aws-cloudformation-drata-setup/drata_cloudformation_stackset_template.json at main · drata/aws-cloudformation-drata-setup · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
{
  "Description": "Drata IAM Role to set read permissions in Org Member Accounts",
  "Parameters": {
    "DrataAWSAccountID": {
      "Type": "String",
      "Description": "Drata's AWS account ID.",
      "Default": "269135526815",
      "AllowedPattern": "\\d{12}$",
      "MinLength": 1,
      "ConstraintDescription": "DrataAWSAccountID should be exactly 12 digits (numeric characters). It's required."
    },
    "RoleSTSExternalID": {
      "Type": "String",
      "Description": "STS ExternalId condition value to use with the role.",
      "AllowedPattern": "[a-zA-Z0-9\\=\\,\\.\\@\\:\\/\\-_]*",
      "MinLength": 1,
      "ConstraintDescription": "RoleSTSExternalID must be an UUID formatted string and is required."
    }
  },
  "Resources": {
    "DrataRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "ManagedPolicyArns": ["arn:aws:iam::aws:policy/SecurityAudit"],
        "MaxSessionDuration": 43200,
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": [{ "Fn::Sub": "arn:aws:iam::${DrataAWSAccountID}:root" }]
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalId": {
                    "Ref": "RoleSTSExternalID"
                  }
                }
              }
            }
          ]
        },
        "RoleName": "DrataAutopilotRole",
        "Description": "Cross-account read-only access for Drata Autopilot"
      }
    },
    "DrataAdditionalPermissionsPolicy": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyName": "DrataAdditionalPermissions",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "backup:ListBackupJobs",
                "backup:ListRecoveryPointsByResource"
              ],
              "Resource": "*"
            }
          ]
        },
        "Roles": [{ "Ref": "DrataRole" }]
      }
    }
  }
}