specified in a separate Globals section. Properties that are defined in the \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fserverless-application-model\u002Flatest\u002Fdeveloperguide\u002Fsam-specification-template-anatomy-globals.html\">Globals\u003C\u002Fa> section are not validated with your CloudFormation Guard rules.\u003C\u002Fp>\n\u003Cp>As outlined in the CloudFormation Guard troubleshooting \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcfn-guard\u002Flatest\u002Fug\u002Ftroubleshooting.html\">documentation\u003C\u002Fa>, be aware that CloudFormation Guard doesn’t support short-form intrinsics like \u003Ccode>!GetAtt\u003C\u002Fcode> or \u003Ccode>!Sub\u003C\u002Fcode> and instead require using the expanded forms: \u003Ccode>Fn::GetAtt\u003C\u002Fcode> and \u003Ccode>Fn::Sub\u003C\u002Fcode>. The example above doesn’t evaluate the Role property, so the short-form intrinsic was used for simplicity.\u003C\u002Fp>\n",{"title":6,"order":7,"authors":8},"2. Proactive Controls with AWS CloudFormation Guard",2,[9,10],"Heeki Park","Pallavi Srivastava","[AWS CloudFormation Guard](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcfn-guard\u002Flatest\u002Fug\u002Fwhat-is-guard.html) is an open-source, general-purpose, policy-as-code evaluation tool. This can be used for proactive governance and compliance by validating Infrastructure as Code (IaC) templates and service compositions against policy rules. These rules can be customized based on your team or organizational requirements. For serverless resources like Lambda functions, the CloudFormation Guard rules can be used to control resource creation and configuration updates by defining the required property settings needed while creating or updating a Lambda function.\n\nCompliance administrators define the list of controls and governance policies that are required for deploying and updating Lambda functions. Platform administrators implement the controls in CI\u002FCD pipelines, as pre-commit validation webhooks with code repositories, and provide developers with command line tools for validating templates and code on local workstations. Developers author code, validate templates with command line tools, and then commit code to repositories, which are then automatically validated via the CI\u002FCD pipelines prior to deployment into an AWS environment.\n\nCloudFormation Guard allows you to [write your rules](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcfn-guard\u002Flatest\u002Fug\u002Fwriting-rules.html) and implement your controls with a domain-specific language as follows.\n\n![2-proactive-guard-rule-dsl](\u002Fassets\u002Fexternal\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002Fassets\u002Fimages\u002F2-proactive-guard-rule-dsl.png)\n\nFor example, suppose you wanted to ensure that developers choose only the latest runtimes. You could specify two different policies, one to identify [runtimes](https:\u002F\u002Fdocs.aws.amazon.com\u002Flambda\u002Flatest\u002Fdg\u002Flambda-runtimes.html) that are already deprecated and another to identify runtimes that are to be deprecated soon. To do this, you might write the following `etc\u002Frules.guard` file:\n\n```\nlet lambda_functions = Resources.*[\n    Type == \"AWS::Lambda::Function\"\n]\n\nrule lambda_already_deprecated_runtime when %lambda_functions !empty {\n    %lambda_functions {\n        Properties {\n            when Runtime exists {\n                Runtime !in [\"dotnetcore3.1\", \"nodejs12.x\", \"python3.6\", \"python2.7\", \"dotnet5.0\", \"dotnetcore2.1\", \"ruby2.5\", \"nodejs10.x\", \"nodejs8.10\", \"nodejs4.3\", \"nodejs6.10\", \"dotnetcore1.0\", \"dotnetcore2.0\", \"nodejs4.3-edge\", \"nodejs\"] \u003C\u003CLambda function is using a deprecated runtime.>>\n            }\n        }\n    }\n}\n\nrule lambda_soon_to_be_deprecated_runtime when %lambda_functions !empty {\n    %lambda_functions {\n        Properties {\n            when Runtime exists {\n                Runtime !in [\"nodejs16.x\", \"nodejs14.x\", \"python3.7\", \"java8\", \"dotnet7\", \"go1.x\", \"ruby2.7\", \"provided\"] \u003C\u003CLambda function is using a runtime that is targeted for deprecation.>>\n            }\n        }\n    }\n}\n```\n\nNow suppose you write the following `iac\u002Flambda.yaml` CloudFormation template that defines a Lambda function:\n\n```yaml\n  Fn:\n    Type: AWS::Lambda::Function\n    Properties:\n      Runtime: python3.7\n      CodeUri: src\n      Handler: fn.handler\n      Role: !GetAtt FnRole.Arn\n      Layers:\n        - arn:aws:lambda:us-east-1:580247275435:layer:LambdaInsightsExtension:35\n```\n\nAfter [installing](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcfn-guard\u002Flatest\u002Fug\u002Fsetting-up.html) the CloudFormation Guard utility, you could then validate your template as follows:\n\n```bash\ncfn-guard validate --rules etc\u002Frules.guard --data iac\u002Flambda.yaml\n```\n\nThis would give you an output as follows:\n\n```bash\nlambda.yaml Status = FAIL\nFAILED rules\nrules.guard\u002Flambda_soon_to_be_deprecated_runtime\n---\nEvaluating data lambda.yaml against rules rules.guard\nNumber of non-compliant resources 1\nResource = Fn {\n  Type      = AWS::Lambda::Function\n  Rule = lambda_soon_to_be_deprecated_runtime {\n    ALL {\n      Check =  Runtime not IN  [\"nodejs16.x\",\"nodejs14.x\",\"python3.7\",\"java8\",\"dotnet7\",\"go1.x\",\"ruby2.7\",\"provided\"] {\n        ComparisonError {\n          Message          = Lambda function is using a runtime that is targeted for deprecation.