pimlock / macie-remediation-sam

Template for writing Amazon Macie remediators

SAM application that automatically remediates alerts generated by Amazon Macie.

Why?

• remediate some of alerts automatically, without manual intervention!
  • more secure
  • more compliant

Package contains some sample remediators, but you will need to write your own that fit your use cases.

Setup

Clone the repo

git clone https://github.com/pimlock/macie-remediation-sam.git
cd macie-remediation-sam

Install dev dependencies (make sure you are using Python3)

pip install -r dev-requirements.txt

Create Virtualenv:

virtualenv venv
source venv/bin/activate

Create CloudFormation stack

This step requires your AWS credentials to be set up:

• as export AWS_ACCESS_KEY_ID=""; export AWS_SECRET_ACCESS_KEY=""
• stored in ~/.aws/credentials

Create required S3 buckets:

1. Where CloudFormation will upload Lambda code to (CODE_DEPLOYMENT_BUCKET)

# this bucket is where the zip file with AWSLambda code will be uploaded (it's used by CloudFormation to deploy Lambda)
export CODE_DEPLOYMENT_BUCKET=my-bucket

# creates deployable package for CloudFormation
scripts/package.sh

# creates/updates the CloudFormation stack
scripts/deploy.sh

© 2017 Piotr Mlocek. This project is licensed under the terms of the MIT license.