Update CHANGELOG

Author: ingalls

CHANGELOG.md

@@ -10,9 +10,13 @@
 
 ## Version History
 
+### v1.13.0
+
+- :tada: Add and enforce ECS Execute Enabled = true check
+
 ### v1.12.0
 
-- :rocket: Fix error in Cloudformatio-Drift subject call
+- :rocket: Fix error in Cloudformation-Drift subject call
 
 ### v1.11.0
 

cloudformation/lib/rules.js

@@ -2,6 +2,40 @@ import cf from '@openaddresses/cloudfriend';
 
 const resources = {
     Resources: {
+        ECSRestrictedExecute: {
+            Type: "AWS::Config::ConfigRule",
+            Properties: {
+                ConfigRuleName: 'ECS-Service-Execute-Disabled',
+                Scope: {
+                    ComplianceResourceTypes: [ "AWS::ECS::Service" ]
+                },
+                Source: {
+                    "Owner": "CUSTOM_POLICY",
+                    SourceDetails: [{
+                        EventSource: "aws.config",
+                        MessageType: "ConfigurationItemChangeNotification"
+                    },{
+                        EventSource: "aws.config",
+                        MessageType: "OversizedConfigurationItemChangeNotification"
+                    }],
+                    CustomPolicyDetails: {
+                        PolicyRuntime: "guard-2.x.x",
+                        PolicyText: `
+                            rule ecs_service_execute_disabled
+                                when
+                                    resourceType == "AWS::ECS::Service"
+                            {
+                                configuration.EnableExecuteCommand == false
+                            }
+                        `,
+                        EnableDebugLogDelivery: false
+                    }
+                },
+                EvaluationModes: [{
+                    Mode: "DETECTIVE"
+                }]
+            }
+        },
         OpenSsh: {
             Type: "AWS::Config::ConfigRule",
             Properties: {

index.cjs

@@ -5,6 +5,7 @@ const Enabled_Urgent_Rules = [
     'Required-Tags',
     'Restricted-SSH',
     'Cloudformation-Drift',
+    'ECS-Service-Execute-Disabled',
     'Certificate-Expiration'
 ];