Skip to content

Commit 2285bce

Browse files
ravinadhruve10ravinadhruve10
committed
Honor include/exclude params in deployment targets
1 parent 1634d1e commit 2285bce

File tree

4 files changed

+251
-9
lines changed

4 files changed

+251
-9
lines changed

‎modules/foundational.cft.yaml‎

Lines changed: 59 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
AWSTemplateFormatVersion: '2010-09-09'
2+
Transform: 'AWS::LanguageExtensions'
23
Description: Sysdig Secure Onboarding
34
Metadata:
45
AWS::CloudFormation::Interface:
@@ -68,7 +69,7 @@ Parameters:
6869
Description: AWS Partition of your account or organization to create resources in
6970
Default: 'aws'
7071
RootOUID:
71-
Type: String
72+
Type: CommaDelimitedList
7273
Description: Root Organizational Unit ID of your AWS organization
7374
IncludeOUIDs:
7475
Type: CommaDelimitedList
@@ -87,6 +88,48 @@ Conditions:
8788
Fn::Equals:
8889
- Ref: IsOrganizational
8990
- 'true'
91+
OUInclusionsConfigured:
92+
!And
93+
- !Condition IsOrganizational
94+
- !Not
95+
- !Equals
96+
- Fn::Length:
97+
- !Ref IncludeOUIDs
98+
- 0
99+
AccountInclusionsConfigured:
100+
!And
101+
- !Condition IsOrganizational
102+
- !Not
103+
- !Equals
104+
- Fn::Length:
105+
- !Ref IncludeAccounts
106+
- 0
107+
# -----------------------------------------------------------------------------------------------------
108+
# Remove below condition once AWS issue is fixed and replace with using UNION filter -
109+
# https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-cloudformation/issues/100
110+
# -----------------------------------------------------------------------------------------------------
111+
# XXX: due to AWS bug of not having UNION filter fully working, there is no way to add those extra accounts requested.
112+
# to not miss out on those extra accounts, deploy the cloud resources across entire org and noop the UNION filter.
113+
# i.e till we can't deploy UNION, we deploy it all ()
114+
AllowedInclusions:
115+
!And
116+
- !Condition OUInclusionsConfigured
117+
- !Not
118+
- !Condition AccountInclusionsConfigured
119+
120+
# cannot do OU exclusions since CFT templates are static and don't have a way to fetch dynamic data from AWS
121+
AccountExclusionsConfigured:
122+
!And
123+
- !Condition IsOrganizational
124+
- !Equals
125+
- Fn::Length:
126+
- !Ref IncludeAccounts
127+
- 0
128+
- !Not
129+
- !Equals
130+
- Fn::Length:
131+
- !Ref ExcludeAccounts
132+
- 0
90133
Resources:
91134
ConfigPostureRole:
92135
Type: AWS::IAM::Role
@@ -196,7 +239,21 @@ Resources:
196239
Ref: Partition
197240
StackInstancesGroup:
198241
- DeploymentTargets:
199-
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
242+
OrganizationalUnitIds:
243+
Fn::If:
244+
- AllowedInclusions
245+
- !Ref IncludeOUIDs
246+
- !Ref RootOUID
247+
AccountFilterType:
248+
Fn::If:
249+
- AccountExclusionsConfigured
250+
- "DIFFERENCE"
251+
- "NONE"
252+
Accounts:
253+
Fn::If:
254+
- AccountExclusionsConfigured
255+
- !Ref ExcludeAccounts
256+
- null
200257
Regions:
201258
- Ref: AWS::Region
202259
TemplateBody: |

