Skip to content

Commit 0a67e62

Browse files
gi-erregi-erre
authored
Add CloudLogs module for AWS Onboarding (#101)
1 parent a19b816 commit 0a67e62

File tree

9 files changed

+644
-0
lines changed

9 files changed

+644
-0
lines changed

‎.github/workflows/ci-master-cloudlogs.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: CI - Master CloudLogs
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'templates_cloudlogs/**'
9+
10+
11+
jobs:
12+
build:
13+
name: Build and Upload
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Check out code
18+
uses: actions/checkout@v3
19+
20+
- name: Configure AWS credentials
21+
uses: aws-actions/configure-aws-credentials@v1
22+
with:
23+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
24+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
25+
aws-region: eu-west-1
26+
27+
- name: Build and Upload Cloudlogs templates
28+
run: make ci
29+
working-directory: ./templates_cloudlogs
30+
env:
31+
S3_BUCKET: cf-templates-cloudvision-ci
32+
S3_PREFIX: master
33+

‎.github/workflows/ci-master-full-install-with-cloudlogs.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: CI - Master Full Install
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'templates_cspm_cloudlogs/**'
9+
10+
11+
jobs:
12+
build:
13+
name: Build and Upload
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Check out code
18+
uses: actions/checkout@v3
19+
20+
- name: Configure AWS credentials
21+
uses: aws-actions/configure-aws-credentials@v1
22+
with:
23+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
24+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
25+
aws-region: eu-west-1
26+
27+
- name: Build and Upload Full install templates
28+
run: make ci
29+
working-directory: ./templates_cspm_cloudlogs
30+
env:
31+
S3_BUCKET: cf-templates-cloudvision-ci
32+
S3_PREFIX: master
33+
34+
- name: Build and Upload Full install templates
35+
run: make ci-org
36+
working-directory: ./templates_cspm_cloudlogs
37+
env:
38+
S3_BUCKET: cf-templates-cloudvision-ci
39+
S3_PREFIX: master

‎.github/workflows/ci-pull-request-cloudlogs.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: CI - Pull Request Cloudlogs
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- 'templates_cloudlogs/**'
9+
10+
jobs:
11+
lint:
12+
name: Lint
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Check out code
17+
uses: actions/checkout@v3
18+
19+
- name: cfn-lint
20+
uses: scottbrenner/cfn-lint-action@v2
21+
22+
- name: Print the Cloud Formation Linter Version & run Linter
23+
run: |
24+
cfn-lint --version
25+
cfn-lint -t templates_cloudlogs/**/*.yaml
26+
27+
build:
28+
name: Build and Upload Cloudlogs templates
29+
runs-on: ubuntu-latest
30+
needs: [lint]
31+
32+
steps:
33+
- name: Check out code
34+
uses: actions/checkout@v3
35+
36+
- name: Configure AWS credentials
37+
uses: aws-actions/configure-aws-credentials@v1
38+
with:
39+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
40+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
41+
aws-region: eu-west-1
42+
43+
- name: Build and Upload Cloudlogs Templates
44+
run: make ci
45+
working-directory: templates_cloudlogs
46+
env:
47+
S3_BUCKET: cf-templates-cloudvision-ci
48+
S3_PREFIX: pr/${{ github.event.pull_request.head.ref }}

‎.github/workflows/ci-pull-request-full-install-with-cloudlogs.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: CI - Pull Request Full Install
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- 'templates_cspm_cloudlogs/**'
9+
10+
jobs:
11+
lint:
12+
name: Lint
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Check out code
17+
uses: actions/checkout@v3
18+
19+
- name: cfn-lint
20+
uses: scottbrenner/cfn-lint-action@v2
21+
22+
- name: Print the Cloud Formation Linter Version & run Linter
23+
run: |
24+
cfn-lint --version
25+
cfn-lint -t templates_cspm_cloudlogs/**/*.yaml
26+
27+
build:
28+
name: Build and Upload Full Install templates
29+
runs-on: ubuntu-latest
30+
needs: [lint]
31+
32+
steps:
33+
- name: Check out code
34+
uses: actions/checkout@v3
35+
36+
- name: Configure AWS credentials
37+
uses: aws-actions/configure-aws-credentials@v1
38+
with:
39+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
40+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
41+
aws-region: eu-west-1
42+
43+
- name: Build and Upload Full Install Templates
44+
run: make ci
45+
working-directory: templates_cspm_cloudlogs
46+
env:
47+
S3_BUCKET: cf-templates-cloudvision-ci
48+
S3_PREFIX: pr/${{ github.event.pull_request.head.ref }}
49+
50+
- name: Build and Upload Full Install Org Templates
51+
run: make ci-org
52+
working-directory: templates_cspm_cloudlogs
53+
env:
54+
S3_BUCKET: cf-templates-cloudvision-ci
55+
S3_PREFIX: pr/${{ github.event.pull_request.head.ref }}

