Skip to content

Commit b45adb7

Browse files
jbonner7jbonner7
authored
Merge pull request #23 from lacework-alliances/22-june-2025-service-updates
fixes (#22)
2 parents 67c5ab4 + a7c7058 commit b45adb7

File tree

1 file changed

+223
-0
lines changed

1 file changed

+223
-0
lines changed

‎templates/lacework-aws-cfg-member.template.yml‎

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -677,6 +677,227 @@ Resources:
677677
- '*'
678678
Roles:
679679
- !Ref LaceworkCrossAccountAccessRole
680+
LaceworkCWSAuditPolicy20253:
681+
Type: AWS::IAM::ManagedPolicy
682+
Properties:
683+
ManagedPolicyName: LaceworkCWSAuditPolicy20253
684+
PolicyDocument:
685+
Version: "2012-10-17"
686+
Statement:
687+
- Sid: IOT
688+
Action:
689+
- 'iot:GetCommand'
690+
- 'iot:GetCommandExecution'
691+
- 'iot:GetEffectivePolicies'
692+
- 'iot:GetIndexingConfiguration'
693+
- 'iot:GetJobDocument'
694+
- 'iot:GetV2LoggingOptions'
695+
- 'iot:GetOtaUpdate'
696+
- 'iot:GetPackage'
697+
- 'iot:GetPackageConfiguration'
698+
- 'iot:GetPackageVersion'
699+
- 'iot:GetRegistrationCode'
700+
- 'iot:GetBehaviorModelTrainingSummaries'
701+
- 'iot:GetThingConnectivityData'
702+
- 'iot:GetTopicRule'
703+
- 'iot:GetTopicRuleDestination'
704+
Effect: Allow
705+
Resource:
706+
- '*'
707+
- Sid: IOTEVENTS
708+
Action:
709+
- 'iotevents:DescribeAlarmModel'
710+
- 'iotevents:ListAlarmModels'
711+
- 'iotevents:ListTagsForResource'
712+
- 'iotevents:ListAlarmModelVersions'
713+
- 'iotevents:DescribeDetectorModel'
714+
- 'iotevents:ListDetectorModels'
715+
- 'iotevents:ListDetectorModelVersions'
716+
- 'iotevents:DescribeInput'
717+
- 'iotevents:DescribeLoggingOptions'
718+
Effect: Allow
719+
Resource:
720+
- '*'
721+
- Sid: MEDIAPACKAGE
722+
Action:
723+
- 'mediapackage:ListChannels'
724+
- 'mediapackage:ListHarvestJobs'
725+
- 'mediapackage:ListTagsForResource'
726+
Effect: Allow
727+
Resource:
728+
- '*'
729+
- Sid: MEDIAPACKAGEV2
730+
Action:
731+
- 'mediapackagev2:GetChannel'
732+
- 'mediapackagev2:GetChannelPolicy'
733+
- 'mediapackagev2:ListChannels'
734+
- 'mediapackagev2:ListTagsForResource'
735+
- 'mediapackagev2:GetChannelGroup'
736+
- 'mediapackagev2:ListChannelGroups'
737+
- 'mediapackagev2:ListHarvestJobs'
738+
- 'mediapackagev2:GetOriginEndpoint'
739+
- 'mediapackagev2:GetOriginEndpointPolicy'
740+
- 'mediapackagev2:ListOriginEndpoints'
741+
Effect: Allow
742+
Resource:
743+
- '*'
744+
- Sid: MEDIAPACKAGEVOD
745+
Action:
746+
- 'mediapackage-vod:DescribeAsset'
747+
- 'mediapackage-vod:ListAssets'
748+
- 'mediapackage-vod:ListPackagingConfigurations'
749+
- 'mediapackage-vod:ListPackagingGroups'
750+
Effect: Allow
751+
Resource:
752+
- '*'
753+
- Sid: SUPPORT
754+
Action:
755+
- 'support:DescribeCases'
756+
- 'support:DescribeCommunications'
757+
- 'support:DescribeServices'
758+
- 'support:DescribeSeverityLevels'