‎modules/log_ingestion.events.cft.yaml‎

Lines changed: 74 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
AWSTemplateFormatVersion: "2010-09-09"
2+
Transform: 'AWS::LanguageExtensions'
23
Description: EventBridge resources that forward CloudTrail logs to Sysdig Secure
34
Metadata:
45
AWS::CloudFormation::Interface:
@@ -119,7 +120,7 @@ Parameters:
119120
Description: AWS Partition of your account or organization to create resources in
120121
Default: 'aws'
121122
RootOUID:
122-
Type: String
123+
Type: CommaDelimitedList
123124
Description: Root Organizational Unit ID of your AWS organization
124125
IncludeOUIDs:
125126
Type: CommaDelimitedList
@@ -138,6 +139,48 @@ Conditions:
138139
Fn::Equals:
139140
- Ref: IsOrganizational
140141
- 'true'
142+
OUInclusionsConfigured:
143+
!And
144+
- !Condition IsOrganizational
145+
- !Not
146+
- !Equals
147+
- Fn::Length:
148+
- !Ref IncludeOUIDs
149+
- 0
150+
AccountInclusionsConfigured:
151+
!And
152+
- !Condition IsOrganizational
153+
- !Not
154+
- !Equals
155+
- Fn::Length:
156+
- !Ref IncludeAccounts
157+
- 0
158+
# -----------------------------------------------------------------------------------------------------
159+
# Remove below condition once AWS issue is fixed and replace with using UNION filter -
160+
# https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-cloudformation/issues/100
161+
# -----------------------------------------------------------------------------------------------------
162+
# XXX: due to AWS bug of not having UNION filter fully working, there is no way to add those extra accounts requested.
163+
# to not miss out on those extra accounts, deploy the cloud resources across entire org and noop the UNION filter.
164+
# i.e till we can't deploy UNION, we deploy it all ()
165+
AllowedInclusions:
166+
!And
167+
- !Condition OUInclusionsConfigured
168+
- !Not
169+
- !Condition AccountInclusionsConfigured
170+
171+
# cannot do OU exclusions since CFT templates are static and don't have a way to fetch dynamic data from AWS
172+
AccountExclusionsConfigured:
173+
!And
174+
- !Condition IsOrganizational
175+
- !Equals
176+
- Fn::Length:
177+
- !Ref IncludeAccounts
178+
- 0
179+
- !Not
180+
- !Equals
181+
- Fn::Length:
182+
- !Ref ExcludeAccounts
183+
- 0
141184
Resources:
142185
AdministrationRole:
143186
Type: AWS::IAM::Role
@@ -318,7 +361,21 @@ Resources:
318361
ParameterValue: !Ref Partition
319362
StackInstancesGroup:
320363
- DeploymentTargets:
321-
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
364+
OrganizationalUnitIds:
365+
Fn::If:
366+
- AllowedInclusions
367+
- !Ref IncludeOUIDs
368+
- !Ref RootOUID
369+
AccountFilterType:
370+
Fn::If:
371+
- AccountExclusionsConfigured
372+
- "DIFFERENCE"
373+
- "NONE"
374+
Accounts:
375+
Fn::If:
376+
- AccountExclusionsConfigured
377+
- !Ref ExcludeAccounts
378+
- null
322379
Regions: [!Ref "AWS::Region"]
323380
TemplateBody: |
324381
AWSTemplateFormatVersion: "2010-09-09"
@@ -406,7 +463,21 @@ Resources:
406463
ParameterValue: !Ref Partition
407464
StackInstancesGroup:
408465
- DeploymentTargets:
409-
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
466+
OrganizationalUnitIds:
467+
Fn::If:
468+
- AllowedInclusions
469+
- !Ref IncludeOUIDs
470+
- !Ref RootOUID
471+
AccountFilterType:
472+
Fn::If:
473+
- AccountExclusionsConfigured
474+
- "DIFFERENCE"
475+
- "NONE"
476+
Accounts:
477+
Fn::If:
478+
- AccountExclusionsConfigured
479+
- !Ref ExcludeAccounts
480+
- null
410481
Regions: !Ref Regions
411482
TemplateBody: |
412483
AWSTemplateFormatVersion: "2010-09-09"

‎modules/vm_workload_scanning.cft.yaml‎

Lines changed: 59 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
AWSTemplateFormatVersion: '2010-09-09'
2+
Transform: 'AWS::LanguageExtensions'
23
Description: Sysdig Secure Agentless Workload Scanning Onboarding
34
Metadata:
45
AWS::CloudFormation::Interface:
@@ -71,7 +72,7 @@ Parameters:
7172
Type: CommaDelimitedList
7273
Description: (Deprecated, use RootOUID or IncludeOUIDs instead) Comma-separated list of organizational unit IDs to deploy (required for organizational deployments)
7374
RootOUID:
74-
Type: String
75+
Type: CommaDelimitedList
7576
Description: Root Organizational Unit ID of your AWS organization
7677
IncludeOUIDs:
7778
Type: CommaDelimitedList
@@ -95,6 +96,48 @@ Conditions:
9596
Fn::Equals:
9697
- Ref: LambdaScanningEnabled
9798
- 'true'
99+
OUInclusionsConfigured:
100+
!And
101+
- !Condition IsOrganizational
102+
- !Not
103+
- !Equals
104+
- Fn::Length:
105+
- !Ref IncludeOUIDs
106+
- 0
107+
AccountInclusionsConfigured:
108+
!And
109+
- !Condition IsOrganizational
110+
- !Not
111+
- !Equals
112+
- Fn::Length:
113+
- !Ref IncludeAccounts
114+
- 0
115+
# -----------------------------------------------------------------------------------------------------
116+
# Remove below condition once AWS issue is fixed and replace with using UNION filter -
117+
# https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-cloudformation/issues/100
118+
# -----------------------------------------------------------------------------------------------------
119+
# XXX: due to AWS bug of not having UNION filter fully working, there is no way to add those extra accounts requested.
120+
# to not miss out on those extra accounts, deploy the cloud resources across entire org and noop the UNION filter.
121+
# i.e till we can't deploy UNION, we deploy it all ()
122+
AllowedInclusions:
123+
!And
124+
- !Condition OUInclusionsConfigured
125+
- !Not
126+
- !Condition AccountInclusionsConfigured
127+
128+
# cannot do OU exclusions since CFT templates are static and don't have a way to fetch dynamic data from AWS
129+
AccountExclusionsConfigured:
130+
!And
131+
- !Condition IsOrganizational
132+
- !Equals
133+
- Fn::Length:
134+
- !Ref IncludeAccounts
135+
- 0
136+
- !Not
137+
- !Equals
138+
- Fn::Length:
139+
- !Ref ExcludeAccounts
140+
- 0
98141

