Custom Scripts

1. Navigate to Environment > Policy Management and select the Custom Scripts tab.

2. Click New.

3. In the New Custom Script dialog, complete these fields:

   • Name

   • Description

   • Type

4. Enter the script in the main text field using JavaScript (specifically ES2020). For details and examples of each type of Custom Script, see the Custom Script Reference.

5. To define parameters used in the script:

   1. Click + next to Custom Parameters.
   2. Enter a Name that corresponds to a parameter defined in the script.
   3. Complete the other fields for the parameter.

6. Click Save to save and/or debug the script. For information about debugging each type of Custom Script, see the Custom Script Reference.

Custom Scripts created by Tripwire (Author=Tripwire) are read-only and can't be edited directly, but you can duplicate them and then edit the duplicates.

1. Navigate to Environment > Policy Management and select the Custom Scripts tab.

2. To edit a non-Tripwire Custom Script, select it and click Edit.

   To edit a Tripwire Custom Script, select it and click Duplicate. Then select the new Custom Script and click Edit.

3. In the Edit Custom Script dialog, edit these fields if desired:

   • Name

   • Description

   • Type

4. Edit the script using JavaScript (specifically ES2020) or modify any of the parameters associated with it. For details and examples of each type of Custom Script, see the Custom Script Reference.

5. Click Save to save and/or debug the script.

This Retrieval Script loops through all AWS Cloudtrails provided by a Prerequisite Rule and calls both GetTrailStatus and GetEventSelectors on each trail:

const aws = require('builtins').aws

let getTrailStatus = async function(context, trailName, homeRegion) {
    try{
        let response = await aws({ service: 'CloudTrail', method: 'GetTrailStatus', params:{'Name': trailName}, config: {region: homeRegion}}, context);
        return response.IsLogging
    }
    catch(e){
        console.log(e)
    }
}

let getTrailEventSelectors = async function(context, trailName, homeRegion) {
    try{
        let response = await aws({ service: 'CloudTrail', method: 'GetEventSelectors', params:{'TrailName': trailName}, config: {region: homeRegion}}, context);
        return response['EventSelectors']
    }
    catch(e){
        console.log(e)
    }
}

module.exports = async function(params, context) {
    //retrieving homeRegions for describeAlarms
    let TrailInfo = []
    await Promise.all(context.aws_cloudtrails.map(async trail => {
        let isLogging = await getTrailStatus(context, trail.Name, trail.HomeRegion)
        let trailEventSelectors = await getTrailEventSelectors(context, trail.Name, trail.HomeRegion)
        let temp_trail = {...trail}
        temp_trail.IsLogging = isLogging
      	temp_trail.EventSelectors = trailEventSelectors
        TrailInfo.push(temp_trail)
    }))

    return TrailInfo
}

To debug a Retrieval Script, assign it to a "Custom" Rule and then debug the Rule from the Rule debug screen.

We recommend keeping the Custom Script and the Rule open in separate tabs to make it easier to modify the script and then execute the Rule debug action.

This script responds to a failing Test by enabling log file validation for cloudtrails that do not have it enabled and then returning a list of cloudtrails that were remediated. You can see that the script got a list of failing trails from the failing Policy Test output via context.data.output. It loops through each one of those and executes an API call to enable log file validation.

const aws = require('builtins').aws
​
module.exports = async function(params, context) {
    let failingCloudTrails = context.data.output
    await Promise.all(failingCloudTrails.map(async badCloudTrail => {
        console.info("Enabling Log File Validation For CloudTrail: ",badCloudTrail)
        let updateParams = {
            'Name': badCloudTrail,
            'EnableLogFileValidation': true
        }
        let updateKey = await aws({ service: 'CloudTrail', method: 'UpdateTrail', params: updateParams },context)
    }))
    let remediationResponse = {
        'message': 'Enabled Log File Validation on CloudTrails',
        'CloudTrails': failingCloudTrails
    }
    return remediationResponse
}

To debug a Policy Response script:

1. Assign the Policy Response script to a Policy Test.
2. Scan a Cloud Account using the Policy Test to generate some results in the Cloud dashboard.
3. On the Edit Custom Script page, click Debug to open the debug panel.
4. In the debug panel, select the same Cloud Account you just scanned and the Policy Test that has the Custom Script specified as the response.
5. In the debug panel, click Run Fix Now.
6. Review the results and edit the script as necessary.