759+
Effect: Allow
760+
Resource:
761+
- '*'
762+
- Sid: IMAGEBUILDER
763+
Action:
764+
- 'imagebuilder:GetComponentPolicy'
765+
- 'imagebuilder:ListComponents'
766+
- 'imagebuilder:ListTagsForResource'
767+
- 'imagebuilder:GetComponent'
768+
- 'imagebuilder:ListComponentBuildVersions'
769+
- 'imagebuilder:GetContainerRecipe'
770+
- 'imagebuilder:GetContainerRecipePolicy'
771+
- 'imagebuilder:ListContainerRecipes'
772+
- 'imagebuilder:GetDistributionConfiguration'
773+
- 'imagebuilder:ListDistributionConfigurations'
774+
- 'imagebuilder:GetImagePolicy'
775+
- 'imagebuilder:ListImages'
776+
- 'imagebuilder:GetImage'
777+
- 'imagebuilder:ListImageBuildVersions'
778+
- 'imagebuilder:ListImagePackages'
779+
- 'imagebuilder:GetImagePipeline'
780+
- 'imagebuilder:ListImagePipelines'
781+
- 'imagebuilder:GetImageRecipe'
782+
- 'imagebuilder:GetImageRecipePolicy'
783+
- 'imagebuilder:ListImageRecipes'
784+
- 'imagebuilder:ListImageScanFindings'
785+
- 'imagebuilder:ListImageScanFindingAggregations'
786+
- 'imagebuilder:GetInfrastructureConfiguration'
787+
- 'imagebuilder:ListInfrastructureConfigurations'
788+
- 'imagebuilder:ListLifecycleExecutions'
789+
- 'imagebuilder:ListLifecycleExecutionResources'
790+
- 'imagebuilder:GetLifecyclePolicy'
791+
- 'imagebuilder:ListLifecyclePolicies'
792+
- 'imagebuilder:ListWorkflows'
793+
- 'imagebuilder:GetWorkflow'
794+
- 'imagebuilder:ListWorkflowBuildVersions'
795+
- 'imagebuilder:ListWorkflowExecutions'
796+
- 'imagebuilder:GetWorkflowStepExecution'
797+
- 'imagebuilder:ListWorkflowStepExecutions'
798+
Effect: Allow
799+
Resource:
800+
- '*'
801+
- Sid: DETECTIVE
802+
Action:
803+
- 'detective:BatchGetMembershipDatasources'
804+
- 'detective:ListDatasourcePackages'
805+
- 'detective:ListTagsForResource'
806+
- 'detective:GetInvestigation'
807+
- 'detective:ListIndicators'
808+
- 'detective:ListInvestigations'
809+
- 'detective:ListInvitations'
810+
- 'detective:BatchGetGraphMemberDatasources'
811+
- 'detective:ListOrganizationAdminAccounts'
812+
Effect: Allow
813+
Resource:
814+
- '*'
815+
- Sid: BATCH
816+
Action:
817+
- 'batch:DescribeJobs'
818+
- 'batch:ListJobs'
819+
- 'batch:ListTagsForResource'
820+
- 'batch:DescribeJobQueues'
821+
- 'batch:DescribeSchedulingPolicies'
822+
- 'batch:ListSchedulingPolicies'
823+
Effect: Allow
824+
Resource:
825+
- '*'
826+
- Sid: NETWORKMANAGER
827+
Action:
828+
- 'networkmanager:GetConnectAttachment'
829+
- 'networkmanager:GetSiteToSiteVpnAttachment'
830+
- 'networkmanager:GetTransitGatewayRouteTableAttachment'
831+
- 'networkmanager:GetVpcAttachment'
832+
- 'networkmanager:ListAttachments'
833+
- 'networkmanager:GetConnectPeer'
834+
- 'networkmanager:ListConnectPeers'
835+
- 'networkmanager:GetCoreNetwork'
836+
- 'networkmanager:GetCoreNetworkChangeEvents'
837+
- 'networkmanager:GetCoreNetworkChangeSet'
