Skip to content

Commit c0d64c6

Browse files
jbonner7jbonner7
authored
Merge pull request #11 from lacework-alliances/9-update-custom-policy-for-aws-config
fixes (#9)
2 parents 875a3dc + 76a75ef commit c0d64c6

File tree

1 file changed

+358
-9
lines changed

1 file changed

+358
-9
lines changed

‎templates/lacework-aws-cfg-member.template.yml‎

Lines changed: 358 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -61,37 +61,386 @@ Resources:
6161
- ""
6262
- - 'arn:aws:iam::'
6363
- "434813966438"
64-
- :root
64+
- :role/lacework-platform
6565
Condition:
6666
StringEquals:
6767
sts:ExternalId: !Join [':',[!Sub "lweid:aws:v2:${LaceworkAccount}:${AWS::AccountId}", !Join ['',["LW",!Select [ 0, !Split [ '-', !Select [ 2, !Split [ '/', !Ref AWS::StackId ] ] ] ]]]]]
6868
ManagedPolicyArns:
6969
- arn:aws:iam::aws:policy/SecurityAudit
70-
7170
LaceworkCWSPolicy:
72-
Type: AWS::IAM::Policy
71+
Type: 'AWS::IAM::Policy'
7372
Properties:
7473
PolicyName: LaceworkCWSPolicy
7574
PolicyDocument:
76-
Version: "2012-10-17"
75+
Version: 2012-10-17
76+
Statement:
77+
- Sid: GetAccountAlias
78+
Action:
79+
- 'iam:ListAccountAliases'
80+
Effect: Allow
81+
Resource: '*'
82+
- Sid: Debug
83+
Action:
84+
- 'cloudtrail:DescribeTrails'
85+
- 'cloudtrail:GetTrailStatus'
86+
- 'eks:ListTagsForResource'
87+
- 's3:GetBucketPolicy'
88+
- 's3:GetBucketLocation'
89+
- 'sns:GetTopicAttributes'
90+
- 'sns:ListSubscriptions'
91+
- 'sns:ListTopics'
92+
Effect: Allow
93+
Resource: '*'
94+
- Sid: EfsPolicies
95+
Action:
96+
- 'elasticfilesystem:DescribeFileSystemPolicy'
97+
- 'elasticfilesystem:DescribeLifecycleConfiguration'
98+
- 'elasticfilesystem:DescribeAccessPoints'
99+
- 'elasticfilesystem:DescribeAccountPreferences'
100+
- 'elasticfilesystem:DescribeBackupPolicy'
101+
- 'elasticfilesystem:DescribeReplicationConfigurations'
102+
- 'elasticfilesystem:ListTagsForResource'
103+
Effect: Allow
104+
Resource: '*'
105+
- Sid: SagemakerPolicies
106+
Action:
107+
- 'sagemaker:GetLineageGroupPolicy'
108+
- 'sagemaker:GetModelPackageGroupPolicy'
109+
Effect: Allow
110+
Resource: '*'
111+
- Sid: IdentityStoreReadOnly
112+
Action:
113+
- 'identitystore:DescribeGroup'
114+
- 'identitystore:DescribeGroupMembership'
115+
- 'identitystore:DescribeUser'
116+
- 'identitystore:ListGroupMemberships'
117+
- 'identitystore:ListGroupMembershipsForMember'
118+
- 'identitystore:ListGroups'
119+
- 'identitystore:ListUsers'
120+
Effect: Allow
121+
Resource: '*'
122+
- Sid: SSOReadOnly
123+
Action:
124+
- 'sso:DescribeAccountAssignmentDeletionStatus'
125+
- 'sso:DescribeInstanceAccessControlAttributeConfiguration'
126+
- 'sso:GetInlinePolicyForPermissionSet'
127+
Effect: Allow
128+
Resource: '*'
129+
- Sid: APIGATEWAY
130+
Action:
131+
- 'apigateway:GET'
132+
Effect: Allow
133+
Resource: '*'
134+
- Sid: APIGATEWAYV2
135+
Action:
136+
- 'apigatewayv2:GET'
137+
Effect: Allow
138+
Resource: '*'
139+
- Sid: SNS
140+
Action:
141+
- 'sns:GetDataProtectionPolicy'
142+
- 'sns:ListPlatformApplications'
143+
- 'sns:GetSubscriptionAttributes'
144+
Effect: Allow
145+
Resource: '*'
146+
- Sid: GLUE
147+
Action:
148+
- 'glue:ListWorkflows'
