Skip to content

Commit 366b492

Browse files
feat(iot): scheduled audit (#31776)
### Issue # (if applicable) Closes #31779. ### Reason for this change Cloudformation supports for creating AWS IoT scheduled audit but AWS CDK does not. ### Description of changes - Define `ScheduledAudit` construct Cloudformation does not support two audit checks. Therefore I have not implemented these checks in the `AuditCheck` enum. - INTERMEDIATE_CA_REVOKED_FOR_ACTIVE_DEVICE_CERTIFICATES_CHECK - IOT_POLICY_POTENTIAL_MIS_CONFIGURATION_CHECK If we try to deploy these checks, the deployment will fail. ```sh Resource handler returned message: "Request contains an invalid Audit Check Name. (Service: Iot, Status Code: 400, Request ID: 3fb58c68-2845-4cc0-882c-7d9b5495ff2a)" (RequestToken: dcb09acd-609f-dfe5-7b63-6eb208052949, HandlerErrorCode: InvalidRequest) ``` ### Description of how you validated changes Added both unit and integ tests. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 0a0e4ad commit 366b492

File tree

9 files changed

+855
-4
lines changed

9 files changed

+855
-4
lines changed

packages/@aws-cdk/aws-iot-alpha/README.md

+37
Original file line numberDiff line numberDiff line change
@@ -139,3 +139,40 @@ new iot.AccountAuditConfiguration(this, 'AuditConfiguration', {
139139
},
140140
});
141141
```
142+
143+
### Scheduled Audit
144+
145+
You can create a [scheduled audit](https://docs.aws.amazon.com/iot-device-defender/latest/devguide/AuditCommands.html#device-defender-AuditCommandsManageSchedules) that is run at a specified time interval. Checks must be enabled for your account by creating `AccountAuditConfiguration`.
146+
147+
```ts
148+
declare const config: iot.AccountAuditConfiguration;
149+
150+
// Daily audit
151+
const dailyAudit = new iot.ScheduledAudit(this, 'DailyAudit', {
152+
accountAuditConfiguration: config,
153+
frequency: iot.Frequency.DAILY,
154+
auditChecks: [
155+
iot.AuditCheck.AUTHENTICATED_COGNITO_ROLE_OVERLY_PERMISSIVE_CHECK,
156+
],
157+
})
158+
159+
// Weekly audit
160+
const weeklyAudit = new iot.ScheduledAudit(this, 'WeeklyAudit', {
161+
accountAuditConfiguration: config,
162+
frequency: iot.Frequency.WEEKLY,
163+
dayOfWeek: iot.DayOfWeek.SUNDAY,
164+
auditChecks: [
165+
iot.AuditCheck.CA_CERTIFICATE_EXPIRING_CHECK,
166+
],
167+
});
168+
169+
// Monthly audit
170+
const monthlyAudit = new iot.ScheduledAudit(this, 'MonthlyAudit', {
171+
accountAuditConfiguration: config,
172+
frequency: iot.Frequency.MONTHLY,
173+
dayOfMonth: iot.DayOfMonth.of(1),
174+
auditChecks: [
175+
iot.AuditCheck.CA_CERTIFICATE_KEY_QUALITY_CHECK,
176+
],
177+
});
178+
```

packages/@aws-cdk/aws-iot-alpha/lib/index.ts

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ export * from './action';
22
export * from './audit-configuration';
33
export * from './iot-sql';
44
export * from './logging';
5+
export * from './scheduled-audit';
56
export * from './topic-rule';
67

78
// AWS::IoT CloudFormation Resources:

0 commit comments

Comments
 (0)