<commit_before>AWSTemplateFormatVersion: 2010-09-09
Description: Deploy MozDef autoscaled EC2 instance group and ALB into AWS
Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: The VPC ID of the VPC to deploy in
  InstanceType:
    Type: String
    Description: EC2 instance type, e.g. m1.small, m1.large, etc.
    Default: m5.large
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Name of an existing EC2 KeyPair to enable SSH access to the web server
  IamInstanceProfile:
    Type: String
    Description: The ARN of the IAM Instance Profile
  AutoScaleGroupSubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: A comma delimited list of subnet IDs
  AMIImageId:
    Type: AWS::EC2::Image::Id
    Description: The AMI Image ID to use of the EC2 instance
  EFSID:
    Type: String
    Description: Logical ID of the EFS Filesystem
  EFSMountPoint:
    Type: String
    Description: Directory to mount EFS to
    Default: '/var/lib/mongodb'
  MozDefSecurityGroupId:
    Type: AWS::EC2::SecurityGroup::Id
    Description: The security group to apply to the EC2 instance
  MozDefLoadBalancerSecurityGroupId:
    Type: AWS::EC2::SecurityGroup::Id
    Description: The security group to apply to the EC2 instance
  ACMCertArn:
    Type: String
    Description: The arn of your pre-issued certificate for ssl termination.
  ESURL:
    Type: String
    Description: The AWS ES endpoint URL
    Default: http://elasticsearch.example.com/
  KibanaURL:
    Type: String
    Description: The AWS ES Kibana complete URL
    Default: https://kibana.example.com/_plugin/kibana
  KibanaDomainOnlyURL:
    Type: String
    Description: The AWS ES Kibana URL with domain only
    Default: https://kibana.example.com/
  OIDCAuthorizationEndpoint:
    Type: String
    Default: ''
    ConstraintDescription: A valid URL
    Description: "The URL of the authorization endpoint found for your OIDC provider generaly found on (Example: https://auth.example.com/.well-known/openid-configuration)"
  OIDCClientId:
    Type: String
    Default: ''
    Description: The client ID that your OIDC provider issues you for your Mozdef instance.
  OIDCClientSecret:
    Type: String
    Default: ''
    Description: The secret that your OIDC provider issues you for your Mozdef instance.
    NoEcho: true
  OIDCIssuer:
    Type: String
    Default: ''
    Description: Generally can be found at the .well-known endpoint for your provider.
  OIDCTokenEndpoint:
    Type: String
    Default: ''
    Description: Generally can be found at the .well-known endpoint for your provider.
  OIDCUserInfoEndpoint:
    Type: String
    Default: ''
    Description: Generally can be found at the .well-known endpoint for your provider.
  CloudTrailSQSNotificationQueueName:
    Type: String
    Description: The name of the SQS used for CloudTrail notifications.
  MozDefSQSQueueName:
    Type: String
    Description: The name of the generic SQS queue used to pickup events.
  DomainName:
    Type: String
    Description: The fully qualified domain you'll be hosting MozDef at.
  AlertQueueUrl:
    Type: String
    Description: The url of the alert queue kombu should use for taskExchange.
  ALBBasicAuthSecret:
    Type: String
    Default: ''
    Description: Default basic authentication password, if enabled.
