ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 04:51:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(aws): enhance metadata for ssmincidents service (#9431)

Browse Source 
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
This commit is contained in:
Rubén De la Torre Vico
2025-12-26 13:11:01 +01:00
committed by GitHub
parent 8acdf8e65b
commit 9f4b5e01cf
2 changed files with 23 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/CHANGELOG.md
+1
View File
@@ -28,6 +28,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
- Update AWS SageMaker service metadata to new format [(#9407)](https://github.com/prowler-cloud/prowler/pull/9407)
- Update AWS Security Hub service metadata to new format [(#9409)](https://github.com/prowler-cloud/prowler/pull/9409)
- Update AWS SES service metadata to new format [(#9411)](https://github.com/prowler-cloud/prowler/pull/9411)
- Update AWS SSM Incidents service metadata to new format [(#9431)](https://github.com/prowler-cloud/prowler/pull/9431)
---
prowler/providers/aws/services/ssmincidents/ssmincidents_enabled_with_plans/ssmincidents_enabled_with_plans.metadata.json
+22 -14
View File
@@ -1,30 +1,38 @@
{
"Provider": "aws",
"CheckID": "ssmincidents_enabled_with_plans",
"CheckTitle": "Ensure SSM Incidents is enabled with response plans.",
"CheckType": [],
"CheckTitle": "SSM Incidents replication set is ACTIVE and has at least one response plan",
"CheckType": [
"Software and Configuration Checks/AWS Security Best Practices",
"Software and Configuration Checks/Industry and Regulatory Standards/NIST CSF Controls (USA)"
],
"ServiceName": "ssmincidents",
"SubServiceName": "",
"ResourceIdTemplate": "arn:aws:ssm:region:account-id:document/document-name",
"Severity": "low",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "Other",
"ResourceGroup": "monitoring",
"Description": "Ensure SSM Incidents is enabled with response plans.",
"Risk": "Not having SSM Incidents enabled can increase the risk of delayed detection and response to security incidents, unauthorized access, limited visibility into incidents and vulnerabilities",
"RelatedUrl": "https://docs.aws.amazon.com/incident-manager/latest/userguide/response-plans.html",
"Description": "**Incident Manager** uses a **replication set** and **response plans**. This evaluates whether a replication set exists and is `ACTIVE`, and that at least one response plan is configured for coordinated incident handling.",
"Risk": "Without an `ACTIVE` replication set or response plans, incidents lack coordinated engagement and automation, raising MTTR and impacting availability and integrity.\n\nThreats include prolonged outages, lateral movement, and data exfiltration from delayed containment and misrouted escalation.",
"RelatedUrl": "",
"AdditionalURLs": [
"https://docs.aws.amazon.com/incident-manager/latest/userguide/response-plans.html"
],
"Remediation": {
"Code": {
"CLI": "aws ssm-incidents create-response-plan",
"NativeIaC": "",
"Other": "",
"Terraform": ""
"CLI": "",
"NativeIaC": "```yaml\n# CloudFormation: create a minimal Incident Manager response plan\nResources:\n ResponsePlan:\n Type: AWS::SSMIncidents::ResponsePlan\n Properties:\n Name: <example_resource_name> # Critical: ensures at least one response plan exists\n IncidentTemplate: # Critical: required template for the response plan\n Title: <example_title> # Critical: required\n Impact: 5 # Critical: required (1=highest, 5=lowest)\n```",
"Other": "1. In the AWS Console, go to Systems Manager > Incident Manager\n2. Replication sets > Create replication set > add at least one Region > Create; wait until Status is ACTIVE\n3. Response plans > Create response plan > set Name, Title, and Impact > Create\n4. Verify: Replication set shows ACTIVE and at least one response plan exists",
"Terraform": "```hcl\n# Ensure replication set exists and becomes ACTIVE\nresource \"aws_ssmincidents_replication_set\" \"example\" {\n regions { # Critical: creates the replication set so it can be ACTIVE\n region_name = \"us-east-1\"\n }\n}\n\n# Create a minimal response plan\nresource \"aws_ssmincidents_response_plan\" \"example\" {\n name = \"<example_resource_name>\" # Critical: ensures at least one response plan exists\n\n incident_template { # Critical: required template for the plan\n title = \"<example_title>\"\n impact = 5\n }\n}\n```"
},
"Recommendation": {
"Text": "Enable SSM Incidents and create response plans",
"Url": "https://docs.aws.amazon.com/incident-manager/latest/userguide/response-plans.html"
"Text": "Establish an `ACTIVE` **replication set** and create **response plans** that define engagement, escalation, runbooks, severity, and communication.\n\nApply **least privilege** to automation roles, test plans regularly, integrate with monitoring to trigger them, and use **defense in depth** with redundant contacts and Regions.",
"Url": "https://hub.prowler.com/check/ssmincidents_enabled_with_plans"
}
},
"Categories": [],
"Categories": [
"resilience"
],
"DependsOn": [],
"RelatedTo": [],
"Notes": ""