Skip to content

Commit 715a895

Browse files
hayk99hayk99
authored
feat(WIP): CFT App Runner (#68)
* feat(WIP): add apprunner templates * feat: add cf templates for apprunner * feat: add cf templates for apprunner * ci: change bucket directory * ci: upload apprunner templates to bucket * ci: remove upload apprunner files * ci: upload apprunner templates to bucket * ci: fix wrong directory * ci: fix wrong directory
1 parent e0f7fed commit 715a895

File tree

8 files changed

+775
-5
lines changed

8 files changed

+775
-5
lines changed

‎.github/workflows/ci-pull-request.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,9 @@ jobs:
3838
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
3939
aws-region: eu-west-1
4040

41-
- name: Build and Upload
41+
- name: Build and Upload ECS Templates
4242
run: make ci
43-
working-directory: ./templates
43+
working-directory: templates_apprunner
4444
env:
4545
S3_BUCKET: cf-templates-cloudvision-ci
46-
S3_PREFIX: pr/${{ github.event.pull_request.head.ref }}
46+
S3_PREFIX: pr/${{ github.event.pull_request.head.ref }}

‎templates/Makefile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ S3_PREFIX ?= "test"
55
# We need the REGION or the TemplateURLs might be created for a different region, resulting in a deployment error
66
S3_REGION ?= "eu-west-1" # ireland
77
SECURE_API_TOKEN ?= ""
8+
STACK_NAME = "SecureForCloudECSTest"
89

910
.PHONY: packaged-template.yaml
1011

@@ -26,7 +27,7 @@ packaged-template.yaml:
2627

2728
test: packaged-template.yaml
2829
aws cloudformation deploy \
29-
--stack-name "CloudVisionTest" \
30+
--stack-name $(STACK_NAME) \
3031
--template-file packaged-template.yaml \
3132
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
3233
--parameter-overrides \
@@ -38,7 +39,7 @@ ci: packaged-template.yaml
3839
aws s3 cp ./packaged-template.yaml s3://$(S3_BUCKET)/$(S3_PREFIX)/entry-point.yaml
3940

4041
clean:
41-
aws cloudformation delete-stack --stack-name "CloudVisionTest"
42+
aws cloudformation delete-stack --stack-name $(STACK_NAME)
4243

4344

4445
#

‎templates_apprunner/CloudAgentlessRole.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: IAM Role for Agentless
3+
Parameters:
4+
SysdigRoleName:
5+
Type: String
6+
Default: "SysdigAgentlessRole"
7+
Description: Unique role for monitoring AWS accounts
8+
SysdigExternalID:
9+
Type: String
10+
Description: ExternalID required for the policy
11+
SysdigTrustedIdentity:
12+
Type: String
13+
Description: Trusted identity required for policy
14+
15+
Resources:
16+
CloudAgentlessRole:
17+
Type: "AWS::IAM::Role"
18+
Properties:
19+
RoleName: !Ref SysdigRoleName
20+
AssumeRolePolicyDocument:
21+
Version: "2012-10-17"
22+
Statement:
23+
-
24+
Effect: "Allow"
25+
Principal:
26+
AWS: !Ref SysdigTrustedIdentity
27+
Action: "sts:AssumeRole"
28+
Condition:
29+
StringEquals:
30+
sts:ExternalId: !Ref SysdigExternalID
31+
ManagedPolicyArns:
32+
- arn:aws:iam::aws:policy/SecurityAudit

