Skip to content

Commit 1634d1e

Browse files
ravinadhruve10ravinadhruve10
committed
feat(modules): Support for include/exclude parameters
Change summary: ---------------- Adding new CFT template parameters to support include/exclude OUs and accounts.
1 parent c7e95c4 commit 1634d1e

File tree

5 files changed

+158
-13
lines changed

5 files changed

+158
-13
lines changed

‎modules/Makefile‎

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,12 @@ deploy:
5050
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
5151
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
5252
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
53-
"Partition=${PARAM_PARTITION}"
53+
"Partition=${PARAM_PARTITION}" \
54+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
55+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
56+
"ExcludeOUIDs=$(PARAM_EXCLUDE_OU_IDS)" \
57+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
58+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
5459
aws cloudformation deploy \
5560
--stack-name $(STACK_NAME)-LogIngestion-EventBridge-$(PARAM_NAME_SUFFIX) \
5661
--template-file log_ingestion.events.cft.yaml \
@@ -63,7 +68,12 @@ deploy:
6368
"TargetEventBusARN=$(PARAM_TARGET_EVENT_BUS_ARN)" \
6469
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
6570
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
66-
"Partition=${PARAM_PARTITION}"
71+
"Partition=${PARAM_PARTITION}" \
72+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
73+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
74+
"ExcludeOUIDs=$(PARAM_EXCLUDE_OU_IDS)" \
75+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
76+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
6777
aws cloudformation deploy \
6878
--stack-name $(STACK_NAME)-LogIngestion-S3-$(PARAM_NAME_SUFFIX) \
6979
--template-file log_ingestion.s3.cft.yaml \
@@ -74,7 +84,12 @@ deploy:
7484
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
7585
"BucketARN=$(PARAM_BUCKET_ARN)" \
7686
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
77-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
87+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
88+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
89+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
90+
"ExcludeOUIDs=$(PARAM_EXCLUDE_OU_IDS)" \
91+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
92+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
7893
aws cloudformation deploy \
7994
--stack-name $(STACK_NAME)-VolumeAccess-$(PARAM_NAME_SUFFIX) \
8095
--template-file volume_access.cft.yaml \
@@ -85,7 +100,12 @@ deploy:
85100
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
86101
"Regions=$(PARAM_REGIONS)" \
87102
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
88-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
103+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
104+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
105+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
106+
"ExcludeOUIDs=$(PARAM_EXCLUDE_OU_IDS)" \
107+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
108+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
89109

90110
aws cloudformation deploy \
91111
--stack-name $(STACK_NAME)-VMWorkloadScanning-$(PARAM_NAME_SUFFIX) \
@@ -97,7 +117,12 @@ deploy:
97117
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
98118
"LambdaScanningEnabled"=$(PARAM_LAMBDA_SCANNING_ENABLED) \
99119
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
100-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
120+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
121+
"RootOUID=$(PARAM_ROOT_OU_ID)" \
122+
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
123+
"ExcludeOUIDs=$(PARAM_EXCLUDE_OU_IDS)" \
124+
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
125+
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
101126

102127
clean:
103128
aws cloudformation delete-stack --stack-name $(STACK_NAME)-Foundational-$(PARAM_NAME_SUFFIX)