838+
- 'networkmanager:GetCoreNetworkPolicy'
839+
- 'networkmanager:GetNetworkRoutes'
840+
- 'networkmanager:ListCoreNetworkPolicyVersions'
841+
- 'networkmanager:ListCoreNetworks'
842+
- 'networkmanager:GetConnectPeerAssociations'
843+
- 'networkmanager:GetConnections'
844+
- 'networkmanager:GetCustomerGatewayAssociations'
845+
- 'networkmanager:GetDevices'
846+
- 'networkmanager:GetLinkAssociations'
847+
- 'networkmanager:GetLinks'
848+
- 'networkmanager:GetNetworkResourceCounts'
849+
- 'networkmanager:GetNetworkResourceRelationships'
850+
- 'networkmanager:GetNetworkResources'
851+
- 'networkmanager:GetNetworkTelemetry'
852+
- 'networkmanager:GetResourcePolicy'
853+
- 'networkmanager:GetSites'
854+
- 'networkmanager:GetTransitGatewayConnectPeerAssociations'
855+
- 'networkmanager:GetTransitGatewayRegistrations'
856+
- 'networkmanager:GetTransitGatewayPeering'
857+
- 'networkmanager:ListPeerings'
858+
Effect: Allow
859+
Resource:
860+
- '*'
861+
- Sid: CODEPIPELINE
862+
Action:
863+
- 'codepipeline:ListActionExecutions'
864+
- 'codepipeline:GetActionType'
865+
- 'codepipeline:ListActionTypes'
866+
- 'codepipeline:ListTagsForResource'
867+
- 'codepipeline:ListPipelineExecutions'
868+
- 'codepipeline:ListRuleExecutions'
869+
- 'codepipeline:ListRuleTypes'
870+
- 'codepipeline:ListWebhooks'
871+
Effect: Allow
872+
Resource:
873+
- '*'
874+
- Sid: GREENGRASS
875+
Action:
876+
- 'greengrass:GetBulkDeploymentStatus'
877+
- 'greengrass:GetGroupCertificateAuthority'
878+
- 'greengrass:GetConnectorDefinitionVersion'
879+
- 'greengrass:GetCoreDefinitionVersion'
880+
- 'greengrass:GetDeploymentStatus'
881+
- 'greengrass:GetDeviceDefinitionVersion'
882+
- 'greengrass:GetFunctionDefinitionVersion'
883+
- 'greengrass:GetAssociatedRole'
884+
- 'greengrass:GetGroupCertificateConfiguration'
885+
- 'greengrass:GetGroupVersion'
886+
- 'greengrass:GetLoggerDefinitionVersion'
887+
- 'greengrass:GetResourceDefinitionVersion'
888+
- 'greengrass:GetServiceRoleForAccount'
889+
- 'greengrass:GetSubscriptionDefinitionVersion'
890+
- 'greengrass:DescribeComponent'
891+
- 'greengrass:GetComponent'
892+
- 'greengrass:GetConnectivityInfo'
893+
- 'greengrass:GetCoreDevice'
894+
- 'greengrass:GetDeployment'
895+
- 'greengrass:GetServiceRoleForAccount'
896+
Effect: Allow
897+
Resource:
898+
- '*'
899+
Roles:
900+
- !Ref LaceworkCrossAccountAccessRole
680901

681902
LaceworkSnsCustomResource:
682903
Type: Custom::LaceworkSnsCustomResource
@@ -685,6 +906,7 @@ Resources:
685906
- LaceworkCWSAuditPolicy
686907
- LaceworkCWSAuditPolicy20251
687908
- LaceworkCWSAuditPolicy20252
909+
- LaceworkCWSAuditPolicy20253
688910
- LaceworkCrossAccountAccessRole
689911
Properties:
690912
Type: AWS_CFG
@@ -713,3 +935,4 @@ Outputs:
713935
Value: "1.0"
714936

715937

938+

0 commit comments

Comments
 (0)