    NoEcho: true
Rules:
  ALBBasicAuthOnly:
    RuleCondition: !Not [ !Equals [ !Ref 'ALBBasicAuthSecret', '' ] ]
    Assertions:
    - Assert:
        !EachMemberEquals
        - - !Ref 'OIDCAuthorizationEndpoint'
          - !Ref 'OIDCClientId'
          - !Ref 'OIDCClientSecret'
          - !Ref 'OIDCIssuer'
          - !Ref 'OIDCTokenEndpoint'
          - !Ref 'OIDCUserInfoEndpoint'
        - ''
      AssertDescription: >
        If you set an ALBBasicAuthSecret indicating you wish to use HTTP Basic
        Auth for authentication, you must leave all OIDC attributes blank
  OIDCHasAllRequiredParameters:
    RuleCondition:
      !Or
      - !Not [ !Equals [ !Ref 'OIDCAuthorizationEndpoint', '' ] ]
      - !Not [ !Equals [ !Ref 'OIDCClientId', '' ] ]
      - !Not [ !Equals [ !Ref 'OIDCClientSecret', '' ] ]
      - !Not [ !Equals [ !Ref 'OIDCIssuer', '' ] ]
      - !Not [ !Equals [ !Ref 'OIDCTokenEndpoint', '' ] ]
      - !Not [ !Equals [ !Ref 'OIDCUserInfoEndpoint', '' ] ]
    Assertions:
    - Assert:
        !And
        - !Not [ !Equals [ !Ref 'OIDCAuthorizationEndpoint', '' ] ]
        - !Not [ !Equals [ !Ref 'OIDCClientId', '' ] ]
        - !Not [ !Equals [ !Ref 'OIDCClientSecret', '' ] ]
        - !Not [ !Equals [ !Ref 'OIDCIssuer', '' ] ]
        - !Not [ !Equals [ !Ref 'OIDCTokenEndpoint', '' ] ]
        - !Not [ !Equals [ !Ref 'OIDCUserInfoEndpoint', '' ] ]
        - !Not [ !Equals [ !Ref 'ACMCertArn', '' ] ]
      AssertDescription: >
        If you set any OIDC parameter indicating you wish to use OIDC for
        authentication, you must set all six OIDC parameters, [
        OIDCAuthorizationEndpoint, OIDCClientId, OIDCClientSecret, OIDCIssuer,
        OIDCTokenEndpoint, OIDCUserInfoEndpoint] as well as an ACM Certificate
        in the ACMCertArn parameter
  SomeAuthHasBeenConfigured:
    Assertions:
    - Assert:
        !Or
        - !Not [ !Equals [ !Ref 'OIDCClientId', '' ] ]
        - !Not [ !Equals [ !Ref 'ALBBasicAuthSecret', '' ] ]
      AssertDescription: >
        You must choose either to use HTTP Basic Auth or OIDC for authentication.
        To choose HTTP Basic Auth you must set an ALBBasicAuthSecret. To choose
        OIDC you must set all six OIDC parameters, [OIDCAuthorizationEndpoint,
        OIDCClientId, OIDCClientSecret, OIDCIssuer, OIDCTokenEndpoint,
        OIDCUserInfoEndpoint] as well as an ACM Certificate in the ACMCertArn
        parameter.
Conditions:
  OIDCEnabledCondition:
    !Not [!Equals [!Ref OIDCClientId, '']]
  OIDCNotEnabledCondition:
    !Equals [!Ref OIDCClientId, '']
  SSLEnabledCondition:
    !And [!Not [!Equals [!Ref ACMCertArn, '']], !Equals [!Ref OIDCClientId, '']]
  SSLNotEnabledCondition:
    !And [!Equals [!Ref ACMCertArn, ''], !Equals [!Ref OIDCClientId, '']]
  SSLEnabledWithOidcCondition:
    !And [!Not [!Equals [!Ref ACMCertArn, '']], !Not [!Equals [!Ref OIDCClientId, '']]]
Resources:
  MozDefElasticLoadBalancingV2TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckPath: '/health'
      HealthCheckIntervalSeconds: 5
      HealthCheckTimeoutSeconds: 2
      HealthyThresholdCount: 2
      Port: 80
      Protocol: HTTP
      Tags:
        - Key: application
          Value: mozdef
        - Key: stack
          Value: !Ref AWS::StackName
      VpcId: !Ref VpcId
  MozDefElasticLoadBalancingV2TargetGroupKibana:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckPath: '/health'
      Port: 9090
      Protocol: HTTP
      Tags:
        - Key: application
          Value: mozdef
        - Key: stack
          Value: !Ref AWS::StackName
      VpcId: !Ref VpcId
  MozDefLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      AssociatePublicIpAddress: true
      IamInstanceProfile: !Ref IamInstanceProfile
      ImageId: !Ref AMIImageId
      InstanceType: !Ref InstanceType
      BlockDeviceMappings:
        - DeviceName: "/dev/xvda"
          Ebs:
            VolumeSize: 14
            VolumeType: gp2
      KeyName: !Ref KeyName
      SecurityGroups:
        - !Ref MozDefSecurityGroupId
      UserData:
        Fn::Base64: !Sub |
          #cloud-config

          packages:
            - amazon-efs-utils
          write_files:
            - content: |
                # Cloudy MozDef env file as imported by docker compose.
                # Drives the configuration of variables for a variety of containers.
                OIDC_CLIENT_ID=${OIDCClientId}
                OPTIONS_ESSERVERS=${ESURL}
                # Private unauthed kibana url for accessing kibana API
                OPTIONS_KIBANAURL=${KibanaURL}
                # The OPTIONS_METEOR_KIBANAURL uses the reserved word "relative" which triggers MozDef
                # to use relative links to Kibana : https://github.com/mozilla/MozDef/pull/956
                OPTIONS_METEOR_KIBANAURL=http://relative:9090/_plugin/kibana/
                OPTIONS_METEOR_ROOTURL=https://${DomainName}
                METEOR_BACKEND=meteor:3000
                ESBACKEND=${KibanaDomainOnlyURL}
                # Disable certain web ui features
                OPTIONS_REMOVE_FEATURES=ipblocklist,fqdnblocklist,globe<commit_msg>Remove globe from cloudy mozdef feature list<commit_after>AWSTemplateFormatVersion: 2010-09-09
Description: Deploy MozDef autoscaled EC2 instance group and ALB into AWS
Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
    Description: The VPC ID of the VPC to deploy in
  InstanceType:
    Type: String
    Description: EC2 instance type, e.g. m1.small, m1.large, etc.
    Default: m5.large
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Name of an existing EC2 KeyPair to enable SSH access to the web server
  IamInstanceProfile:
    Type: String
    Description: The ARN of the IAM Instance Profile
  AutoScaleGroupSubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: A comma delimited list of subnet IDs
  AMIImageId:
    Type: AWS::EC2::Image::Id
    Description: The AMI Image ID to use of the EC2 instance
  EFSID:
    Type: String
    Description: Logical ID of the EFS Filesystem
  EFSMountPoint:
    Type: String
    Description: Directory to mount EFS to
    Default: '/var/lib/mongodb'
  MozDefSecurityGroupId:
    Type: AWS::EC2::SecurityGroup::Id
    Description: The security group to apply to the EC2 instance
  MozDefLoadBalancerSecurityGroupId:
    Type: AWS::EC2::SecurityGroup::Id
    Description: The security group to apply to the EC2 instance
  ACMCertArn:
    Type: String
    Description: The arn of your pre-issued certificate for ssl termination.
  ESURL:
    Type: String
    Description: The AWS ES endpoint URL
    Default: http://elasticsearch.example.com/
  KibanaURL:
    Type: String
    Description: The AWS ES Kibana complete URL
    Default: https://kibana.example.com/_plugin/kibana
  KibanaDomainOnlyURL:
    Type: String
    Description: The AWS ES Kibana URL with domain only
    Default: https://kibana.example.com/
  OIDCAuthorizationEndpoint:
    Type: String
    Default: ''
    ConstraintDescription: A valid URL
    Description: "The URL of the authorization endpoint found for your OIDC provider generaly found on (Example: https://auth.example.com/.well-known/openid-configuration)"
  OIDCClientId:
    Type: String
    Default: ''
    Description: The client ID that your OIDC provider issues you for your Mozdef instance.
