Skip to content

Commit 2a28f5c

Browse files
authored
Add Service Quotas Module (#233)
1 parent 547a51a commit 2a28f5c

File tree

7 files changed

+449
-1
lines changed

7 files changed

+449
-1
lines changed

data-collection/deploy/deploy-data-collection.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ Metadata:
3535
- IncludeAWSFeedsModule
3636
- IncludeLicenseManagerModule
3737
- IncludeQuickSightModule
38+
- IncludeServiceQuotasModule
3839
ParameterLabels:
3940
DestinationBucket:
4041
default: 'Destination S3 bucket prefix'
@@ -86,6 +87,8 @@ Metadata:
8687
default: 'Include AWS Health Events Module'
8788
IncludeLicenseManagerModule:
8889
default: 'Include Marketplace Licensing Collection'
90+
IncludeServiceQuotasModule:
91+
default: 'Include Service Quota Data Collection'
8992
IncludeQuickSightModule:
9093
default: 'Include QuickSight User Collection Module'
9194

@@ -237,6 +240,11 @@ Parameters:
237240
Description: Collects Marketplace Licenses and Grants
238241
AllowedValues: ['yes', 'no']
239242
Default: 'no'
243+
IncludeServiceQuotasModule:
244+
Type: String
245+
Description: Collects AWS Service Quotas data
246+
AllowedValues: ['yes', 'no']
247+
Default: 'no'
240248

241249
Conditions:
242250
DeployTAModule: !Equals [ !Ref IncludeTAModule, "yes"]
@@ -255,6 +263,7 @@ Conditions:
255263
DeployHealthEventsModule: !Equals [ !Ref IncludeHealthEventsModule, "yes"]
256264
DeployLicenseManagerModule: !Equals [ !Ref IncludeLicenseManagerModule, "yes"]
257265
DeployQuickSightModule: !Equals [ !Ref IncludeQuickSightModule, "yes"]
266+
DeployServiceQuotasModule: !Equals [ !Ref IncludeServiceQuotasModule, "yes"]
258267
DeployPricingModule: !Or
259268
- !Condition DeployInventoryCollectorModule
260269
- !Condition DeployRDSUtilizationModule
@@ -276,6 +285,7 @@ Conditions:
276285
- !Condition DeployHealthEventsModule
277286
- !Condition DeployLicenseManagerModule
278287
- !Condition DeployQuickSightModule
288+
- !Condition DeployServiceQuotasModule
279289
RegionsInScopeIsEmpty: !Equals
280290
- !Join [ '', !Split [ ' ', !Ref RegionsInScope ] ] # remove spaces
281291
- ""
@@ -1223,6 +1233,31 @@ Resources:
12231233
StepFunctionExecutionRoleARN: !GetAtt StepFunctionExecutionRole.Arn
12241234
SchedulerExecutionRoleARN: !GetAtt SchedulerExecutionRole.Arn
12251235

1236+
ServiceQuotasModule:
1237+
Type: AWS::CloudFormation::Stack
1238+
Condition: DeployServiceQuotasModule
1239+
Properties:
1240+
TemplateURL: !Sub "https://${CFNSourceBucket}.s3.amazonaws.com/cfn/data-collection/module-service-quotas.yaml"
1241+
Parameters:
1242+
DatabaseName: !Ref DatabaseName
1243+
DestinationBucket: !Ref S3Bucket
1244+
DestinationBucketARN: !GetAtt S3Bucket.Arn
1245+
MultiAccountRoleName: !Sub "${ResourcePrefix}${MultiAccountRoleName}"
1246+
Schedule: !Ref ScheduleFrequent
1247+
GlueRoleARN: !GetAtt GlueRole.Arn
1248+
ResourcePrefix: !Ref ResourcePrefix
1249+
LambdaAnalyticsARN: !GetAtt LambdaAnalytics.Arn
1250+
AccountCollectorLambdaARN: !Sub "${AccountCollector.Outputs.LambdaFunctionARN}"
1251+
CodeBucket: !If [ ProdCFNTemplateUsed, !FindInMap [RegionMap, !Ref "AWS::Region", CodeBucket], !Ref CFNSourceBucket ]
1252+
StepFunctionTemplate: !FindInMap [StepFunctionCode, main-v3, TemplatePath]
1253+
StepFunctionExecutionRoleARN: !GetAtt StepFunctionExecutionRole.Arn
1254+
SchedulerExecutionRoleARN: !GetAtt SchedulerExecutionRole.Arn
1255+
RegionsInScope:
1256+
Fn::If:
1257+
- RegionsInScopeIsEmpty
1258+
- !Sub "${AWS::Region}"
1259+
- !Join [ '', !Split [ ' ', !Ref RegionsInScope ] ] # remove spaces
1260+
12261261
QuickSightModule:
12271262
Type: AWS::CloudFormation::Stack
12281263
Condition: DeployQuickSightModule