‎modules/foundational.cft.yaml‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@ Metadata:
1212
- IsOrganizational
1313
- OrganizationalUnitIDs
1414
- Partition
15+
- RootOUID
16+
- IncludeOUIDs
17+
- ExcludeOUIDs
18+
- IncludeAccounts
19+
- ExcludeAccounts
1520
ParameterLabels:
1621
NameSuffix:
1722
default: Name Suffix
@@ -22,9 +27,19 @@ Metadata:
2227
IsOrganizational:
2328
default: Is Organizational
2429
OrganizationalUnitIDs:
25-
default: Organizational Unit IDs
30+
default: (Deprecated, use RootOUID or IncludeOUIDs instead) Organizational Unit IDs
2631
Partition:
2732
default: AWS Partition
33+
RootOUID:
34+
default: Root Organization Unit ID
35+
IncludeOUIDs:
36+
default: Include Organizational Unit IDs
37+
ExcludeOUIDs:
38+
default: Exclude Organizational Unit IDs
39+
IncludeAccounts:
40+
default: Include AWS accounts
41+
ExcludeAccounts:
42+
default: Exclude AWS accounts
2843
Parameters:
2944
NameSuffix:
3045
Type: String
@@ -47,11 +62,26 @@ Parameters:
4762
- 'false'
4863
OrganizationalUnitIDs:
4964
Type: CommaDelimitedList
50-
Description: Comma separated list of organizational unit IDs to deploy
65+
Description: (Deprecated, use RootOUID or IncludeOUIDs instead) Comma separated list of organizational unit IDs to deploy
5166
Partition:
5267
Type: String
5368
Description: AWS Partition of your account or organization to create resources in
5469
Default: 'aws'
70+
RootOUID:
71+
Type: String
72+
Description: Root Organizational Unit ID of your AWS organization
73+
IncludeOUIDs:
74+
Type: CommaDelimitedList
75+
Description: Comma separated list of organizational unit IDs to be included for deployment
76+
ExcludeOUIDs:
77+
Type: CommaDelimitedList
78+
Description: Comma separated list of organizational unit IDs to be excluded for deployment
79+
IncludeAccounts:
80+
Type: CommaDelimitedList
81+
Description: Comma separated list of AWS accounts in your organization to be included for deployment
82+
ExcludeAccounts:
83+
Type: CommaDelimitedList
84+
Description: Comma separated list of AWS accounts in your organization to be excluded for deployment
5585
Conditions:
5686
IsOrganizational:
5787
Fn::Equals:

‎modules/log_ingestion.events.cft.yaml‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ Metadata:
1919
- IsOrganizational
2020
- OrganizationalUnitIDs
2121
- Partition
22+
- RootOUID
23+
- IncludeOUIDs
24+
- ExcludeOUIDs
25+
- IncludeAccounts
26+
- ExcludeAccounts
2227
ParameterLabels:
2328
NameSuffix:
2429
default: Name Suffix
@@ -37,9 +42,19 @@ Metadata:
3742
IsOrganizational:
3843
default: Is Organizational
3944
OrganizationalUnitIDs:
40-
default: Organizational Unit IDs
45+
default: (Deprecated, use RootOUID or IncludeOUIDs instead) Organizational Unit IDs
4146
Partition:
4247
default: AWS Partition
48+
RootOUID:
49+
default: Root Organization Unit ID
50+
IncludeOUIDs:
51+
default: Include Organizational Unit IDs
52+
ExcludeOUIDs:
53+
default: Exclude Organizational Unit IDs
54+
IncludeAccounts:
55+
default: Include AWS accounts
56+
ExcludeAccounts:
57+
default: Exclude AWS accounts
4358
Parameters:
4459
NameSuffix:
4560
Type: String
@@ -61,7 +76,7 @@ Parameters:
6176
Description: Comma separated list of regions to monitor with EventBridge
6277
OrganizationalUnitIDs:
6378
Type: CommaDelimitedList
64-
Description: Comma separated list of organizational unit IDs to deploy
79+
Description: (Deprecated, use RootOUID or IncludeOUIDs instead) Comma separated list of organizational unit IDs to deploy
6580
RuleState:
6681
Type: String
6782
Description: The state of the EventBridge Rule
@@ -103,6 +118,21 @@ Parameters:
103118
Type: String
104119
Description: AWS Partition of your account or organization to create resources in
105120
Default: 'aws'
121+
RootOUID:
122+
Type: String
123+
Description: Root Organizational Unit ID of your AWS organization
124+
IncludeOUIDs:
125+
Type: CommaDelimitedList
126+
Description: Comma separated list of organizational unit IDs to be included for deployment
127+
ExcludeOUIDs:
128+
Type: CommaDelimitedList
129+
Description: Comma separated list of organizational unit IDs to be excluded for deployment
130+
IncludeAccounts:
131+
Type: CommaDelimitedList
132+
Description: Comma separated list of AWS accounts in your organization to be included for deployment
133+
ExcludeAccounts:
134+
Type: CommaDelimitedList
135+
Description: Comma separated list of AWS accounts in your organization to be excluded for deployment
106136
Conditions:
107137
IsOrganizational:
108138
Fn::Equals:

‎modules/vm_workload_scanning.cft.yaml‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@ Metadata:
1212
- LambdaScanningEnabled
1313
- IsOrganizational
1414
- OrganizationalUnitIDs
15+
- RootOUID
16+
- IncludeOUIDs
17+
- ExcludeOUIDs
18+
- IncludeAccounts
19+
- ExcludeAccounts
1520
ParameterLabels:
1621
NameSuffix:
1722
default: Name Suffix
@@ -24,7 +29,17 @@ Metadata:
2429
IsOrganizational:
2530
default: Is Organizational Deployment?
2631
OrganizationalUnitIDs:
27-
default: Organizational Unit IDs
32+
default: (Deprecated, use RootOUID or IncludeOUIDs instead) Organizational Unit IDs
33+
RootOUID:
34+
default: Root Organization Unit ID
35+
IncludeOUIDs:
36+
default: Include Organizational Unit IDs
37+
ExcludeOUIDs:
38+
default: Exclude Organizational Unit IDs
39+
IncludeAccounts:
40+
default: Include AWS accounts
41+
ExcludeAccounts:
42+
default: Exclude AWS accounts
2843
Parameters:
2944
NameSuffix:
3045
Type: String
@@ -54,7 +69,22 @@ Parameters:
5469
- 'false'
5570
OrganizationalUnitIDs:
5671
Type: CommaDelimitedList
57-
Description: Comma-separated list of organizational unit IDs to deploy (required for organizational deployments)
72+
Description: (Deprecated, use RootOUID or IncludeOUIDs instead) Comma-separated list of organizational unit IDs to deploy (required for organizational deployments)
73+
RootOUID:
74+
Type: String
75+
Description: Root Organizational Unit ID of your AWS organization
76+
IncludeOUIDs:
77+
Type: CommaDelimitedList
78+
Description: Comma separated list of organizational unit IDs to be included for deployment
79+
ExcludeOUIDs:
80+
Type: CommaDelimitedList
81+
Description: Comma separated list of organizational unit IDs to be excluded for deployment
82+
IncludeAccounts:
83+
Type: CommaDelimitedList
84+
Description: Comma separated list of AWS accounts in your organization to be included for deployment
85+
ExcludeAccounts:
86+
Type: CommaDelimitedList
87+
Description: Comma separated list of AWS accounts in your organization to be excluded for deployment
5888

5989
Conditions:
6090
IsOrganizational:

‎modules/volume_access.cft.yaml‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ Metadata:
1313
- Regions
1414
- IsOrganizational
1515
- OrganizationalUnitIDs
16+
- RootOUID
17+
- IncludeOUIDs
18+
- ExcludeOUIDs
19+
- IncludeAccounts
20+
- ExcludeAccounts
1621
ParameterLabels:
1722
NameSuffix:
1823
default: Name Suffix
@@ -27,7 +32,17 @@ Metadata:
2732
IsOrganizational:
2833
default: Is Organizational
2934
OrganizationalUnitIDs:
30-
default: "Organizational Unit IDs"
35+
default: "(Deprecated, use RootOUID or IncludeOUIDs instead) Organizational Unit IDs"
36+
RootOUID:
37+
default: Root Organization Unit ID
38+
IncludeOUIDs:
39+
default: Include Organizational Unit IDs
40+
ExcludeOUIDs:
41+
default: Exclude Organizational Unit IDs
42+
IncludeAccounts:
43+
default: Include AWS accounts
44+
ExcludeAccounts:
45+
default: Exclude AWS accounts
3146

3247
Parameters:
3348
NameSuffix:
@@ -58,7 +73,22 @@ Parameters:
5873
- 'false'
5974
OrganizationalUnitIDs:
6075
Type: CommaDelimitedList
61-
Description: Comma separated list of organizational unit IDs to deploy
76+
Description: (Deprecated, use RootOUID or IncludeOUIDs instead) Comma separated list of organizational unit IDs to deploy
77+
RootOUID:
78+
Type: String
79+
Description: Root Organizational Unit ID of your AWS organization
80+
IncludeOUIDs:
81+
Type: CommaDelimitedList
82+
Description: Comma separated list of organizational unit IDs to be included for deployment
83+
ExcludeOUIDs:
84+
Type: CommaDelimitedList
85+
Description: Comma separated list of organizational unit IDs to be excluded for deployment
86+
IncludeAccounts:
87+
Type: CommaDelimitedList
88+
Description: Comma separated list of AWS accounts in your organization to be included for deployment
89+
ExcludeAccounts:
90+
Type: CommaDelimitedList
91+
Description: Comma separated list of AWS accounts in your organization to be excluded for deployment
6292

6393
Conditions:
6494
IsOrganizational:

0 commit comments

Comments
 (0)