  OIDCClientSecret:
    Type: String
    Default: ''
    Description: The secret that your OIDC provider issues you for your Mozdef instance.
    NoEcho: true
  OIDCIssuer:
    Type: String
    Default: ''
    Description: Generally can be found at the .well-known endpoint for your provider.
  OIDCTokenEndpoint:
    Type: String
    Default: ''
    Description: Generally can be found at the .well-known endpoint for your provider.
  OIDCUserInfoEndpoint:
    Type: String
    Default: ''
    Description: Generally can be found at the .well-known endpoint for your provider.
  CloudTrailSQSNotificationQueueName:
    Type: String
    Description: The name of the SQS used for CloudTrail notifications.
  MozDefSQSQueueName:
    Type: String
    Description: The name of the generic SQS queue used to pickup events.
  DomainName:
    Type: String
    Description: The fully qualified domain you'll be hosting MozDef at.
  AlertQueueUrl:
    Type: String
    Description: The url of the alert queue kombu should use for taskExchange.
  ALBBasicAuthSecret:
    Type: String
    Default: ''
    Description: Default basic authentication password, if enabled.
    NoEcho: true
Rules:
  ALBBasicAuthOnly:
    RuleCondition: !Not [ !Equals [ !Ref 'ALBBasicAuthSecret', '' ] ]
    Assertions:
    - Assert:
        !EachMemberEquals
        - - !Ref 'OIDCAuthorizationEndpoint'
          - !Ref 'OIDCClientId'
          - !Ref 'OIDCClientSecret'
          - !Ref 'OIDCIssuer'
          - !Ref 'OIDCTokenEndpoint'
          - !Ref 'OIDCUserInfoEndpoint'
        - ''
      AssertDescription: >
        If you set an ALBBasicAuthSecret indicating you wish to use HTTP Basic
        Auth for authentication, you must leave all OIDC attributes blank
  OIDCHasAllRequiredParameters:
    RuleCondition:
      !Or
      - !Not [ !Equals [ !Ref 'OIDCAuthorizationEndpoint', '' ] ]
      - !Not [ !Equals [ !Ref 'OIDCClientId', '' ] ]
      - !Not [ !Equals [ !Ref 'OIDCClientSecret', '' ] ]
      - !Not [ !Equals [ !Ref 'OIDCIssuer', '' ] ]
      - !Not [ !Equals [ !Ref 'OIDCTokenEndpoint', '' ] ]
      - !Not [ !Equals [ !Ref 'OIDCUserInfoEndpoint', '' ] ]
    Assertions:
    - Assert:
        !And
        - !Not [ !Equals [ !Ref 'OIDCAuthorizationEndpoint', '' ] ]
        - !Not [ !Equals [ !Ref 'OIDCClientId', '' ] ]
        - !Not [ !Equals [ !Ref 'OIDCClientSecret', '' ] ]
        - !Not [ !Equals [ !Ref 'OIDCIssuer', '' ] ]
        - !Not [ !Equals [ !Ref 'OIDCTokenEndpoint', '' ] ]
        - !Not [ !Equals [ !Ref 'OIDCUserInfoEndpoint', '' ] ]
        - !Not [ !Equals [ !Ref 'ACMCertArn', '' ] ]
      AssertDescription: >
        If you set any OIDC parameter indicating you wish to use OIDC for
        authentication, you must set all six OIDC parameters, [
        OIDCAuthorizationEndpoint, OIDCClientId, OIDCClientSecret, OIDCIssuer,
        OIDCTokenEndpoint, OIDCUserInfoEndpoint] as well as an ACM Certificate
        in the ACMCertArn parameter
  SomeAuthHasBeenConfigured:
    Assertions:
    - Assert:
        !Or
        - !Not [ !Equals [ !Ref 'OIDCClientId', '' ] ]
        - !Not [ !Equals [ !Ref 'ALBBasicAuthSecret', '' ] ]
      AssertDescription: >
        You must choose either to use HTTP Basic Auth or OIDC for authentication.
