Skip to content

Commit 5e2c4cd

Browse files
ClareJonesBJSSClareJonesBJSS
committed
CCM-8574: Code review comments excl lambda layers
1 parent 438035c commit 5e2c4cd

12 files changed

+253
-255
lines changed

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed.tf‎

Lines changed: 3 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
resource "aws_cloudwatch_event_rule" "quarantine_guardduty_scan_failed" {
1+
resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed" {
22
name = "${local.csi}-quarantine-scan-failed"
33
description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is not NO_THREATS_FOUND"
44

@@ -19,38 +19,13 @@ resource "aws_cloudwatch_event_rule" "quarantine_guardduty_scan_failed" {
1919
}
2020

2121
resource "aws_cloudwatch_event_target" "quarantine_scan_failed_set_file_status" {
22-
rule = aws_cloudwatch_event_rule.quarantine_guardduty_scan_failed.name
22+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed.name
2323
arn = module.lambda_set_file_virus_scan_status.function_arn
2424
role_arn = aws_iam_role.quarantine_scan_failed.arn
2525
}
2626

2727
resource "aws_cloudwatch_event_target" "quarantine_scan_failed_delete_object" {
28-
rule = aws_cloudwatch_event_rule.quarantine_guardduty_scan_failed.name
28+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed.name
2929
arn = module.lambda_delete_failed_scanned_object.function_arn
3030
role_arn = aws_iam_role.quarantine_scan_failed.arn
3131
}
32-
33-
resource "aws_iam_role" "quarantine_scan_failed" {
34-
name = "${local.csi}-quarantine-scan-failed"
35-
assume_role_policy = data.aws_iam_policy_document.events_assume_role.json
36-
}
37-
38-
resource "aws_iam_role_policy" "quarantine_scan_failed" {
39-
name = "${local.csi}-quarantine-scan-failed"
40-
role = aws_iam_role.quarantine_scan_failed.id
41-
policy = data.aws_iam_policy_document.quarantine_scan_failed.json
42-
}
43-
44-
data "aws_iam_policy_document" "quarantine_scan_failed" {
45-
version = "2012-10-17"
46-
47-
statement {
48-
sid = "AllowLambdaInvoke"
49-
effect = "Allow"
50-
actions = ["lambda:InvokeFunction"]
51-
resources = [
52-
module.lambda_set_file_virus_scan_status.function_arn,
53-
module.lambda_delete_failed_scanned_object.function_arn
54-
]
55-
}
56-
}

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed.tf‎

Lines changed: 8 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -18,62 +18,20 @@ resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed" {
1818
})
1919
}
2020

21-
resource "aws_cloudwatch_event_target" "guardduty_quarantine_scan_passed_copy_object" {
21+
resource "aws_cloudwatch_event_target" "quarantine_scan_passed_set_file_status" {
2222
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed.name
23-
arn = module.lambda_copy_scanned_object_to_internal.function_arn
24-
role_arn = aws_iam_role.guardduty_quarantine_scan_passed.arn
23+
arn = module.lambda_set_file_virus_scan_status.function_arn
24+
role_arn = aws_iam_role.quarantine_scan_passed.arn
2525
}
2626

27-
resource "aws_cloudwatch_event_target" "guardduty_quarantine_scan_passed_set_file_status" {
27+
resource "aws_cloudwatch_event_target" "quarantine_scan_passed_copy_object" {
2828
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed.name
29-
arn = module.lambda_set_file_virus_scan_status.function_arn
30-
role_arn = aws_iam_role.guardduty_quarantine_scan_passed.arn
29+
arn = module.lambda_copy_scanned_object_to_internal.function_arn
30+
role_arn = aws_iam_role.quarantine_scan_passed.arn
3131
}
3232

33-
resource "aws_cloudwatch_event_target" "guardduty_quarantine_scan_passed_validate_files" {
33+
resource "aws_cloudwatch_event_target" "quarantine_scan_passed_validate_files" {
3434
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed.name
3535
arn = module.sqs_validate_letter_template_files.sqs_queue_arn
36-
role_arn = aws_iam_role.guardduty_quarantine_scan_passed.arn
37-
}
38-
39-
resource "aws_iam_role" "guardduty_quarantine_scan_passed" {
40-
name = "${local.csi}-quarantine-scan-passed"
41-
assume_role_policy = data.aws_iam_policy_document.events_assume_role.json
42-
}
43-
44-
resource "aws_iam_role_policy" "guardduty_quarantine_scan_passed" {
45-
name = "${local.csi}-quarantine-scan-passed"
46-
role = aws_iam_role.guardduty_quarantine_scan_passed.id
47-
policy = data.aws_iam_policy_document.guardduty_quarantine_scan_passed.json
48-
}
49-
50-
data "aws_iam_policy_document" "guardduty_quarantine_scan_passed" {
51-
version = "2012-10-17"
52-
53-
statement {
54-
sid = "AllowLambdaInvoke"
55-
effect = "Allow"
56-
actions = ["lambda:InvokeFunction"]
57-
resources = [
58-
module.lambda_copy_scanned_object_to_internal.function_arn,
59-
module.lambda_set_file_virus_scan_status.function_arn,
60-
]
61-
}
62-
63-
statement {
64-
sid = "AllowSQSSendMessage"
65-
effect = "Allow"
66-
actions = ["sqs:SendMessage"]
67-
resources = [module.sqs_validate_letter_template_files.sqs_queue_arn]
68-
}
69-
70-
statement {
71-
sid = "AllowKMS"
72-
effect = "Allow"
73-
actions = [
74-
"kms:Decrypt",
75-
"kms:GenerateDataKey"
76-
]
77-
resources = [var.kms_key_arn]
78-
}
36+
role_arn = aws_iam_role.quarantine_scan_passed.arn
7937
}

