Skip to content

Commit 5dfc164

Browse files
sameer-insameer-in
authored
creating cloudformation template for CSPM and Eventbridge (#84)
* adding eb templates * adding full install template * making changes as per PR comments * move file * renaming defaults * adding changes as per design team * renaming parameters * adding github actions * adding org templates * adding ci and master templates * added pr github action * adding correct s3 directory
1 parent 951bacd commit 5dfc164

File tree

13 files changed

+666
-0
lines changed

13 files changed

+666
-0
lines changed

‎.github/workflows/ci-master-cspm.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: CI - Master CSPM
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'templates_cspm/**'
9+
10+
11+
jobs:
12+
build:
13+
name: Build and Upload
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Check out code
18+
uses: actions/checkout@v3
19+
20+
- name: Configure AWS credentials
21+
uses: aws-actions/configure-aws-credentials@v1
22+
with:
23+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
24+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
25+
aws-region: eu-west-1
26+
27+
- name: Build and Upload ECS templates
28+
run: make ci
29+
working-directory: ./templates_cspm
30+
env:
31+
S3_BUCKET: cf-templates-cloudvision-ci
32+
S3_PREFIX: master

‎.github/workflows/ci-master-eventbridge.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: CI - Master EventBridge
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'templates_eventbridge/**'
9+
10+
11+
jobs:
12+
build:
13+
name: Build and Upload
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Check out code
18+
uses: actions/checkout@v3
19+
20+
- name: Configure AWS credentials
21+
uses: aws-actions/configure-aws-credentials@v1
22+
with:
23+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
24+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
25+
aws-region: eu-west-1
26+
27+
- name: Build and Upload EventBridge templates
28+
run: make ci
29+
working-directory: ./templates_eventbridge
30+
env:
31+
S3_BUCKET: cf-templates-cloudvision-ci
32+
S3_PREFIX: master

‎.github/workflows/ci-master-full-install.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: CI - Master Full Install
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'templates_cspm_eventbridge/**'
9+
10+
11+
jobs:
12+
build:
13+
name: Build and Upload
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Check out code
18+
uses: actions/checkout@v3
19+
20+
- name: Configure AWS credentials
21+
uses: aws-actions/configure-aws-credentials@v1
22+
with:
23+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
24+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
25+
aws-region: eu-west-1
26+
27+
- name: Build and Upload Full install templates
28+
run: make ci
29+
working-directory: ./templates_cspm_eventbridge
30+
env:
31+
S3_BUCKET: cf-templates-cloudvision-ci
32+
S3_PREFIX: master

‎.github/workflows/ci-pull-request-cspm.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: CI - Pull Request CSPM
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- 'templates_cspm/**'
9+
10+
jobs:
11+
lint:
12+
name: Lint
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Check out code
17+
uses: actions/checkout@v3
18+
19+
- name: cfn-lint
20+
uses: scottbrenner/cfn-lint-action@v2
21+
22+
- name: Print the Cloud Formation Linter Version & run Linter
23+
run: |
24+
cfn-lint --version
25+
cfn-lint -t templates_cspm/**/*.yaml
26+
27+
build:
28+
name: Build and Upload ECS templates
29+
runs-on: ubuntu-latest
30+
needs: [lint]
31+
32+
steps:
33+
- name: Check out code
34+
uses: actions/checkout@v3
35+
36+
- name: Configure AWS credentials
37+
uses: aws-actions/configure-aws-credentials@v1
38+
with:
39+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
40+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
41+
aws-region: eu-west-1
42+
43+
- name: Build and Upload CSPM Templates
44+
run: make ci
45+
working-directory: templates_cspm
46+
env:
47+
S3_BUCKET: cf-templates-cloudvision-ci
48+
S3_PREFIX: pr/${{ github.event.pull_request.head.ref }}

