Skip to content

Commit 72a9aae

Browse files
jdnojdno
committed
Deploy custom role for Wiz integration
Wiz provides a managed AWS role for its integration. The role grants Wiz access to certain S3 buckets that we want to exclude from its analysis. Namely, buckets contain Terraform state files and the Rust release keys. The provided AWS role has been copied into the project and modified to deny access to those buckets.
1 parent 0318255 commit 72a9aae

File tree

5 files changed

+270
-7
lines changed

5 files changed

+270
-7
lines changed

‎terragrunt/modules/wiz/_terraform.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
terraform {
2+
required_version = "~> 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = "~> 4.20"
8+
}
9+
}
10+
}
11+

‎terragrunt/modules/wiz/main.tf‎

Lines changed: 204 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,205 @@
1-
module "wiz" {
2-
source = "https://s3-us-east-2.amazonaws.com/wizio-public/deployment-v2/aws/wiz-aws-native-terraform-terraform-module.zip"
3-
remote-arn = "arn:aws:iam::830522659852:role/prod-us43-AssumeRoleDelegator"
4-
external-id = "fc959d31-537c-4108-8b87-9af9e0c9b8d2"
5-
data-scanning = false
1+
resource "aws_iam_role_policy" "tf-policy" {
2+
name = "WizCustomPolicy"
3+
role = aws_iam_role.user-role-tf.id
4+
5+
policy = jsonencode({
6+
"Statement" : [
7+
{
8+
"Action" : [
9+
"acm:GetCertificate",
10+
"apigateway:GET",
11+
"backup:DescribeGlobalSettings",
12+
"backup:GetBackupVaultAccessPolicy",
13+
"backup:GetBackupVaultNotifications",
14+
"backup:ListBackupVaults",
15+
"backup:ListTags",
16+
"cloudtrail:GetInsightSelectors",
17+
"cloudtrail:ListTrails",
18+
"codebuild:BatchGetProjects",
19+
"codebuild:GetResourcePolicy",
20+
"codebuild:ListProjects",
21+
"cognito-identity:DescribeIdentityPool",
22+
"connect:ListInstances",
23+
"connect:ListInstanceAttributes",
24+
"connect:ListInstanceStorageConfigs",
25+
"connect:ListSecurityKeys",
26+
"connect:ListLexBots",
27+
"connect:ListLambdaFunctions",
28+
"connect:ListApprovedOrigins",
29+
"connect:ListIntegrationAssociations",
30+
"dynamodb:DescribeExport",
31+
"dynamodb:DescribeKinesisStreamingDestination",
32+
"dynamodb:ListExports",
33+
"ec2:GetEbsEncryptionByDefault",
34+
"ec2:SearchTransitGatewayRoutes",
35+
"ecr:BatchGetImage",
36+
"ecr:DescribeImages",
37+
"ecr:GetAuthorizationToken",
38+
"ecr:GetDownloadUrlForLayer",
39+
"ecr:ListTagsForResource",
40+
"ecr:GetRegistryPolicy",
41+
"ecr:DescribeRegistry",
42+
"ecr-public:BatchGetImage",
43+
"ecr-public:DescribeImages",
44+
"ecr-public:GetAuthorizationToken",
45+
"ecr-public:GetDownloadUrlForLayer",
46+
"ecr-public:ListTagsForResource",
47+
"ecr-public:GetRegistryPolicy",
48+
"eks:ListTagsForResource",
49+
"elasticfilesystem:DescribeAccessPoints",
50+
"elasticfilesystem:DescribeFileSystemPolicy",
51+
"elasticmapreduce:GetAutoTerminationPolicy",
52+
"elasticmapreduce:GetManagedScalingPolicy",
53+
"emr-serverless:ListApplications",
54+
"emr-serverless:ListJobRuns",
55+
"ssm:GetDocument",
56+
"ssm:GetServiceSetting",
57+
"glacier:GetDataRetrievalPolicy",
58+
"glacier:GetVaultLock",
59+
"glue:GetConnection",
60+
"glue:GetSecurityConfiguration",
61+
"glue:GetTags",
62+
"health:DescribeAffectedAccountsForOrganization",
63+
"health:DescribeAffectedEntities",
64+
"health:DescribeAffectedEntitiesForOrganization",
65+
"health:DescribeEntityAggregates",
66+
"health:DescribeEventAggregates",
67+
"health:DescribeEventDetails",
68+
"health:DescribeEventDetailsForOrganization",
69+
"health:DescribeEventTypes",
70+
"health:DescribeEvents",
71+
"health:DescribeEventsForOrganization",
72+
"health:DescribeHealthServiceStatusForOrganization",
73+
"kafka:ListClusters",
74+
"kendra:DescribeDataSource",
75+
"kendra:DescribeIndex",
76+
"kendra:ListDataSources",
77+
"kendra:ListIndices",
78+
"kendra:ListTagsForResource",
79+
"kinesisanalytics:ListApplications",
80+
"kinesisanalytics:DescribeApplication",
81+
"kinesisanalytics:ListTagsForResource",
82+
"kinesisvideo:ListStreams",
83+
"kinesisvideo:ListTagsForStream",
84+
"kinesisvideo:GetDataEndpoint",
85+
"kms:GetKeyRotationStatus",
86+
"kms:ListResourceTags",
87+
"lambda:GetFunction",
88+
"lambda:GetLayerVersion",
89+
"logs:ListTagsForResource",
90+
"profile:GetDomain",
91+
"profile:ListDomains",
92+
"profile:ListIntegrations",
93+
"s3:GetBucketNotification",
94+
"s3:GetMultiRegionAccessPointPolicy",
95+
"s3:ListMultiRegionAccessPoints",
96+
"ses:DescribeActiveReceiptRuleSet",
97+
"ses:GetAccount",
98+
"ses:GetConfigurationSet",
99+
"ses:GetConfigurationSetEventDestinations",
100+
"ses:GetDedicatedIps",
101+
"ses:GetEmailIdentity",
102+
"ses:ListConfigurationSets",
103+
"ses:ListDedicatedIpPools",
104+
"ses:ListReceiptFilters",
105+
"voiceid:DescribeDomain",
106+
"wafv2:GetLoggingConfiguration",
107+
"wafv2:GetWebACLForResource",
108+
"wisdom:GetAssistant",
109+
"macie2:ListFindings",
110+
"macie2:GetFindings",
111+
"identitystore:List*",
112+
"identitystore:Describe*",
113+
"sso-directory:Describe*",
114+
"sso-directory:ListMembersInGroup",
115+
"cloudwatch:GetMetricStatistics"
116+
],
117+
"Effect" : "Allow",
118+
"Resource" : "*"
119+
},
120+
{
121+
"Action" : [
122+
"ec2:CopySnapshot",
123+
"ec2:CreateSnapshot",
124+
"kms:CreateKey",
125+
"kms:DescribeKey",
126+
"ec2:GetEbsEncryptionByDefault",
127+
"ec2:DescribeSnapshots"
128+
],
129+
"Effect" : "Allow",
130+
"Resource" : "*"
131+
},
132+
{
133+
"Action" : [
134+
"ec2:CreateTags"
135+
],
136+
"Effect" : "Allow",
137+
"Resource" : "arn:aws:ec2:*::snapshot/*"
138+
},
139+
{
140+
"Action" : "kms:CreateAlias",
141+
"Effect" : "Allow",
142+
"Resource" : [
143+
"arn:aws:kms:*:*:alias/wizKey",
144+
"arn:aws:kms:*:*:key/*"
145+
]
146+
},
147+
{
148+
"Action" : [
149+
"kms:CreateGrant",
150+
"kms:ReEncryptFrom"
151+
],
152+
"Condition" : {
153+
"StringLike" : {
154+
"kms:ViaService" : "ec2.*.amazonaws.com"
155+
}
156+
},
157+
"Effect" : "Allow",
158+
"Resource" : "*"
159+
},
160+
{
161+
"Action" : [
162+
"kms:GetKeyPolicy",
163+
"kms:PutKeyPolicy"
164+
],
165+
"Condition" : {
166+
"StringEquals" : {
167+
"aws:ResourceTag/wiz" : "auto-gen-cmk"
168+
}
169+
},
170+
"Effect" : "Allow",
171+
"Resource" : "*"
172+
},
173+
{
174+
"Action" : [
175+
"ec2:DeleteSnapshot",
176+
"ec2:ModifySnapshotAttribute"
177+
],
178+
"Condition" : {
179+
"StringEquals" : {
180+
"ec2:ResourceTag/wiz" : "auto-gen-snapshot"
181+
}
182+
},
183+
"Effect" : "Allow",
184+
"Resource" : "*"
185+
},
186+
{
187+
"Action" : [
188+
"s3:*",
189+
],
190+
"Effect" : "Deny",
191+
"Resource" : [
192+
"arn:aws:s3:::*terraform*",
193+
"arn:aws:s3:::*tfstate*",
194+
"arn:aws:s3:::*tf?state*",
195+
"arn:aws:s3:::*cloudtrail*",
196+
"arn:aws:s3:::elasticbeanstalk-*",
197+
"arn:aws:s3:::rust-release-keys",
198+
],
199+
"Sid" : "WizAccessS3"
200+
}
201+
]
202+
"Version" : "2012-10-17"
203+
}
204+
)
6205
}

