Update permissions in AWS trust-relationship CFT templates (#117)

* Remove unnecessary permission in AWS trust-relationship CFT templates

Removing account:GetContactInformation since it is no longer a
required permission for the CSPM feature to work.

* Add macie2:ListClassificationJobs permission

Author: ravinadhruve10

templates_cspm/CloudAgentlessRole.yaml

@@ -63,7 +63,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
 
 Outputs:

templates_cspm/OrgCloudAgentlessRole.yaml

@@ -65,7 +65,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
   RoleStackSet:
     Type: AWS::CloudFormation::StackSet
@@ -136,5 +136,5 @@ Resources:
                           - "arn:aws:waf-regional:*:*:rule/*"
                           - "arn:aws:waf-regional:*:*:rulegroup/*"
                       - Effect: "Allow"
-                        Action: "account:GetContactInformation"
+                        Action: "macie2:ListClassificationJobs"
                         Resource: "*"

templates_cspm_cloudlogs/FullInstall.yaml

@@ -76,7 +76,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"

templates_cspm_cloudlogs/OrgFullInstall.yaml

@@ -81,7 +81,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"
@@ -190,5 +190,5 @@ Resources:
                           - "arn:aws:waf-regional:*:*:rule/*"
                           - "arn:aws:waf-regional:*:*:rulegroup/*"
                       - Effect: "Allow"
-                        Action: "account:GetContactInformation"
+                        Action: "macie2:ListClassificationJobs"
                         Resource: "*"

templates_cspm_eventbridge/FullInstall.yaml

@@ -88,7 +88,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role

templates_cspm_eventbridge/OrgFullInstall.yaml

@@ -132,7 +132,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role
@@ -245,7 +245,7 @@ Resources:
                           - "arn:aws:waf-regional:*:*:rule/*"
                           - "arn:aws:waf-regional:*:*:rulegroup/*"
                       - Effect: "Allow"
-                        Action: "account:GetContactInformation"
+                        Action: "macie2:ListClassificationJobs"
                         Resource: "*"
           EventBridgeRole:
             Type: AWS::IAM::Role