‎.github/workflows/ci-pull-request-eventbridge.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: CI - Pull Request EventBridge
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- 'templates_eventbridge/**'
9+
10+
jobs:
11+
lint:
12+
name: Lint
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Check out code
17+
uses: actions/checkout@v3
18+
19+
- name: cfn-lint
20+
uses: scottbrenner/cfn-lint-action@v2
21+
22+
- name: Print the Cloud Formation Linter Version & run Linter
23+
run: |
24+
cfn-lint --version
25+
cfn-lint -t templates_eventbridge/**/*.yaml
26+
27+
build:
28+
name: Build and Upload EventBridge templates
29+
runs-on: ubuntu-latest
30+
needs: [lint]
31+
32+
steps:
33+
- name: Check out code
34+
uses: actions/checkout@v3
35+
36+
- name: Configure AWS credentials
37+
uses: aws-actions/configure-aws-credentials@v1
38+
with:
39+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
40+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
41+
aws-region: eu-west-1
42+
43+
- name: Build and Upload EventBridge Templates
44+
run: make ci
45+
working-directory: templates_eventbridge
46+
env:
47+
S3_BUCKET: cf-templates-cloudvision-ci
48+
S3_PREFIX: pr/${{ github.event.pull_request.head.ref }}

‎.github/workflows/ci-pull-request-full-install.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: CI - Pull Request Full Install
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- 'templates_cspm_eventbridge/**'
9+
10+
jobs:
11+
lint:
12+
name: Lint
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Check out code
17+
uses: actions/checkout@v3
18+
19+
- name: cfn-lint
20+
uses: scottbrenner/cfn-lint-action@v2
21+
22+
- name: Print the Cloud Formation Linter Version & run Linter
23+
run: |
24+
cfn-lint --version
25+
cfn-lint -t templates_cspm_eventbridge/**/*.yaml
26+
27+
build:
28+
name: Build and Upload Full Install templates
29+
runs-on: ubuntu-latest
30+
needs: [lint]
31+
32+
steps:
33+
- name: Check out code
34+
uses: actions/checkout@v3
35+
36+
- name: Configure AWS credentials
37+
uses: aws-actions/configure-aws-credentials@v1
38+
with:
39+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
40+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
41+
aws-region: eu-west-1
42+
43+
- name: Build and Upload Full Install Templates
44+
run: make ci
45+
working-directory: templates_cspm_eventbridge
46+
env:
47+
S3_BUCKET: cf-templates-cloudvision-ci
48+
S3_PREFIX: pr/${{ github.event.pull_request.head.ref }}

‎.github/workflows/release.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,3 +76,45 @@ jobs:
7676
env:
7777
S3_BUCKET: cf-templates-cloudvision-ci
7878
S3_PREFIX: latest
79+
80+
- name: Build and Upload CSPM Version
81+
run: make ci
82+
working-directory: ./templates_cspm
83+
env:
84+
S3_BUCKET: cf-templates-cloudvision-ci
85+
S3_PREFIX: ${{ steps.prep.outputs.VERSION }}
86+
87+
- name: Build and Upload CSPM Latest
88+
run: make ci
89+
working-directory: ./templates_cspm
90+
env:
91+
S3_BUCKET: cf-templates-cloudvision-ci
92+
S3_PREFIX: latest
93+
94+
- name: Build and Upload EventBridge Version
95+
run: make ci
96+
working-directory: ./templates_eventbridge
97+
env:
98+
S3_BUCKET: cf-templates-cloudvision-ci
99+
S3_PREFIX: ${{ steps.prep.outputs.VERSION }}
100+
101+
- name: Build and Upload EventBridge Latest
102+
run: make ci
103+
working-directory: ./templates_eventbridge
104+
env:
105+
S3_BUCKET: cf-templates-cloudvision-ci
106+
S3_PREFIX: latest
107+
108+
- name: Build and Upload full install Version
109+
run: make ci
110+
working-directory: ./templates_cspm_eventbridge
111+
env:
112+
S3_BUCKET: cf-templates-cloudvision-ci
113+
S3_PREFIX: ${{ steps.prep.outputs.VERSION }}
114+
115+
- name: Build and Upload full install Latest
116+
run: make ci
117+
working-directory: ./templates_cspm_eventbridge
118+
env:
119+
S3_BUCKET: cf-templates-cloudvision-ci
120+
S3_PREFIX: latest