‎infrastructure/terraform/modules/backend-api/guardduty_malware_protection_plan_quarantine.tf‎

Lines changed: 0 additions & 152 deletions
Original file line numberDiff line numberDiff line change
@@ -14,155 +14,3 @@ resource "aws_guardduty_malware_protection_plan" "quarantine" {
1414
}
1515
}
1616
}
17-
18-
resource "aws_iam_role" "guardduty_quarantine" {
19-
name = "${local.csi}-guardduty-quarantine"
20-
description = "IAM Role for GuardDuty to provide S3 malware protection"
21-
assume_role_policy = data.aws_iam_policy_document.guardduty_assumerole.json
22-
}
23-
24-
resource "aws_iam_role_policy_attachment" "guardduty_quarantine" {
25-
role = aws_iam_role.guardduty_quarantine.name
26-
policy_arn = aws_iam_policy.guardduty_quarantine.arn
27-
}
28-
29-
resource "aws_iam_policy" "guardduty_quarantine" {
30-
name = "${local.csi}-guardduty"
31-
description = "Permissions for GuardDuty to provide S3 malware protection"
32-
policy = data.aws_iam_policy_document.guardduty_quarantine.json
33-
}
34-
35-
data "aws_iam_policy_document" "guardduty_assumerole" {
36-
statement {
37-
sid = "GuardDutyAssumeRole"
38-
effect = "Allow"
39-
40-
actions = [
41-
"sts:AssumeRole",
42-
]
43-
44-
principals {
45-
type = "Service"
46-
47-
identifiers = [
48-
"malware-protection-plan.guardduty.amazonaws.com"
49-
]
50-
}
51-
}
52-
}
53-
54-
#tfsec:ignore:aws-iam-no-policy-wildcards
55-
data "aws_iam_policy_document" "guardduty_quarantine" {
56-
statement {
57-
sid = "AllowManagedRuleToSendS3EventsToGuardDuty"
58-
effect = "Allow"
59-
actions = [
60-
"events:PutRule",
61-
"events:DeleteRule",
62-
"events:PutTargets",
63-
"events:RemoveTargets"
64-
]
65-
resources = [
66-
"arn:aws:events:${var.region}:${var.aws_account_id}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*"
67-
]
68-
condition {
69-
test = "StringLike"
70-
variable = "events:ManagedBy"
71-
values = [
72-
"malware-protection-plan.guardduty.amazonaws.com"
73-
]
74-
}
75-
}
76-
77-
statement {
78-
sid = "AllowGuardDutyToMonitorEventBridgeManagedRule"
79-
effect = "Allow"
80-
actions = [
81-
"events:DescribeRule",
82-
"events:ListTargetsByRule"
83-
]
84-
resources = [
85-
"arn:aws:events:${var.region}:${var.aws_account_id}:rule/DO-NOT-DELETE-AmazonGuardDutyMalwareProtectionS3*"
86-
]
87-
}
88-
89-
statement {
90-
sid = "AllowPostScanTag"
91-
effect = "Allow"
92-
actions = [
93-
"S3:PutObjectTagging",
94-
"S3:GetObjectTagging",
95-
"S3:PutObjectVersionTagging",
96-
"S3:GetObjectVersionTagging"
97-
]
98-
99-
resources = [
100-
"${module.s3bucket_quarantine.arn}/*"
101-
]
102-
}
103-
104-
statement {
105-
sid = "AllowEnableS3EventBridgeEvents"
106-
effect = "Allow"
107-
actions = [
108-
"s3:PutBucketNotification",
109-
"s3:GetBucketNotification"
110-
]
111-
resources = [
112-
module.s3bucket_quarantine.arn
113-
]
114-
}
115-
116-
statement {
117-
sid = "AllowPutValidationObject"
118-
effect = "Allow"
119-
actions = [
120-
"s3:PutObject"
121-
]
122-
resources = [
123-
"${module.s3bucket_quarantine.arn}/malware-protection-resource-validation-object"
124-
]
125-
}
126-
127-
statement {
128-
sid = "AllowCheckBucketOwnership"
129-
effect = "Allow"
130-
actions = [
131-
"s3:ListBucket"
132-
]
133-
resources = [
134-
module.s3bucket_quarantine.arn
135-
]
136-
}
137-
statement {
138-
sid = "AllowMalwareScan"
139-
effect = "Allow"
140-
actions = [
141-
"s3:GetObject",
142-
"s3:GetObjectVersion"
143-
]
144-
145-
resources = [
146-
"${module.s3bucket_quarantine.arn}/*"
147-
]
148-
}
149-
150-
statement {
151-
sid = "AllowKMSDecrypt"
152-
effect = "Allow"
153-
actions = [
154-
"kms:GenerateDataKey",
155-
"kms:Decrypt"
156-
]
157-
resources = [
158-
var.kms_key_arn
159-
]
160-
condition {
161-
test = "StringLike"
162-
variable = "kms:ViaService"
163-
values = [
164-
"s3.*.amazonaws.com"
165-
]
166-
}
167-
}
168-
}

0 commit comments

Comments
 (0)