Skip to content

Commit 2e87d6d

Browse files
miguelpaismiguelpais
committed
Version without so many variables
1 parent 27e26eb commit 2e87d6d

File tree

2 files changed

+94
-233
lines changed

2 files changed

+94
-233
lines changed

‎modules/Makefile‎

Lines changed: 4 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ S3_BUCKET ?= "s4c-cft"
44
S3_PREFIX ?= "test"
55
S3_REGION ?= eu-west-1
66
STACK_NAME = Sysdig-Secure
7-
PARAM_NAME_SUFFIX ?= test
7+
PARAM_NAME_SUFFIX ?= abc1240
88
PARAM_IS_ORGANIZATIONAL ?= false
99
PARAM_EXTERNAL_ID ?= test
10-
PARAM_TRUSTED_IDENTITY ?= arn:aws:iam:::role/$(PARAM_NAME_SUFFIX)
10+
PARAM_TRUSTED_IDENTITY ?= arn:aws:iam::064689838359:role/us-east-1-integration01-secure-assume-role
1111
PARAM_TARGET_EVENT_BUS_ARN ?= arn:aws:events:us-east-1::event-bus/default
1212
PARAM_BUCKET_ARN ?= arn:aws:s3:::cloudtrail-$(PARAM_NAME_SUFFIX)
1313
PARAM_REGIONS ?= us-east-1
@@ -30,8 +30,7 @@ lint:
3030
yq '.Resources.OrganizationRuleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
3131
yq '.Resources.AccountStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
3232
yq '.Resources.OrganizationStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
33-
yq '.Resources.ScanningOrgNoLambdaRoleStackSet.Properties.TemplateBody' vm_workload_scanning.cft.yaml | cfn-lint -
34-
yq '.Resources.ScanningOrgWithLambdaRoleStackSet.Properties.TemplateBody' vm_workload_scanning.cft.yaml | cfn-lint -
33+
yq '.Resources.ScanningOrgStackSet.Properties.TemplateBody' vm_workload_scanning.cft.yaml | cfn-lint -
3534

3635
publish:
3736
aws s3 cp foundational.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/foundational.cft.yaml
@@ -41,52 +40,7 @@ publish:
4140
aws s3 cp vm_workload_scanning.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/vm_workload_scanning.cft.yaml
4241

4342
deploy:
44-
aws cloudformation deploy \
45-
--stack-name $(STACK_NAME)-Foundational-$(PARAM_NAME_SUFFIX) \
46-
--template-file foundational.cft.yaml \
47-
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
48-
--parameter-overrides \
49-
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
50-
"ExternalID=$(PARAM_EXTERNAL_ID)" \
51-
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
52-
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
53-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
54-
"Partition=${PARAM_PARTITION}"
55-
aws cloudformation deploy \
56-
--stack-name $(STACK_NAME)-LogIngestion-EventBridge-$(PARAM_NAME_SUFFIX) \
57-
--template-file log_ingestion.events.cft.yaml \
58-
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
59-
--parameter-overrides \
60-
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
61-
"ExternalID=$(PARAM_EXTERNAL_ID)" \
62-
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
63-
"Regions=$(PARAM_REGIONS)" \
64-
"TargetEventBusARN=$(PARAM_TARGET_EVENT_BUS_ARN)" \
65-
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
66-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
67-
"Partition=${PARAM_PARTITION}"
68-
aws cloudformation deploy \
69-
--stack-name $(STACK_NAME)-LogIngestion-S3-$(PARAM_NAME_SUFFIX) \
70-
--template-file log_ingestion.s3.cft.yaml \
71-
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
72-
--parameter-overrides \
73-
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
74-
"ExternalID=$(PARAM_EXTERNAL_ID)" \
75-
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
76-
"BucketARN=$(PARAM_BUCKET_ARN)" \
77-
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
78-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
79-
aws cloudformation deploy \
80-
--stack-name $(STACK_NAME)-VolumeAccess-$(PARAM_NAME_SUFFIX) \
81-
--template-file volume_access.cft.yaml \
82-
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
83-
--parameter-overrides \
84-
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
85-
"ExternalID=$(PARAM_EXTERNAL_ID)" \
86-
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
87-
"Regions=$(PARAM_REGIONS)" \
88-
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
89-
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
43+
9044