149+
- 'glue:BatchGetWorkflows'
150+
- 'glue:GetWorkflows'
151+
- 'glue:GetTags'
152+
- 'glue:GetTables'
153+
- 'glue:GetTable'
154+
Effect: Allow
155+
Resource: '*'
156+
- Sid: GLACIER
157+
Action:
158+
- 'glacier:ListTagsForVault'
159+
Effect: Allow
160+
Resource: '*'
161+
- Sid: CODEBUILD
162+
Action:
163+
- 'codebuild:ListBuilds'
164+
- 'codebuild:BatchGetBuilds'
165+
Effect: Allow
166+
Resource: '*'
167+
- Sid: WAFREGIONAL
168+
Action:
169+
- 'waf-regional:ListRules'
170+
- 'waf-regional:GetRule'
171+
- 'waf-regional:ListRuleGroups'
172+
- 'waf-regional:GetRuleGroup'
173+
- 'waf-regional:ListActivatedRulesInRuleGroup'
174+
Effect: Allow
175+
Resource: '*'
176+
- Sid: NETWORKFIREWALL
177+
Effect: Allow
178+
Action:
179+
- 'network-firewall:DescribeLoggingConfiguration'
180+
Resource: '*'
181+
- Sid: WAFV2
182+
Effect: Allow
183+
Action:
184+
- 'wafv2:ListWebACLs'
185+
- 'wafv2:ListRegexPatternSets'
186+
- 'wafv2:ListIPSets'
187+
Resource:
188+
- '*'
189+
- Sid: STATES
190+
Action:
191+
- 'states:ListTagsForResource'
192+
Effect: Allow
193+
Resource: '*'
194+
Roles:
195+
- !Ref LaceworkCrossAccountAccessRole
196+
LaceworkCWSPolicy2:
197+
Type: 'AWS::IAM::Policy'
198+
Properties:
199+
PolicyName: LaceworkCWSPolicy2
200+
PolicyDocument:
201+
Version: 2012-10-17
77202
Statement:
78-
- Sid: GetEc2DefaultEncryption
203+
- Sid: KINESISVIDEO
204+
Action:
205+
- 'kinesisvideo:GetSignalingChannelEndpoint'
206+
- 'kinesisvideo:GetDataEndpoint'
207+
- 'kinesisvideo:DescribeImageGenerationConfiguration'
208+
Effect: Allow
209+
Resource: '*'
210+
- Sid: AMP
211+
Action:
212+
- 'aps:ListScrapers'
213+
- 'aps:DescribeScraper'
214+
- 'aps:ListWorkspaces'
215+
- 'aps:DescribeAlertManagerDefinition'
216+
- 'aps:DescribeLoggingConfiguration'
217+
- 'aps:DescribeWorkspace'
218+
- 'aps:ListRuleGroupsNamespaces'
219+
- 'aps:DescribeRuleGroupsNamespace'
220+
- 'aps:ListTagsForResource'
221+
Effect: Allow
222+
Resource: '*'
223+
- Sid: APPSTREAM
224+
Action:
225+
- 'appstream:Describe*'
226+
- 'appstream:List*'
227+
Effect: Allow
228+
Resource: '*'
229+
- Sid: PERSONALIZE
230+
Action:
231+
- 'personalize:Describe*'
232+
- 'personalize:List*'
233+
- 'personalize:GetSolutionMetrics'
234+
Effect: Allow
235+
Resource: '*'
236+
- Sid: CODEARTIFACT
237+
Action:
238+
- 'codeartifact:ListDomains'
239+
- 'codeartifact:DescribeDomain'
240+
- 'codeartifact:DescribeRepository'
241+
- 'codeartifact:ListPackages'
242+
- 'codeartifact:GetRepositoryEndpoint'
243+
- 'codeartifact:DescribePackage'
244+
- 'codeartifact:ListPackageVersions'
245+
- 'codeartifact:DescribePackageVersion'
246+
- 'codeartifact:GetPackageVersionReadme'
247+
- 'codeartifact:ListPackageVersionDependencies'
248+
- 'codeartifact:ListPackageVersionAssets'
249+
- 'codeartifact:GetPackageVersionAsset'
250+
- 'codeartifact:ListTagsForResource'
251+
Effect: Allow
252+
Resource: '*'
253+
- Sid: FIS
254+
Action:
255+
- 'fis:ListActions'
256+
- 'fis:GetAction'
257+
- 'fis:ListExperimentTemplates'
258+
- 'fis:GetExperimentTemplate'
259+
- 'fis:ListTargetAccountConfigurations'
260+
- 'fis:ListExperiments'
261+
- 'fis:GetExperiment'
262+