‎templates_cloudlogs/CloudLogs.yaml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: >
3+
CloudFormation template for provisioning
4+
the necessary resources for the `cloud-logs`
5+
component.
6+
7+
Metadata:
8+
AWS::CloudFormation::Interface:
9+
ParameterGroups:
10+
- Label:
11+
default: "Sysdig Settings (Do not change)"
12+
Parameters:
13+
- RoleName
14+
- ExternalId
15+
- TrustedIdentity
16+
- BucketARN
17+
18+
ParameterLabels:
19+
RoleName:
20+
default: "Role Name (Sysdig use only)"
21+
ExternalId:
22+
default: "External ID (Sysdig use only)"
23+
TrustedIdentity:
24+
default: "Trusted Identity (Sysdig use only)"
25+
BucketARN:
26+
default: "Bucket ARN"
27+
28+
Parameters:
29+
RoleName:
30+
Type: String
31+
Description: The name of the IAM Role that will enable access to the Cloudtrail logs.
32+
ExternalId:
33+
Type: String
34+
Description: Random string generated unique to a customer.
35+
TrustedIdentity:
36+
Type: String
37+
Description: The name of Sysdig trusted identity.
38+
BucketARN:
39+
Type: String
40+
Description: The ARN of your s3 bucket associated with your Cloudtrail trail.
41+
42+
Resources:
43+
CloudLogsRole:
44+
Type: "AWS::IAM::Role"
45+
Properties:
46+
RoleName: !Ref RoleName
47+
AssumeRolePolicyDocument:
48+
Version: "2012-10-17"
49+
Statement:
50+
- Effect: "Allow"
51+
Principal:
52+
AWS: !Ref TrustedIdentity
53+
Action:
54+
- "sts:AssumeRole"
55+
Condition:
56+
StringEquals:
57+
"sts:ExternalId": !Ref ExternalId
58+
CloudLogsRolePolicies:
59+
Type: "AWS::IAM::Policy"
60+
Properties:
61+
PolicyName: "CloudlogsS3Access"
62+
PolicyDocument:
63+
Version: "2012-10-17"
64+
Statement:
65+
- Sid: "CloudlogsS3Access"
66+
Effect: "Allow"
67+
Action:
68+
- "s3:Get*"
69+
- "s3:List*"
70+
Resource:
71+
- !Sub '${BucketARN}'
72+
- !Sub '${BucketARN}/*'
73+
Roles:
74+
- Ref: "CloudLogsRole"

‎templates_cloudlogs/Makefile‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# requires AWS_PROFILE
2+
# bucket must exist, prefix will be created
3+
S3_BUCKET ?= "s4c-cft"
4+
S3_PREFIX ?= "test"
5+
# We need the REGION or the TemplateURLs might be created for a different region, resulting in a deployment error
6+
S3_REGION ?= "eu-west-1" # ireland
7+
SECURE_API_TOKEN ?= ""
8+
STACK_NAME = "CloudLogsTest"
9+
10+
.PHONY: packaged-template.yaml
11+
12+
validate:
13+
aws cloudformation validate-template --template-body file://./CloudLogs.yaml
14+
15+
lint:
16+
cfn-lint *.yaml
17+
18+
packaged-template.yaml:
19+
aws s3 rm s3://$(S3_BUCKET)/cloudlogs/$(S3_PREFIX) --recursive
20+
21+
aws cloudformation package \
22+
--region $(S3_REGION) \
23+
--template-file CloudLogs.yaml \
24+
--s3-bucket $(S3_BUCKET) \
25+
--s3-prefix cspm/$(S3_PREFIX) \
26+
--force-upload \
27+
--output-template-file packaged-template.yaml
28+
29+
test: packaged-template.yaml
30+
aws cloudformation deploy \
31+
--stack-name $(STACK_NAME) \
32+
--template-file packaged-template.yaml \
33+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
34+
--parameter-overrides \
35+
"SysdigSecureAPIToken=$(SECURE_API_TOKEN)"
36+
37+
ci: packaged-template.yaml
38+
aws s3 cp ./packaged-template.yaml s3://$(S3_BUCKET)/cloudlogs/$(S3_PREFIX)/entry-point.yaml
39+
40+
clean:
41+
aws cloudformation delete-stack --stack-name $(STACK_NAME)