data-collection/deploy/deploy-data-read-permissions.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ Metadata:
2929
- IncludeTAModule
3030
- IncludeTransitGatewayModule
3131
- IncludeLicenseManagerModule
32+
- IncludeServiceQuotasModule
3233
ParameterLabels:
3334
ManagementAccountRole:
3435
default: "Management account role"
@@ -70,6 +71,8 @@ Metadata:
7071
default: "Include AWS Health Events Module"
7172
IncludeLicenseManagerModule:
7273
default: "Include Marketplace Licensing Module"
74+
IncludeServiceQuotasModule:
75+
default: "Include Service Quotas Module"
7376
Parameters:
7477
ManagementAccountRole:
7578
Type: String
@@ -165,6 +168,11 @@ Parameters:
165168
Description: Collects Marketplace Licensing information
166169
AllowedValues: ['yes', 'no']
167170
Default: 'no'
171+
IncludeServiceQuotasModule:
172+
Type: String
173+
Description: Collects Service Quotas information
174+
AllowedValues: ['yes', 'no']
175+
Default: 'no'
168176

169177
Conditions:
170178
DeployModuleReadInMgmt: !Equals [!Ref AllowModuleReadInMgmt, "yes"]
@@ -185,6 +193,7 @@ Resources:
185193
IncludeBackupModule: !Ref IncludeBackupModule
186194
IncludeHealthEventsModule: !Ref IncludeHealthEventsModule
187195
IncludeLicenseManagerModule: !Ref IncludeLicenseManagerModule
196+
IncludeServiceQuotasModule: !Ref IncludeServiceQuotasModule
188197
DataCollectorMgmtAccountModulesReadStack:
189198
Type: AWS::CloudFormation::Stack
190199
Condition: DeployModuleReadInMgmt
@@ -201,6 +210,7 @@ Resources:
201210
IncludeRDSUtilizationModule: !Ref IncludeRDSUtilizationModule
202211
IncludeBudgetsModule: !Ref IncludeBudgetsModule
203212
IncludeTransitGatewayModule: !Ref IncludeTransitGatewayModule
213+
IncludeServiceQuotasModule: !Ref IncludeServiceQuotasModule
204214
DataCollectorOrgAccountModulesReadStackSet:
205215
Type: AWS::CloudFormation::StackSet
206216
Properties:
@@ -236,6 +246,8 @@ Resources:
236246
ParameterValue: !Ref IncludeBudgetsModule
237247
- ParameterKey: IncludeTransitGatewayModule
238248
ParameterValue: !Ref IncludeTransitGatewayModule
249+
- ParameterKey: IncludeServiceQuotasModule
250+
ParameterValue: !Ref IncludeServiceQuotasModule
239251
StackInstancesGroup:
240252
- DeploymentTargets:
241253
OrganizationalUnitIds: !Split [",", !Ref OrganizationalUnitIds]

data-collection/deploy/deploy-in-linked-account.yaml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ Metadata:
1919
- IncludeTAModule
2020
- IncludeSupportCasesModule
2121
- IncludeTransitGatewayModule
22+
- IncludeServiceQuotasModule
2223
ParameterLabels:
2324
DataCollectionAccountID:
2425
default: 'Data Collection Account ID'
@@ -40,6 +41,8 @@ Metadata:
4041
default: 'Include Budgets Collection Module'
4142
IncludeTransitGatewayModule:
4243
default: 'Include Transit Gateway Module'
44+
IncludeServiceQuotasModule:
45+
default: 'Include Service Quotas Module'
4346

4447
Parameters:
4548
DataCollectionAccountID:
@@ -88,6 +91,11 @@ Parameters:
8891
Description: Collects TransitGateway from your accounts
8992
AllowedValues: ['yes', 'no']
9093
Default: 'no'
94+
IncludeServiceQuotasModule:
95+
Type: String
96+
Description: Collects Service Quotas from your accounts
97+
AllowedValues: ['yes', 'no']
98+
Default: 'no'
9199

92100
Conditions:
93101
IncludeTAModulePolicy: !Equals
@@ -111,6 +119,9 @@ Conditions:
111119
IncludeTransitGatewayModulePolicy: !Equals
112120
- !Ref IncludeTransitGatewayModule
113121
- "yes"
122+
IncludeServiceQuotasModulePolicy: !Equals
123+
- !Ref IncludeServiceQuotasModule
124+
- "yes"
114125