The Debug panel has the following fields:

• Last Item Result shows the last results associated with the selected Policy Test in the Debug panel.
• Test Output shows the filtered test output for the selected Policy Test and the selected Cloud Account.
• Test Result shows the pass/fail status of the selected Policy Test and the selected Cloud Account.
• Response Fix Options shows any options available for fixing a failing Policy Test. You can modify these options here before clicking the Run Fix Now button.

This script exposes 4 different parameters to a user for responding to an element (blockPublicAcls, ignorePublicAcls, blockPublicPolicy, and restrictPublicBuckets). You can use these parameters to specify how CM should respond to a particular Element (in this case to a particular S3 bucket). The script will modify the settings of a bucket according to the specified configuration.

module.exports = async function (params, context) {
  const aws = require('builtins').aws
  const newParams = {}
  if (params.blockPublicAcls !== undefined) {
    newParams.BlockPublicAcls = params.blockPublicAcls
  }
  if (params.ignorePublicAcls !== undefined) {
    newParams.IgnorePublicAcls = params.ignorePublicAcls
  }
  if (params.blockPublicPolicy !== undefined) {
    newParams.BlockPublicPolicy = params.blockPublicPolicy
  }
  if (params.restrictPublicBuckets !== undefined) {
    newParams.RestrictPublicBuckets = params.restrictPublicBuckets
  }
  if (Object.entries(newParams).length === 0) {
    throw new Error('No params to enforce')
  }
  const existingParams = {
    BlockPublicAcls: context.data.current.attributes.blockPublicAcls,
    IgnorePublicAcls: context.data.current.attributes.ignorePublicAcls,
    BlockPublicPolicy: context.data.current.attributes.blockPublicPolicy,
    RestrictPublicBuckets:
      context.data.current.attributes.restrictPublicBuckets,
  }
  console.info('Existing Public Access Block settings: ', existingParams)
  console.info('Public Access Block settings to enforce: ', newParams)
  const paramsToSet = {
    ...existingParams,
    ...newParams,
  }
  const response = await aws(
    {
      service: 'S3',
      method: 'PutPublicAccessBlock',
      params: {
        Bucket: context.data.current.bucketName,
        PublicAccessBlockConfiguration: paramsToSet,
      },
    },
    context
  )
  return response
}

Let's say you have configured a response to specify that blockPublicAcls must be true. Then CM scans an S3 bucket using a Rule with this Change Response Script and returns the following settings:

{
    'bucketName': 'bucket1',
    'arn': 'bucket-arn',
    'attributes': {
        'blockPublicAcls': false,
    },
    'policyData': {'something': 'here'}
}

CM compares the value of the blockPublicAcls attribute of the bucket (false), to the response value (true). Because these two values differ, the Change Response script is executed for this bucket.

The script received a "params" value of '{blockPublicAcls: true}' and receive the bucket data from the scan via "context.data.current". The script pulls the bucket name out of "context.data.current" and executes an API call to set BlockPublicAcls to true.

module.exports = async (params = {}, context = {}) => {
 const url = 'https://login.example.com/dologin'
 const request = 'username=${context.username}&password=${context.secrets.password}'
 const response = await fetch(url, {
   method: 'post',
   body: request,
   headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
   })
 const data = await response.json()
 return {
   token: data.access_token
 }
}

Rules can then use login.token as an authentication header, or whatever is needed for the API.