Skip to content

Commit 167ff0e

Browse files
matteopasamatteopasa
committed
api dest cfts
1 parent 9b96bd5 commit 167ff0e

File tree

3 files changed

+669
-0
lines changed

3 files changed

+669
-0
lines changed

‎templates_eventbridge_api_dest/EventBridgeApiDest.yaml‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: EventBridge resources that forward CloudTrail logs to Sysdig Secure via API Destination
3+
4+
Metadata:
5+
AWS::CloudFormation::Interface:
6+
ParameterGroups:
7+
- Label:
8+
default: "Sysdig Settings (Do not change)"
9+
Parameters:
10+
- EventBridgeRoleName
11+
- ExternalID
12+
- TrustedIdentity
13+
- ApiKey
14+
- IngestionUrl
15+
- RateLimit
16+
- EventBridgeState
17+
- EventBridgeEventPattern
18+
19+
ParameterLabels:
20+
ExternalID:
21+
default: "External ID (Sysdig use only)"
22+
TrustedIdentity:
23+
default: "Trusted Identity (Sysdig use only)"
24+
ApiKey:
25+
default: "API Key (Sysdig use only)"
26+
IngestionUrl:
27+
default: "Ingestion URL (Sysdig use only)"
28+
RateLimit:
29+
default: "Rate Limit (Sysdig use only)"
30+
EventBridgeRoleName:
31+
default: "Integration Name (Sysdig use only)"
32+
EventBridgeState:
33+
default: "State of the EventBridge Rule (Sysdig use only)"
34+
EventBridgeEventPattern:
35+
default: "Event Pattern (Sysdig use only)"
36+
37+
Parameters:
38+
EventBridgeRoleName:
39+
Type: String
40+
Description: A unique identifier used to create an IAM Role and EventBridge Rule
41+
ExternalID:
42+
Type: String
43+
Description: Sysdig ExternalID required for the policy creation
44+
TrustedIdentity:
45+
Type: String
46+
Description: The Role in Sysdig's AWS Account with permissions to your account
47+
ApiKey:
48+
Type: String
49+
Description: API key for Sysdig Secure authentication
50+
IngestionUrl:
51+
Type: String
52+
Description: Sysdig Secure API ingestion URL
53+
RateLimit:
54+
Type: Number
55+
Description: Maximum invocations per second for the API destination
56+
Default: 300
57+
EventBridgeState:
58+
Type: String
59+
Description: The state of the EventBridge Rule
60+
Default: ENABLED
61+
AllowedValues:
62+
- ENABLED
63+
- DISABLED
64+
EventBridgeEventPattern:
65+
Type: String
66+
Description: JSON pattern for the EventBridge rule's event pattern
67+
Default: |
68+
{
69+
"detail-type": [
70+
"AWS API Call via CloudTrail",
71+
"AWS Console Sign In via CloudTrail",
72+
"AWS Service Event via CloudTrail",
73+
"Object Access Tier Changed",
74+
"Object ACL Updated",
75+
"Object Created",
76+
"Object Deleted",
77+
"Object Restore Completed",
78+
"Object Restore Expired",
79+
"Object Restore Initiated",
80+
"Object Storage Class Changed",
81+
"Object Tags Added",
82+
"Object Tags Deleted",
83+
"GuardDuty Finding"
84+
]
85+
}
86+
87+
Resources:
88+
EventBridgeConnection:
89+
Type: AWS::Events::Connection
90+
Properties:
91+
Name: !Sub ${EventBridgeRoleName}-connection
92+
AuthorizationType: API_KEY
93+
AuthParameters:
94+
ApiKey:
95+
Key: X-Api-Key
96+
Value: !Ref ApiKey
97+
98+
EventBridgeApiDestination:
99+
Type: AWS::Events::ApiDestination
100+
Properties:
101+
Name: !Sub ${EventBridgeRoleName}-destination
102+
ConnectionArn: !GetAtt EventBridgeConnection.Arn
103+
InvocationEndpoint: !Ref IngestionUrl
104+
HttpMethod: POST
105+
InvocationRateLimitPerSecond: !Ref RateLimit
106+
107+
EventBridgeRole:
108+
Type: AWS::IAM::Role
109+
Properties:
110+
RoleName: !Ref EventBridgeRoleName
111+
AssumeRolePolicyDocument:
112+
Statement:
113+
- Effect: Allow
114+
Principal:
115+
Service: events.amazonaws.com
116+
Action: 'sts:AssumeRole'
117+
- Effect: "Allow"
118+
Principal:
119+
AWS: !Ref TrustedIdentity
120+
Action: "sts:AssumeRole"
121+
Condition:
122+
StringEquals:
123+
sts:ExternalId: !Ref ExternalID
124+
Policies:
125+
- PolicyName: !Ref EventBridgeRoleName
126+
PolicyDocument:
127+
Version: "2012-10-17"
128+
Statement:
129+
- Sid: "InvokeApiDestination"
130+
Effect: Allow
131+
Action:
132+
- "events:InvokeApiDestination"
133+
Resource:
134+
- !Sub "arn:aws:events:*:*:api-destination/${EventBridgeRoleName}-destination/*"
135+
- Sid: "CloudTrailEventRuleAccess"
136+
Effect: Allow
137+
Action:
138+
- "events:DescribeRule"
139+
- "events:ListTargetsByRule"
140+
Resource:
141+
- !Sub "arn:aws:events:*:*:rule/${EventBridgeRoleName}"
142+
- Sid: "ValidationAccess"
143+
Effect: Allow
144+
Action:
145+
- "events:DescribeApiDestination"
146+
- "events:DescribeConnection"
147+
Resource: "*"
148+
149+
EventBridgeRule:
150+
Type: AWS::Events::Rule
151+
Properties:
152+
Name: !Ref EventBridgeRoleName
153+
Description: Capture all CloudTrail events for Sysdig Secure
154+
EventPattern: !Ref EventBridgeEventPattern
155+
State: !Ref EventBridgeState
156+
Targets:
157+
- Id: !Ref EventBridgeRoleName
158+
Arn: !GetAtt EventBridgeApiDestination.Arn
159+
RoleArn: !GetAtt EventBridgeRole.Arn