9145
aws cloudformation deploy \
9246
--stack-name $(STACK_NAME)-VMWorkloadScanning-$(PARAM_NAME_SUFFIX) \

‎modules/vm_workload_scanning.cft.yaml‎

Lines changed: 90 additions & 183 deletions
Original file line numberDiff line numberDiff line change
@@ -65,35 +65,27 @@ Conditions:
6565
Fn::Equals:
6666
- Ref: IsOrganizational
6767
- 'false'
68-
IsLambdaScanningEnabled:
69-
Fn::Equals:
70-
- Ref: LambdaScanningEnabled
71-
- 'true'
72-
NotLambdaScanningEnabled:
73-
Fn::Equals:
74-
- Ref: LambdaScanningEnabled
75-
- 'false'
7668
IsOrganizationalAndLambdaEnabled:
7769
Fn::And:
78-
- Condition: IsOrganizational
79-
- Condition: IsLambdaScanningEnabled
80-
IsOrganizationalAndNotLambdaEnabled:
81-
Fn::And:
82-
- Condition: IsOrganizational
83-
- Condition: NotLambdaScanningEnabled
70+
- Fn::Equals:
71+
- Ref: IsOrganizational
72+
- 'true'
73+
- Fn::Equals:
74+
- Ref: LambdaScanningEnabled
75+
- 'true'
8476
IsNotOrganizationalAndLambdaEnabled:
8577
Fn::And:
86-
- Condition: IsLambdaScanningEnabled
87-
- Condition: IsNotOrganizational
88-
IsNotOrganizationalAndNotLambdaEnabled:
89-
Fn::And:
90-
- Condition: NotLambdaScanningEnabled
91-
- Condition: IsNotOrganizational
78+
- Fn::Equals:
79+
- Ref: IsOrganizational
80+
- 'false'
81+
- Fn::Equals:
82+
- Ref: LambdaScanningEnabled
83+
- 'true'
9284