‎templates_cspm_cloudlogs/FullInstall.yaml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: IAM Roles for CSPM and Cloudlogs used by Sysdig Secure
3+
4+
Metadata:
5+
AWS::CloudFormation::Interface:
6+
ParameterGroups:
7+
- Label:
8+
default: "Sysdig Settings (Do not change)"
9+
Parameters:
10+
- CSPMRoleName
11+
- CloudLogsRoleName
12+
- ExternalId
13+
- TrustedIdentity
14+
- BucketARN
15+
16+
ParameterLabels:
17+
CSPMRoleName:
18+
default: "CSPM Role Name (Sysdig use only)"
19+
CloudLogsRoleName:
20+
default: "CloudLogs Role Name (Sysdig use only)"
21+
ExternalId:
22+
default: "External ID (Sysdig use only)"
23+
TrustedIdentity:
24+
default: "Trusted Identity (Sysdig use only)"
25+
BucketARN:
26+
default: "Bucket ARN"
27+
28+
Parameters:
29+
CSPMRoleName:
30+
Type: String
31+
Description: The read-only IAM Role that Sysdig will create
32+
CloudLogsRoleName:
33+
Type: String
34+
Description: The name of the IAM Role that will enable access to the Cloudtrail logs.
35+
ExternalId:
36+
Type: String
37+
Description: Sysdig ExternalID required for the policy creation
38+
TrustedIdentity:
39+
Type: String
40+
Description: The name of Sysdig trusted identity.
41+
BucketARN:
42+
Type: String
43+
Description: The ARN of your s3 bucket associated with your Cloudtrail trail.
44+
45+
Resources:
46+
CloudAgentlessRole:
47+
Type: "AWS::IAM::Role"
48+
Properties:
49+
RoleName: !Ref CSPMRoleName
50+
AssumeRolePolicyDocument:
51+
Version: "2012-10-17"
52+
Statement:
53+
-
54+
Effect: "Allow"
55+
Principal:
56+
AWS: !Ref TrustedIdentity
57+
Action: "sts:AssumeRole"
58+
Condition:
59+
StringEquals:
60+
sts:ExternalId: !Ref ExternalId
61+
ManagedPolicyArns:
62+
- arn:aws:iam::aws:policy/SecurityAudit
63+
CloudLogsRole:
64+
Type: "AWS::IAM::Role"
65+
Properties:
66+
RoleName: !Ref CloudLogsRoleName
67+
AssumeRolePolicyDocument:
68+
Version: "2012-10-17"
69+
Statement:
70+
- Effect: "Allow"
71+
Principal:
72+
AWS: !Ref TrustedIdentity
73+
Action:
74+
- "sts:AssumeRole"
75+
Condition:
76+
StringEquals:
77+
"sts:ExternalId": !Ref ExternalId
78+
CloudLogsRolePolicies:
79+
Type: "AWS::IAM::Policy"
80+
Properties:
81+
PolicyName: "CloudlogsS3Access"
82+
PolicyDocument:
83+
Version: "2012-10-17"
84+
Statement:
85+
- Sid: "CloudlogsS3Access"
86+
Effect: "Allow"
87+
Action:
88+
- "s3:Get*"
89+
- "s3:List*"
90+
Resource:
91+
- !Sub '${BucketARN}'
92+
- !Sub '${BucketARN}/*'
93+
Roles:
94+
- Ref: "CloudLogsRole"

0 commit comments

Comments
 (0)