InsuranceLake Security

Contents

• Infrastructure Code
• Application Code

For more information on how AWS services come together in InsuranceLake to align with the Security Pillar of the AWS Well-Architected Framework, refer to the InsuranceLake Well-architected Pillar Alignment for Security.

Infrastructure Code

InsuranceLake uses CDK-nag to confirm AWS resource security recommendations are followed. CDK-nag can generate warnings, which may need to be fixed depending on the context, and errors, which will interrupt the stack synthesis and prevent any deployment.

To force synthesis of all stacks (including the CodePipeline deployed stacks), which will check all code and generate all reports, use the following command:

cdk synth '**'

When this operation is complete, you will also have access to the CDK-nag reports in CSV format in the cdk.out directory and assembly directories.

By default, the AWS Solutions Rules Pack is used, but any combination of CDK Nag Rules packs can be selected by adjusting the source code in four locations (two for both the Infrastructure and ETL codebases):

Infrastructure app.py Line 21, ETL app.py Line 20:

# Enable CDK Nag for the Mirror repository, Pipeline, and related stacks
# Environment stacks must be enabled on the Stage resource
cdk.Aspects.of(app).add(AwsSolutionsChecks())

Infrastructure pipeline_stack.py Line 148, ETL pipeline_stack.py Line 147

        # Enable CDK Nag for environment stacks before adding to
        # pipeline, which are deployed with CodePipeline
        cdk.Aspects.of(pipeline_deploy_stage).add(AwsSolutionsChecks())

Application Code

InsuranceLake uses Bandit and Amazon CodeGuru for static code analysis of all helper scripts, Lambda functions, and AWS Glue jobs.

To configure CodeGuru Code Reviews, follow the AWS Documentation on creating Code Reviews.

To scan all application code using Bandit, use the following command:

bandit -r --ini .bandit