\n          Error            = Check was not compliant as property [\u002FResources\u002FFn\u002FProperties\u002FRuntime[L:88,C:15]] was not present in [(resolved, Path=[L:0,C:0] Value=[\"nodejs16.x\",\"nodejs14.x\",\"python3.7\",\"java8\",\"dotnet7\",\"go1.x\",\"ruby2.7\",\"provided\"])]\n        }\n          PropertyPath    = \u002FResources\u002FFn\u002FProperties\u002FRuntime[L:88,C:15]\n          Operator        = NOT IN\n          Value           = \"python3.7\"\n          ComparedWith    = [[\"nodejs16.x\",\"nodejs14.x\",\"python3.7\",\"java8\",\"dotnet7\",\"go1.x\",\"ruby2.7\",\"provided\"]]\n          Code:\n               86.  Fn:\n               87.    Type: AWS::Lambda::Function\n               88.    Properties:\n               89.      Runtime: python3.7\n               90.      CodeUri: src\n               91.      Handler: fn.handler\n\n      }\n    }\n  }\n}\n```\n\nCloudFormation Guard allows your developers to see from their local developer workstations that they need to update the template to use a runtime that is allowed by the organization. This happens prior to committing to a code repository and subsequently failing checks within a CI\u002FCD pipeline. As a result, your developers get this feedback on how to develop compliant templates and shift his or her time to writing code that delivers business value. This control can be applied on the local developer workstation, in a pre-commit validation webhook, and\u002For in the CI\u002FCD pipeline prior to deployment.\n\n### Caveats\n\nServerless developers who are using AWS SAM templates to define Lambda functions, be aware that you need to update the CloudFormation Guard rule to search for the `AWS::Serverless::Function` resource type as follows.\n\n```\nlet lambda_functions = Resources.*[\n    Type == \"AWS::Serverless::Function\"\n]\n```\n\nCloudFormation Guard also expects the properties to be included within the resource definition. Meanwhile, AWS SAM templates allow for properties to be specified in a separate Globals section. Properties that are defined in the [Globals](https:\u002F\u002Fdocs.aws.amazon.com\u002Fserverless-application-model\u002Flatest\u002Fdeveloperguide\u002Fsam-specification-template-anatomy-globals.html) section are not validated with your CloudFormation Guard rules.\n\nAs outlined in the CloudFormation Guard troubleshooting [documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcfn-guard\u002Flatest\u002Fug\u002Ftroubleshooting.html), be aware that CloudFormation Guard doesn’t support short-form intrinsics like `!GetAtt` or `!Sub` and instead require using the expanded forms: `Fn::GetAtt` and `Fn::Sub`. The example above doesn’t evaluate the Role property, so the short-form intrinsic was used for simplicity.\n",[13],{"title":14,"collapsible":15,"isCollapsed":15,"content":16},"Governance in Depth",false,[17,29,35,44,51,59,66,73],{"title":18,"order":19,"authors":20,"callout":21,"time":25,"path":26,"id":27,"link":28},"1. Introduction",1,[9],{"title":22,"description":23,"link":24},"Watch this video","This reinvent 2023 video covers the topics of this guide in further detail.","https:\u002F\u002Fyoutu.be\u002Fqlz15v-gHFI","5 min","1-introduction","1-introduction.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F1-introduction",{"title":6,"order":7,"authors":30,"time":31,"path":32,"id":33,"link":34},[9,10],"4 min","2-proactive-guard","2-proactive-guard.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F2-proactive-guard",{"title":36,"order":37,"authors":38,"time":40,"path":41,"id":42,"link":43},"3. Proactive Controls with AWS Config",3,[39],"Debasis Rath","6 min","3-proactive-config","3-proactive-config.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F3-proactive-config",{"title":45,"order":46,"authors":47,"time":25,"path":48,"id":49,"link":50},"4. Detective Controls with AWS Config",4,[39],"4-detective-config","4-detective-config.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F4-detective-config",{"title":52,"order":53,"authors":54,"time":55,"path":56,"id":57,"link":58},"5. Code Signing with AWS Signer",5,[9],"3 min","5-code-signing","5-code-signing.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F5-code-signing",{"title":60,"order":61,"authors":62,"time":55,"path":63,"id":64,"link":65},"6. Code Scanning with Amazon Inspector",6,[10],"6-code-scanning","6-code-scanning.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F6-code-scanning",{"title":67,"order":68,"authors":69,"time":40,"path":70,"id":71,"link":72},"7. Observability for Security and Compliance",7,[39],"7-observability","7-observability.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F7-observability",{"title":74,"order":75,"authors":76,"time":77,"path":78,"id":79,"link":80},"8. Discussion of Open Source and other AWS tools",8,[9],"1 min","8-open-source-and-other-tools","8-open-source-and-other-tools.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Fgovernance\u002F8-open-source-and-other-tools","LIST",[83,84,85],"content\u002Fcontributors\u002Fheeki-park.json","content\u002Fcontributors\u002Fdebasis-rath.json","content\u002Fcontributors\u002Fpallavi-srivastava.json","Implementing governance in depth for serverless applications",1789900521892]