- 'fis:ListExperimentResolvedTargets'
263+
- 'fis:ListTagsForResource'
264+
Effect: Allow
265+
Resource: '*'
266+
- Sid: MEMORYDB
267+
Action:
268+
- 'memorydb:DescribeMultiRegionClusters'
269+
- 'memorydb:DescribeSnapshots'
270+
- 'memorydb:DescribeSubnetGroups'
271+
- 'memorydb:DescribeParameterGroups'
272+
- 'memorydb:DescribeParameters'
273+
- 'memorydb:DescribeUsers'
274+
- 'memorydb:DescribeACLs'
275+
- 'memorydb:DescribeServiceUpdates'
276+
- 'memorydb:DescribeEngineVersions'
277+
- 'memorydb:DescribeReservedNodes'
278+
- 'memorydb:DescribeReservedNodesOfferings'
279+
- 'memorydb:ListTags'
280+
- 'memorydb:ListAllowedNodeTypeUpdates'
281+
- 'memorydb:ListAllowedMultiRegionClusterUpdates'
282+
Effect: Allow
283+
Resource: '*'
284+
- Sid: QBUSINESS
285+
Action:
286+
- 'qbusiness:GetApplication'
287+
- 'qbusiness:GetChatControlsConfiguration'
288+
- 'qbusiness:GetPolicy'
289+
- 'qbusiness:ListAttachments'
290+
- 'qbusiness:ListConversations'
291+
- 'qbusiness:ListMessages'
292+
- 'qbusiness:ListDataAccessors'
293+
- 'qbusiness:GetDataAccessor'
294+
- 'qbusiness:GetIndex'
295+
- 'qbusiness:GetDataSource'
296+
- 'qbusiness:GetPlugin'
297+
- 'qbusiness:ListPluginActions'
298+
- 'qbusiness:GetRetriever'
299+
- 'qbusiness:GetWebExperience'
300+
- 'qbusiness:ListPluginTypeMetadata'
301+
- 'qbusiness:ListPluginTypeActions'
302+
Effect: Allow
303+
Resource: '*'
304+
- Sid: QAPPS
305+
Action:
306+
- 'qapps:DescribeQAppPermissions'
307+
- 'qapps:GetLibraryItem'
308+
- 'qapps:GetQApp'
309+
- 'qapps:GetQAppSession'
310+
- 'qapps:GetQAppSessionMetadata'
311+
- 'qapps:ListCategories'
312+
- 'qapps:ListLibraryItems'
313+
- 'qapps:ListQAppSessionData'
314+
- 'qapps:ListQApps'
315+
- 'qapps:ListTagsForResource'
316+
Effect: Allow
317+
Resource: '*'
318+
- Sid: QCONNECT
319+
Action:
320+
- 'wisdom:GetAIAgent'
321+
- 'wisdom:GetAIGuardrail'
322+
- 'wisdom:GetAIPrompt'
323+
- 'wisdom:GetContent'
324+
- 'wisdom:GetImportJob'
325+
- 'wisdom:GetKnowledgeBase'
326+
- 'wisdom:GetMessageTemplate'
327+
- 'wisdom:GetQuickResponse'
328+
- 'wisdom:ListAIAgentVersions'
329+
- 'wisdom:ListAIAgents'
330+
- 'wisdom:ListAIGuardrailVersions'
331+
- 'wisdom:ListAIGuardrails'
332+
- 'wisdom:ListAIPromptVersions'
333+
- 'wisdom:ListAIPrompts'
334+
- 'wisdom:ListAssistantAssociations'
335+
- 'wisdom:ListAssistants'
336+
- 'wisdom:ListContentAssociations'
337+
- 'wisdom:ListContents'
338+
- 'wisdom:ListImportJobs'
339+
- 'wisdom:ListKnowledgeBases'
340+
- 'wisdom:ListMessageTemplateVersions'
341+
- 'wisdom:ListMessageTemplates'
342+
- 'wisdom:ListQuickResponses'
343+
- 'wisdom:ListTagsForResource'
344+
Effect: Allow
345+
Resource: '*'
346+
- Sid: RESOURCEGROUPS
347+
Action:
348+
- 'resource-groups:ListGroups'
349+
- 'resource-groups:GetGroupQuery'
350+
- 'resource-groups:GetGroupConfiguration'
351+
Effect: Allow
352+
Resource: '*'
353+
- Sid: SERVICECATALOGAPPREGISTRY
354+
Action:
355+
- 'servicecatalog:GetApplication'
356+
- 'servicecatalog:ListApplications'
357+
- 'servicecatalog:GetAssociatedResource'
358+
- 'servicecatalog:ListAssociatedResources'
359+
- 'servicecatalog:ListAssociatedAttributeGroups'
360+