99142
Resources:
100143
ScanningRole:
@@ -187,7 +230,21 @@ Resources:
187230
Ref: LambdaScanningEnabled
188231
StackInstancesGroup:
189232
- DeploymentTargets:
190-
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
233+
OrganizationalUnitIds:
234+
Fn::If:
235+
- AllowedInclusions
236+
- !Ref IncludeOUIDs
237+
- !Ref RootOUID
238+
AccountFilterType:
239+
Fn::If:
240+
- AccountExclusionsConfigured
241+
- "DIFFERENCE"
242+
- "NONE"
243+
Accounts:
244+
Fn::If:
245+
- AccountExclusionsConfigured
246+
- !Ref ExcludeAccounts
247+
- null
191248
Regions:
192249
- Ref: AWS::Region
193250
TemplateBody: |

‎modules/volume_access.cft.yaml‎

Lines changed: 59 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
AWSTemplateFormatVersion: '2010-09-09'
2+
Transform: 'AWS::LanguageExtensions'
23
Description: Sysdig Agentless Scanning integration resources
34
Metadata:
45
AWS::CloudFormation::Interface:
@@ -75,7 +76,7 @@ Parameters:
7576
Type: CommaDelimitedList
7677
Description: (Deprecated, use RootOUID or IncludeOUIDs instead) Comma separated list of organizational unit IDs to deploy
7778
RootOUID:
78-
Type: String
79+
Type: CommaDelimitedList
7980
Description: Root Organizational Unit ID of your AWS organization
8081
IncludeOUIDs:
8182
Type: CommaDelimitedList
@@ -95,6 +96,48 @@ Conditions:
9596
Fn::Equals:
9697
- Ref: IsOrganizational
9798
- 'true'
99+
OUInclusionsConfigured:
100+
!And
101+
- !Condition IsOrganizational
102+
- !Not
103+
- !Equals
104+
- Fn::Length:
105+
- !Ref IncludeOUIDs
106+
- 0
107+
AccountInclusionsConfigured:
108+
!And
109+
- !Condition IsOrganizational
110+
- !Not
111+
- !Equals
112+
- Fn::Length:
113+
- !Ref IncludeAccounts
114+
- 0
115+
# -----------------------------------------------------------------------------------------------------
116+
# Remove below condition once AWS issue is fixed and replace with using UNION filter -
117+
# https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-cloudformation/issues/100
118+
# -----------------------------------------------------------------------------------------------------
119+
# XXX: due to AWS bug of not having UNION filter fully working, there is no way to add those extra accounts requested.
120+
# to not miss out on those extra accounts, deploy the cloud resources across entire org and noop the UNION filter.
121+
# i.e till we can't deploy UNION, we deploy it all ()
122+
AllowedInclusions:
123+
!And
124+
- !Condition OUInclusionsConfigured
125+
- !Not
126+
- !Condition AccountInclusionsConfigured
127+
128+
# cannot do OU exclusions since CFT templates are static and don't have a way to fetch dynamic data from AWS
129+
AccountExclusionsConfigured:
130+
!And
131+
- !Condition IsOrganizational
132+
- !Equals
133+
- Fn::Length:
134+
- !Ref IncludeAccounts
135+
- 0
136+
- !Not
137+
- !Equals
138+
- Fn::Length:
139+
- !Ref ExcludeAccounts
140+
- 0
98141

99142
Resources:
100143
AdministrationRole:
@@ -354,7 +397,21 @@ Resources:
354397
ParameterValue: !Ref ExternalID
355398
StackInstancesGroup:
356399
- DeploymentTargets:
357-
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
400+
OrganizationalUnitIds:
401+
Fn::If:
402+
- AllowedInclusions
403+
- !Ref IncludeOUIDs
404+
- !Ref RootOUID
405+
AccountFilterType:
406+
Fn::If:
407+
- AccountExclusionsConfigured
408+
- "DIFFERENCE"
409+
- "NONE"
410+
Accounts:
411+
Fn::If:
412+
- AccountExclusionsConfigured
413+
- !Ref ExcludeAccounts
414+
- null
358415
Regions: !Ref Regions
359416
TemplateBody: |
360417
AWSTemplateFormatVersion: "2010-09-09"

0 commit comments

Comments
 (0)