‎terragrunt/modules/wiz/outputs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
output "wiz_connector_arn" {
2-
value = module.wiz.role_arn
1+
output "role_arn" {
2+
value = aws_iam_role.user-role-tf.arn
33
}

‎terragrunt/modules/wiz/role.tf‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
resource "aws_iam_role" "user-role-tf" {
2+
name = var.rolename
3+
assume_role_policy = jsonencode(
4+
{
5+
"Version" : "2012-10-17",
6+
"Statement" : [
7+
{
8+
"Effect" : "Allow",
9+
"Principal" : {
10+
"AWS" : var.remote-arn
11+
},
12+
"Action" : "sts:AssumeRole",
13+
"Condition" : {
14+
"StringEquals" : {
15+
"sts:ExternalId" : var.external-id
16+
}
17+
}
18+
}
19+
]
20+
}
21+
)
22+
}
23+
24+
data "aws_iam_policy" "view_only_access" {
25+
arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
26+
}
27+
28+
data "aws_iam_policy" "security_audit" {
29+
arn = "arn:aws:iam::aws:policy/SecurityAudit"
30+
}
31+
32+
resource "aws_iam_role_policy_attachment" "view_only_access_role_policy_attach" {
33+
role = aws_iam_role.user-role-tf.name
34+
policy_arn = data.aws_iam_policy.view_only_access.arn
35+
}
36+
resource "aws_iam_role_policy_attachment" "security_audit_role_policy_attach" {
37+
role = aws_iam_role.user-role-tf.name
38+
policy_arn = data.aws_iam_policy.security_audit.arn
39+
}

‎terragrunt/modules/wiz/variables.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
variable "external-id" {
2+
type = string
3+
default = "fc959d31-537c-4108-8b87-9af9e0c9b8d2"
4+
}
5+
6+
variable "rolename" {
7+
type = string
8+
default = "WizAccess-Role"
9+
}
10+
11+
variable "remote-arn" {
12+
type = string
13+
default = "arn:aws:iam::830522659852:role/prod-us43-AssumeRoleDelegator"
14+
}

0 commit comments

Comments
 (0)