- 'servicecatalog:GetAttributeGroup'
361+
- 'servicecatalog:ListAttributeGroups'
362+
- 'servicecatalog:ListTagsForResource'
363+
- 'servicecatalog:ListAttributeGroupsForApplication'
364+
- 'servicecatalog:GetConfiguration'
365+
Effect: Allow
366+
Resource: '*'
367+
- Sid: OAM
368+
Action:
369+
- 'oam:GetLink'
370+
- 'oam:GetSink'
371+
- 'oam:GetSinkPolicy'
372+
- 'oam:ListAttachedLinks'
373+
- 'oam:ListLinks'
374+
- 'oam:ListSinks'
375+
Effect: Allow
376+
Resource: '*'
377+
- Sid: CLOUDDIRECTORY
378+
Action:
379+
- 'clouddirectory:GetAppliedSchemaVersion'
380+
- 'clouddirectory:GetDirectory'
381+
- 'clouddirectory:GetFacet'
382+
- 'clouddirectory:GetLinkAttributes'
383+
- 'clouddirectory:GetObjectAttributes'
384+
- 'clouddirectory:GetObjectInformation'
385+
- 'clouddirectory:GetSchemaAsJson'
386+
- 'clouddirectory:GetTypedLinkFacetInformation'
387+
- 'clouddirectory:ListAppliedSchemaArns'
388+
- 'clouddirectory:ListAttachedIndices'
389+
- 'clouddirectory:ListDevelopmentSchemaArns'
390+
- 'clouddirectory:ListFacetAttributes'
391+
- 'clouddirectory:ListFacetNames'
392+
- 'clouddirectory:ListIncomingTypedLinks'
393+
- 'clouddirectory:ListIndex'
394+
- 'clouddirectory:ListManagedSchemaArns'
395+
- 'clouddirectory:ListObjectAttributes'
396+
- 'clouddirectory:ListObjectChildren'
397+
- 'clouddirectory:ListObjectParentPaths'
398+
- 'clouddirectory:ListObjectParents'
399+
- 'clouddirectory:ListObjectPolicies'
400+
- 'clouddirectory:ListOutgoingTypedLinks'
401+
- 'clouddirectory:ListPolicyAttachments'
402+
- 'clouddirectory:ListPublishedSchemaArns'
403+
- 'clouddirectory:ListTagsForResource'
404+
- 'clouddirectory:ListTypedLinkFacetAttributes'
405+
- 'clouddirectory:ListTypedLinkFacetNames'
406+
Effect: Allow
407+
Resource: '*'
408+
- Sid: COSTOPTIMIZATIONHUB
409+
Action:
410+
- 'cost-optimization-hub:GetPreferences'
411+
- 'cost-optimization-hub:GetRecommendation'
412+
- 'cost-optimization-hub:ListEnrollmentStatuses'
413+
- 'cost-optimization-hub:ListRecommendationSummaries'
414+
- 'cost-optimization-hub:ListRecommendations'
415+
Effect: Allow
416+
Resource: '*'
417+
- Sid: BUDGETS
79418
Action:
80-
- ec2:GetEbsEncryptionByDefault
419+
- 'budgets:DescribeBudgetAction'
420+
- 'budgets:DescribeBudgetActionHistories'
421+
- 'budgets:DescribeBudgetActionsForAccount'
422+
- 'budgets:DescribeBudgetActionsForBudget'
423+
- 'budgets:ListTagsForResource'
424+
- 'budgets:ViewBudget'
81425
Effect: Allow
82426
Resource: '*'
83-
- Sid: GetBucketPublicAccessBlock
427+
- Sid: BILLINGCONSOLE
84428
Action:
85-
- s3:GetBucketPublicAccessBlock
429+
- 'aws-portal:GetConsoleActionSetEnforced'
430+
- 'aws-portal:ViewAccount'
431+
- 'aws-portal:ViewBilling'
432+
- 'aws-portal:ViewPaymentMethods'
433+
- 'aws-portal:ViewUsage'
86434
Effect: Allow
87435
Resource: '*'
88436
Roles:
89-
- Ref: LaceworkCrossAccountAccessRole
437+
- !Ref LaceworkCrossAccountAccessRole
90438

91439
LaceworkSnsCustomResource:
92440
Type: Custom::LaceworkSnsCustomResource
93441
DependsOn:
94442
- LaceworkCWSPolicy
443+
- LaceworkCWSPolicy2
95444
- LaceworkCrossAccountAccessRole
96445
Properties:
97446
Type: AWS_CFG

0 commit comments

Comments
 (0)