        To choose HTTP Basic Auth you must set an ALBBasicAuthSecret. To choose
        OIDC you must set all six OIDC parameters, [OIDCAuthorizationEndpoint,
        OIDCClientId, OIDCClientSecret, OIDCIssuer, OIDCTokenEndpoint,
        OIDCUserInfoEndpoint] as well as an ACM Certificate in the ACMCertArn
        parameter.
Conditions:
  OIDCEnabledCondition:
    !Not [!Equals [!Ref OIDCClientId, '']]
  OIDCNotEnabledCondition:
    !Equals [!Ref OIDCClientId, '']
  SSLEnabledCondition:
    !And [!Not [!Equals [!Ref ACMCertArn, '']], !Equals [!Ref OIDCClientId, '']]
  SSLNotEnabledCondition:
    !And [!Equals [!Ref ACMCertArn, ''], !Equals [!Ref OIDCClientId, '']]
  SSLEnabledWithOidcCondition:
    !And [!Not [!Equals [!Ref ACMCertArn, '']], !Not [!Equals [!Ref OIDCClientId, '']]]
Resources:
  MozDefElasticLoadBalancingV2TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckPath: '/health'
      HealthCheckIntervalSeconds: 5
      HealthCheckTimeoutSeconds: 2
      HealthyThresholdCount: 2
      Port: 80
      Protocol: HTTP
      Tags:
        - Key: application
          Value: mozdef
        - Key: stack
          Value: !Ref AWS::StackName
      VpcId: !Ref VpcId
  MozDefElasticLoadBalancingV2TargetGroupKibana:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckPath: '/health'
      Port: 9090
      Protocol: HTTP
      Tags:
        - Key: application
          Value: mozdef
        - Key: stack
          Value: !Ref AWS::StackName
      VpcId: !Ref VpcId
  MozDefLaunchConfiguration:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      AssociatePublicIpAddress: true
      IamInstanceProfile: !Ref IamInstanceProfile
      ImageId: !Ref AMIImageId
      InstanceType: !Ref InstanceType
      BlockDeviceMappings:
        - DeviceName: "/dev/xvda"
          Ebs:
            VolumeSize: 14
            VolumeType: gp2
      KeyName: !Ref KeyName
      SecurityGroups:
        - !Ref MozDefSecurityGroupId
      UserData:
        Fn::Base64: !Sub |
          #cloud-config

          packages:
            - amazon-efs-utils
          write_files:
            - content: |
                # Cloudy MozDef env file as imported by docker compose.
                # Drives the configuration of variables for a variety of containers.
                OIDC_CLIENT_ID=${OIDCClientId}
                OPTIONS_ESSERVERS=${ESURL}
                # Private unauthed kibana url for accessing kibana API
                OPTIONS_KIBANAURL=${KibanaURL}
                # The OPTIONS_METEOR_KIBANAURL uses the reserved word "relative" which triggers MozDef
                # to use relative links to Kibana : https://github.com/mozilla/MozDef/pull/956
                OPTIONS_METEOR_KIBANAURL=http://relative:9090/_plugin/kibana/
                OPTIONS_METEOR_ROOTURL=https://${DomainName}
                METEOR_BACKEND=meteor:3000
                ESBACKEND=${KibanaDomainOnlyURL}
                # Disable certain web ui features
                OPTIONS_REMOVE_FEATURES=ipblocklist,fqdnblocklist
{'fraction_non_alphanumeric': 0.08636921817437576, 'fraction_numerical': 0.0060815157008362085, 'mean_word_length': 2.7414132574928898, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 11, 'https://': 10, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5758351', 'n_tokens_mistral': 5285, 'n_tokens_neox': 5054, 'n_words': 1519}