‎templates_cspm/CloudAgentlessRole.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: IAM Role for Agentless
3+
4+
Metadata:
5+
AWS::CloudFormation::Interface:
6+
ParameterGroups:
7+
- Label:
8+
default: ""
9+
Parameters:
10+
- RoleName
11+
- Label:
12+
default: "Sysdig Settings (Do not change)"
13+
Parameters:
14+
- ExternalID
15+
- TrustedIdentity
16+
17+
ParameterLabels:
18+
RoleName:
19+
default: "Role Name"
20+
ExternalID:
21+
default: "External ID (Sysdig use only)"
22+
TrustedIdentity:
23+
default: "Trusted Identity (Sysdig use only)"
24+
25+
Parameters:
26+
RoleName:
27+
Type: String
28+
Default: "sysdig-secure"
29+
Description: The read-only IAM Role that Sysdig will create
30+
ExternalID:
31+
Type: String
32+
Description: Sysdig generated token that proves you own this account
33+
TrustedIdentity:
34+
Type: String
35+
Description: The Role in Sysdig’s AWS Account with permissions to your account
36+
37+
Resources:
38+
CloudAgentlessRole:
39+
Type: "AWS::IAM::Role"
40+
Properties:
41+
RoleName: !Ref RoleName
42+
AssumeRolePolicyDocument:
43+
Version: "2012-10-17"
44+
Statement:
45+
- Effect: "Allow"
46+
Principal:
47+
AWS: !Ref TrustedIdentity
48+
Action: "sts:AssumeRole"
49+
Condition:
50+
StringEquals:
51+
sts:ExternalId: !Ref ExternalID
52+
ManagedPolicyArns:
53+
- arn:aws:iam::aws:policy/SecurityAudit

‎templates_cspm/Makefile‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# requires AWS_PROFILE
2+
# bucket must exist, prefix will be created
3+
S3_BUCKET ?= "s4c-cft"
4+
S3_PREFIX ?= "test"
5+
# We need the REGION or the TemplateURLs might be created for a different region, resulting in a deployment error
6+
S3_REGION ?= "eu-west-1" # ireland
7+
SECURE_API_TOKEN ?= ""
8+
STACK_NAME = "CSPMTest"
9+
10+
.PHONY: packaged-template.yaml
11+
12+
validate:
13+
aws cloudformation validate-template --template-body file://./CloudAgentlessRole.yaml
14+
15+
lint:
16+
cfn-lint *.yaml
17+
18+
packaged-template.yaml:
19+
aws s3 rm s3://$(S3_BUCKET)/ecs/$(S3_PREFIX) --recursive
20+
aws cloudformation package \
21+
--region $(S3_REGION) \
22+
--template-file CloudAgentlessRole.yaml \
23+
--s3-bucket $(S3_BUCKET) \
24+
--s3-prefix cspm/$(S3_PREFIX) \
25+
--force-upload \
26+
--output-template-file packaged-template.yaml
27+
28+
test: packaged-template.yaml
29+
aws cloudformation deploy \
30+
--stack-name $(STACK_NAME) \
31+
--template-file packaged-template.yaml \
32+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
33+
--parameter-overrides \
34+
"SysdigSecureAPIToken=$(SECURE_API_TOKEN)"
35+
36+
ci: packaged-template.yaml
37+
aws s3 cp ./packaged-template.yaml s3://$(S3_BUCKET)/cspm/$(S3_PREFIX)/entry-point.yaml
38+
39+
clean:
40+
aws cloudformation delete-stack --stack-name $(STACK_NAME)
41+
42+
#
43+
# local-test-manual:
44+
# (have not found a way to do it via cli)
45+
# aws console > cloudformation > create new stack (template, upload template: select ./templates_ecs/Cloudvision.yaml)
46+
# note: this will upload the template into an s3 bucket, remember to delete it afterwards
47+
#

0 commit comments

Comments
 (0)