115126
Outputs:
116127
LambdaRole:
@@ -139,6 +150,7 @@ Resources:
139150
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}transit-gateway-LambdaRole"
140151
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}trusted-advisor-LambdaRole"
141152
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}support-cases-LambdaRole"
153+
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}service-quotas-LambdaRole"
142154
Path: /
143155
Metadata:
144156
cfn_nag:
@@ -298,6 +310,33 @@ Resources:
298310
Resource: "*" ## Policy is used for scanning of a wide range of resources
299311
Roles:
300312
- Ref: LambdaRole
313+
Metadata:
314+
cfn_nag:
315+
rules_to_suppress:
316+
- id: W12
317+
reason: "Policy is used for scanning of a wide range of resources"
318+
ServiceQuotasReadOnlyPolicy:
319+
Type: 'AWS::IAM::Policy'
320+
Condition: IncludeServiceQuotasModulePolicy
321+
Properties:
322+
PolicyName: ServiceQuotasReadOnlyPolicy
323+
PolicyDocument:
324+
Version: "2012-10-17"
325+
Statement:
326+
- Effect: "Allow"
327+
Action:
328+
- "servicequotas:ListRequestedServiceQuotaChangeHistory"
329+
- "servicequotas:GetServiceQuota"
330+
- "servicequotas:GetAWSDefaultServiceQuota"
331+
- "rds:DescribeAccountAttributes"
332+
- "elasticloadbalancing:DescribeAccountLimits"
333+
- "dynamodb:DescribeLimits"
334+
- "cloudformation:DescribeAccountLimits"
335+
- "autoscaling:DescribeAccountLimits"
336+
- "route53:GetAccountLimit"
337+
Resource: "*" ## Policy is used for scanning a wide range of resources. All service quotas in this case. All of them.
338+
Roles:
339+
- Ref: LambdaRole
301340
Metadata:
302341
cfn_nag:
303342
rules_to_suppress:

data-collection/deploy/deploy-in-management-account.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ Metadata:
1919
- IncludeHealthEventsModule
2020
- IncludeRightsizingModule
2121
- IncludeLicenseManagerModule
22+
- IncludeServiceQuotasModule
2223
ParameterLabels:
2324
ManagementAccountRole:
2425
default: "Management account role"
@@ -40,6 +41,8 @@ Metadata:
4041
default: "Include Health Events Module"
4142
IncludeLicenseManagerModule:
4243
default: "Include Marketplace Licensing Module"
44+
IncludeServiceQuotasModule:
45+
default: "Include Service Quotas Module"
4346
Parameters:
4447
DataCollectionAccountID:
4548
Type: String
@@ -87,6 +90,11 @@ Parameters:
8790
Description: Collects Marketplace Licensing Information from your accounts
8891
AllowedValues: ['yes', 'no']
8992
Default: 'no'
93+
IncludeServiceQuotasModule:
94+
Type: String
95+
Description: Collects Service Quotas Information from your accounts
96+
AllowedValues: ['yes', 'no']
97+
Default: 'no'
9098

9199
Conditions:
92100
EnableComputeOptimizerModule: !Equals [!Ref IncludeComputeOptimizerModule, "yes"]
@@ -96,6 +104,7 @@ Conditions:
96104
EnableBackupModule: !Equals [!Ref IncludeBackupModule, "yes"]
97105
EnableHealthEventsModule: !Equals [!Ref IncludeHealthEventsModule, "yes"]
98106
EnableLicenseManagerModule: !Equals [!Ref IncludeLicenseManagerModule, "yes"]
107+
EnableServiceQuotasModule: !Equals [!Ref IncludeServiceQuotasModule, "yes"]
99108

100109
Outputs:
101110
LambdaRole:
@@ -129,6 +138,7 @@ Resources:
129138
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}health-events-LambdaRole"
130139
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}license-manager-LambdaRole"
131140
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}RLS-LambdaRole"
141+
- !Sub "arn:${AWS::Partition}:iam::${DataCollectionAccountID}:role/${ResourcePrefix}service-quotas-LambdaRole"
132142
Path: /
133143
Metadata:
134144
cfn_nag:
@@ -348,6 +358,33 @@ Resources:
348358
Resource: "*"
349359
Roles:
350360
- Ref: LambdaRole
361+
Metadata:
362+
cfn_nag:
363+
rules_to_suppress:
364+
- id: W12
365+
reason: "Policy is used for scanning of a wide range of resources"
366+
ServiceQuotasPolicy:
367+
Type: "AWS::IAM::Policy"
368+
Condition: EnableServiceQuotasModule
369+
Properties:
370+
PolicyName: ServiceQuotasPolicy
371+
PolicyDocument:
372+
Version: "2012-10-17"
373+
Statement:
374+
- Effect: "Allow"
375+
Action:
376+
- "servicequotas:ListRequestedServiceQuotaChangeHistory"
377+
- "servicequotas:GetServiceQuota"
378+
- "servicequotas:GetAWSDefaultServiceQuota"
379+
- "rds:DescribeAccountAttributes"
380+
- "elasticloadbalancing:DescribeAccountLimits"
381+
- "dynamodb:DescribeLimits"
382+
- "cloudformation:DescribeAccountLimits"
383+
- "autoscaling:DescribeAccountLimits"
384+
- "route53:GetAccountLimit"
385+
Resource: "*" ## Policy is used for scanning a wide range of resources. All service quotas in this case. All of them.
386+
Roles:
387+
- Ref: LambdaRole
351388
Metadata:
352389
cfn_nag:
353390
rules_to_suppress:

0 commit comments

Comments
 (0)