‎templates_eventbridge_api_dest/Makefile‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# requires AWS_PROFILE
2+
# bucket must exist, prefix will be created
3+
S3_BUCKET ?= "s4c-cft"
4+
S3_PREFIX ?= "test"
5+
# We need the REGION or the TemplateURLs might be created for a different region, resulting in a deployment error
6+
S3_REGION ?= "eu-west-1" # ireland
7+
SECURE_API_TOKEN ?= ""
8+
STACK_NAME = "EventBridgeApiDestTest"
9+
STACK_NAME_ORG = "OrgEventBridgeApiDestTest"
10+
11+
.PHONY: packaged-template.yaml
12+
.PHONY: packaged-template-org.yaml
13+
14+
validate:
15+
aws cloudformation validate-template --template-body file://./EventBridgeApiDest.yaml
16+
aws cloudformation validate-template --template-body file://./OrgEventBridgeApiDest.yaml
17+
18+
lint:
19+
cfn-lint *.yaml
20+
21+
packaged-template.yaml:
22+
aws s3 rm s3://$(S3_BUCKET)/event-bridge/single/$(S3_PREFIX) --recursive
23+
aws cloudformation package \
24+
--region $(S3_REGION) \
25+
--template-file EventBridgeApiDest.yaml \
26+
--s3-bucket $(S3_BUCKET) \
27+
--s3-prefix event-bridge/single/$(S3_PREFIX) \
28+
--force-upload \
29+
--output-template-file packaged-template.yaml
30+
31+
test: packaged-template.yaml
32+
aws cloudformation deploy \
33+
--stack-name $(STACK_NAME) \
34+
--template-file packaged-template.yaml \
35+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
36+
--parameter-overrides \
37+
"SysdigSecureAPIToken=$(SECURE_API_TOKEN)"
38+
39+
ci: packaged-template.yaml
40+
aws s3 cp ./packaged-template.yaml s3://$(S3_BUCKET)/event-bridge/single/$(S3_PREFIX)/entry-point.yaml
41+
42+
clean:
43+
aws cloudformation delete-stack --stack-name $(STACK_NAME)
44+
45+
packaged-template-org.yaml:
46+
aws s3 rm s3://$(S3_BUCKET)/event-bridge/org/$(S3_PREFIX) --recursive
47+
aws cloudformation package \
48+
--region $(S3_REGION) \
49+
--template-file OrgEventBridgeApiDest.yaml \
50+
--s3-bucket $(S3_BUCKET) \
51+
--s3-prefix event-bridge/$(S3_PREFIX) \
52+
--force-upload \
53+
--output-template-file packaged-template-org.yaml
54+
55+
test-org: packaged-template-org.yaml
56+
aws cloudformation deploy \
57+
--stack-name $(STACK_NAME_ORG) \
58+
--template-file packaged-template-org.yaml \
59+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
60+
--parameter-overrides \
61+
"SysdigSecureAPIToken=$(SECURE_API_TOKEN)"
62+
63+
ci-org: packaged-template-org.yaml
64+
aws s3 cp ./packaged-template-org.yaml s3://$(S3_BUCKET)/event-bridge/org/$(S3_PREFIX)/entry-point.yaml
65+
66+
clean-org:
67+
aws cloudformation delete-stack --stack-name $(STACK_NAME_ORG)
68+
69+
#
70+
# local-test-manual:
71+
# (have not found a way to do it via cli)
72+
# aws console > cloudformation > create new stack (template, upload template: select ./templates_ecs/Cloudvision.yaml)
73+
# note: this will upload the template into an s3 bucket, remember to delete it afterwards
74+
#

0 commit comments

Comments
 (0)