9385
Resources:
94-
ScanningRoleWithLambda:
86+
ScanningRole:
9587
Type: AWS::IAM::Role
96-
Condition: IsNotOrganizationalAndLambdaEnabled
88+
Condition: IsNotOrganizational
9789
Properties:
9890
RoleName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
9991
AssumeRolePolicyDocument:
@@ -108,164 +100,51 @@ Resources:
108100
StringEquals:
109101
sts:ExternalId:
110102
Ref: ExternalID
111-
Policies:
112-
- PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
113-
PolicyDocument:
114-
Version: '2012-10-17'
115-
Statement:
116-
- Effect: Allow
117-
Action:
118-
- ecr:GetDownloadUrlForLayer
119-
- ecr:BatchGetImage
120-
- ecr:BatchCheckLayerAvailability
121-
- ecr:ListImages
122-
- ecr:GetAuthorizationToken
123-
Resource: '*'
124-
- Effect: Allow
125-
Action:
126-
- lambda:GetFunction
127-
- lambda:GetFunctionConfiguration
128-
- lambda:GetRuntimeManagementConfig
129-
- lambda:ListFunctions
130-
- lambda:ListTagsForResource
131-
- lambda:GetLayerVersionByArn
132-
- lambda:GetLayerVersion
133-
- lambda:ListLayers
134-
- lambda:ListLayerVersions
135-
Resource: '*'
136-
137-
ScanningRoleNoLambda:
138-
Type: AWS::IAM::Role
139-
Condition: IsNotOrganizationalAndNotLambdaEnabled
103+
ECRPolicy:
104+
Type: AWS::IAM::Policy
105+
Condition: IsNotOrganizational
140106
Properties:
141-
RoleName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
142-
AssumeRolePolicyDocument:
107+
PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}-ecr
108+
Roles:
109+
- !Ref ScanningRole
110+
PolicyDocument:
143111
Version: '2012-10-17'
144112
Statement:
145113
- Effect: Allow
146-
Principal:
147-
AWS:
148-
Ref: TrustedIdentity
149-
Action: [ 'sts:AssumeRole' ]
150-
Condition:
151-
StringEquals:
152-
sts:ExternalId:
153-
Ref: ExternalID
154-
Policies:
155-
- PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
156-
PolicyDocument:
157-
Version: '2012-10-17'
158-
Statement:
159-
- Effect: Allow
160-
Action:
161-
- ecr:GetDownloadUrlForLayer
162-
- ecr:BatchGetImage
163-
- ecr:BatchCheckLayerAvailability
164-
- ecr:ListImages
165-
- ecr:GetAuthorizationToken
166-
Resource: '*'
167-
168-
ScanningOrgWithLambdaRoleStackSet:
169-
Type: AWS::CloudFormation::StackSet
170-
Condition: IsOrganizationalAndLambdaEnabled
114+
Action:
115+
- ecr:GetDownloadUrlForLayer
116+
- ecr:BatchGetImage
117+
- ecr:BatchCheckLayerAvailability
118+
- ecr:ListImages
119+
- ecr:GetAuthorizationToken
120+
Resource: '*'
121+
LambdaPolicy:
122+
Type: AWS::IAM::Policy
123+
Condition: IsNotOrganizationalAndLambdaEnabled
171124
Properties:
172-
StackSetName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
173-
Description: Creates IAM roles within an AWS organization for Agentless Workload Scanning
174-
PermissionModel: SERVICE_MANAGED
175-
Capabilities:
176-
- CAPABILITY_NAMED_IAM
177-
AutoDeployment:
178-
Enabled: true
179-
RetainStacksOnAccountRemoval: false
180-
ManagedExecution:
181-
Active: true
182-
OperationPreferences:
183-
MaxConcurrentPercentage: 100
184-
FailureTolerancePercentage: 90
185-
ConcurrencyMode: SOFT_FAILURE_TOLERANCE
186-
Parameters:
187-
- ParameterKey: NameSuffix
188-
ParameterValue:
189-
Ref: NameSuffix
190-
- ParameterKey: TrustedIdentity
191-
ParameterValue:
192-
Ref: TrustedIdentity
193-
- ParameterKey: ExternalID
194-
ParameterValue:
195-
Ref: ExternalID
196-
- ParameterKey: LambdaScanningEnabled
197-
ParameterValue:
198-
Ref: LambdaScanningEnabled
199-
StackInstancesGroup:
200-
- DeploymentTargets:
201-
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
202-
Regions:
203-
- Ref: AWS::Region
204-
TemplateBody: |
205-
AWSTemplateFormatVersion: "2010-09-09"
206-
Description: IAM Role for Agentless Workload Scanning
207-
Parameters:
208-
NameSuffix:
209-
Type: String
210-
Description: Suffix to append to the resource name identifiers
211-
AllowedPattern: "[0-9a-z]+"
212-
MaxLength: 8
213-
MinLength: 4
214-
TrustedIdentity:
215-
Type: String
216-
Description: Trusted identity
217-
ExternalID:
218-
Type: String
219-
Description: external ID
220-
LambdaScanningEnabled:
221-
Type: String
222-
Description: Enable Lambda function scanning
223-
Default: 'false'
125+
PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}-lambda
126+
Roles:
127+
- !Ref ScanningRole
128+
PolicyDocument:
129+
Version: '2012-10-17'
130+
Statement:
131+
- Effect: Allow
132+
Action:
133+
- lambda:GetFunction
134+
- lambda:GetFunctionConfiguration
135+
- lambda:GetRuntimeManagementConfig
136+
- lambda:ListFunctions
137+
- lambda:ListTagsForResource
138+
- lambda:GetLayerVersionByArn
139+
- lambda:GetLayerVersion
140+
- lambda:ListLayers
141+
- lambda:ListLayerVersions
142+
Resource: '*'
224143

