SyntheticSun
SyntheticSun copied to clipboard
[PFR] SyntheticSun V2
Story As a user of SyntheticSun, I want to refactor a majority of the solution for ease of deployment and dynamic onboarding for logging sources.
Definition of Done
- No more than 1 CFN template, if any at all
- Dynamic creation of all WAF and GuardDuty components (Threat Intel Sets, WAF IP Sets)
- Onboarding of FMS & baseline Policies
- Buffer all logging with SQS
- Dynamic onboarding of ALB and APIGW log sources
- Add CloudFront & Route53 to Scope
- New method to install Suricata on SSM-managed Instances
- Updated Readme
Nice to Have N/A
Additional Information In the current form, SyntheticSun is little more than a POC, it was not meant for ease of deployment and relied too heavily on CFN. A majority of the CFN templates should be removed, and new scripts take its place, this goes for the build automation pieces especially given that you would need to use a StackSet in most regions