225-
Resources:
226-
ScanningRole:
227-
Type: AWS::IAM::Role
228-
Properties:
229-
RoleName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
230-
AssumeRolePolicyDocument:
231-
Version: "2012-10-17"
232-
Statement:
233-
- Effect: "Allow"
234-
Action: "sts:AssumeRole"
235-
Principal:
236-
AWS: !Ref TrustedIdentity
237-
Condition:
238-
StringEquals:
239-
sts:ExternalId: !Ref ExternalID
240-
Policies:
241-
- PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
242-
PolicyDocument:
243-
Version: "2012-10-17"
244-
Statement:
245-
- Effect: "Allow"
246-
Action:
247-
- ecr:GetDownloadUrlForLayer
248-
- ecr:BatchGetImage
249-
- ecr:BatchCheckLayerAvailability
250-
- ecr:ListImages
251-
- ecr:GetAuthorizationToken
252-
Resource: "*"
253-
- Effect: Allow
254-
Action:
255-
- lambda:GetFunction
256-
- lambda:GetFunctionConfiguration
257-
- lambda:GetRuntimeManagementConfig
258-
- lambda:ListFunctions
259-
- lambda:ListTagsForResource
260-
- lambda:GetLayerVersionByArn
261-
- lambda:GetLayerVersion
262-
- lambda:ListLayers
263-
- lambda:ListLayerVersions
264-
Resource: "*"
265144

266-
ScanningOrgNoLambdaRoleStackSet:
145+
ScanningOrgStackSet:
267146
Type: AWS::CloudFormation::StackSet
268-
Condition: IsOrganizationalAndNotLambdaEnabled
147+
Condition: IsOrganizational
269148
Properties:
270149
StackSetName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
271150
Description: Creates IAM roles within an AWS organization for Agentless Workload Scanning
@@ -335,19 +214,47 @@ Resources:
335214
Condition:
336215
StringEquals:
337216
sts:ExternalId: !Ref ExternalID
338-
Policies:
339-
- PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
217+
ECRPolicy:
218+
Type: AWS::IAM::Policy
219+
Condition: IsOrganizational
220+
Properties:
221+
PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}-ecr
222+
Roles:
223+
- !Ref ScanningRole
340224
PolicyDocument:
341-
Version: "2012-10-17"
225+
Version: '2012-10-17'
342226
Statement:
343-
- Effect: "Allow"
344-
Action:
345-
- ecr:GetDownloadUrlForLayer
346-
- ecr:BatchGetImage
347-
- ecr:BatchCheckLayerAvailability
348-
- ecr:ListImages
349-
- ecr:GetAuthorizationToken
350-
Resource: "*"
227+
- Effect: Allow
228+
Action:
229+
- ecr:GetDownloadUrlForLayer
230+
- ecr:BatchGetImage
231+
- ecr:BatchCheckLayerAvailability
232+
- ecr:ListImages
233+
- ecr:GetAuthorizationToken
234+
Resource: '*'
235+
LambdaPolicy:
236+
Type: AWS::IAM::Policy
237+
Condition: IsOrganizationalAndLambdaEnabled
238+
Properties:
239+
PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}-lambda
240+
Roles:
241+
- !Ref ScanningRole
242+
PolicyDocument:
243+
Version: '2012-10-17'
244+
Statement:
245+
- Effect: Allow
246+
Action:
247+
- lambda:GetFunction
248+
- lambda:GetFunctionConfiguration
249+
- lambda:GetRuntimeManagementConfig
250+
- lambda:ListFunctions
251+
- lambda:ListTagsForResource
252+
- lambda:GetLayerVersionByArn
253+
- lambda:GetLayerVersion
254+
- lambda:ListLayers
255+
- lambda:ListLayerVersions
256+
Resource: '*'
257+
351258
352259
Outputs:
353260
ScanningRoleARN:

0 commit comments

Comments
 (0)