‎templates_apprunner/CloudConnector.yaml‎

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: Cloud Connector for AWS
3+
4+
Parameters:
5+
LogRetention:
6+
Type: Number
7+
Default: 5
8+
Description: Days to keep logs from CloudConnector
9+
SysdigSecureEndpoint:
10+
Type: String
11+
Description: "Sysdig Secure Endpoint URL"
12+
SysdigSecureAPIToken:
13+
Type: String
14+
Description: "Name of the parameter in SSM containing the Sysdig Secure API Token"
15+
SysdigSecureAPITokenSsm:
16+
Type: AWS::SSM::Parameter::Name
17+
Description: "Name of the parameter in SSM containing the Sysdig Secure API Token"
18+
S3ConfigBucket:
19+
Type: String
20+
Description: Name of a bucket (must exist) where the configuration YAML files will be stored
21+
VerifySSL:
22+
Type: String
23+
AllowedValues:
24+
- "Yes"
25+
- "No"
26+
Default: "Yes"
27+
BuildProject:
28+
Type: String
29+
Default: ""
30+
CloudTrailTopic:
31+
Type: String
32+
Description: ARN of the SNS Topic to subscribe
33+
DeployCloudScanning:
34+
Type: String
35+
AllowedValues:
36+
- "Yes"
37+
- "No"
38+
Default: "Yes"
39+
Description: Whether to deploy cloud scanning or not
40+
ECRImageScanningDeploy:
41+
Type: String
42+
AllowedValues:
43+
- "Yes"
44+
- "No"
45+
Default: "Yes"
46+
Description: Whether to deploy ECR Image Scanning or not
47+
ECSImageScanningDeploy:
48+
Type: String
49+
AllowedValues:
50+
- "Yes"
51+
- "No"
52+
Default: "Yes"
53+
Description: Whether to deploy ECS Image Scanning or not
54+
55+
Conditions:
56+
VerifySSL: !Equals [ !Ref VerifySSL, "Yes" ]
57+
DeployCloudScanning: !Equals [ !Ref DeployCloudScanning, "Yes"]
58+
ECRImageScanningDeploy: !Equals [ !Ref ECRImageScanningDeploy, "Yes"]
59+
ECSImageScanningDeploy: !Equals [ !Ref ECSImageScanningDeploy, "Yes"]
60+
61+
Resources:
62+
63+
CloudTrailQueue:
64+
Type: AWS::SQS::Queue
65+
66+
CloudTrailQueuePolicy:
67+
Type: AWS::SQS::QueuePolicy
68+
Properties:
69+
Queues:
70+
- !Ref CloudTrailQueue
71+
PolicyDocument:
72+
Version: 2012-10-17
73+
Statement:
74+
- Sid: Allow CloudTrail to send messages
75+
Effect: Allow
76+
Principal:
77+
Service: sns.amazonaws.com
78+
Action:
79+
- sqs:SendMessage
80+
- sqs:SendMessageBatch
81+
Resource: !GetAtt CloudTrailQueue.Arn
82+
83+
Subscription:
84+
Type: AWS::SNS::Subscription
85+
Properties:
86+
Protocol: sqs
87+
Endpoint: !GetAtt CloudTrailQueue.Arn
88+
TopicArn: !Ref CloudTrailTopic
89+
90+
LogGroup:
91+
Type: AWS::Logs::LogGroup
92+
Properties:
93+
LogGroupName: !Ref AWS::StackName
94+
RetentionInDays: !Ref LogRetention
95+
96+
AlertsLogStream:
97+
Type: AWS::Logs::LogStream
98+
Properties:
99+
LogGroupName: !Ref LogGroup
100+
LogStreamName: alerts
101+
102+
CloudConnectorAppRunner:
103+
Type: AWS::AppRunner::Service
104+
Properties:
105+
ServiceName: "CloudConnector_AppRunner"
106+
InstanceConfiguration:
107+
InstanceRoleArn: !GetAtt AppRunnerRole.Arn
108+
SourceConfiguration:
109+
AutoDeploymentsEnabled: false
110+
ImageRepository:
111+
ImageConfiguration:
112+
Port: "5000"
113+
RuntimeEnvironmentVariables:
114+
- Name: CONFIG
115+
Value:
116+
"Fn::Base64":
117+
!Sub
118+
- |
119+
logging: info
120+
rules: []
121+
ingestors:
122+
- cloudtrail-sns-sqs:
123+
queueURL: ${CloudTrailQueue}
124+
scanners: ${Scanners}
125+
- S3ConfigBucket: !Ref S3ConfigBucket
126+
CloudTrailQueue: !Ref CloudTrailQueue
127+
Scanners:
128+
'Fn::If':
129+
- DeployCloudScanning
130+
- !Sub
131+
- |
132+
133+
${ECRCode}
134+
${ECSCode}
135+
- ECRCode:
136+
'Fn::If':
137+
- ECRImageScanningDeploy
138+
- !Sub |
139+
140+
- aws-ecr:
141+
codeBuildProject: ${BuildProject}
142+
secureAPITokenSecretName: ${SysdigSecureAPITokenSsm}
143+
- ""
144+
ECSCode:
145+
'Fn::If':
146+
- ECSImageScanningDeploy
147+
- !Sub |
148+
149+
- aws-ecs:
150+
codeBuildProject: ${BuildProject}
151+
secureAPITokenSecretName: ${SysdigSecureAPITokenSsm}
152+
- ""
153+
- "[]"
154+
155+
- Name: SECURE_API_TOKEN
156+
Value: !Ref SysdigSecureAPIToken
157+
- Name: SECURE_URL
158+
Value: !Ref SysdigSecureEndpoint
159+
- Name: VERIFY_SSL
160+
Value: !If [ VerifySSL, "true", "false" ]
161+
- Name: TELEMETRY_DEPLOYMENT_METHOD
162+
Value: "cft_aws_apprunner_single"
163+
ImageIdentifier: "public.ecr.aws/o5x4u2t4/cloud-connector:latest"
164+
ImageRepositoryType: "ECR_PUBLIC"
165+
Tags:
166+
- Key: Name
167+
Value: !Sub "${AWS::StackName}-CloudConnector"
168+
169+
AppRunnerRole:
170+
Type: AWS::IAM::Role
171+
Properties:
172+
AssumeRolePolicyDocument:
173+
Statement:
174+
- Effect: Allow
175+
Principal:
176+
Service: [ tasks.apprunner.amazonaws.com ]
177+
Action: [ 'sts:AssumeRole' ]
178+
Path: /
179+
Policies:
180+
- PolicyName: !Sub "${AWS::StackName}-AppRunnerPolicy"
181+
PolicyDocument:
182+
Statement:
183+
- Effect: Allow
184+
Action:
185+
- "s3:GetObject"
186+
- "s3:ListBucket"
187+
Resource: '*'
188+
- Effect: Allow
189+
Action:
190+
- 'sqs:GetQueueUrl'
191+
- 'sqs:ListQueues'
192+
- 'sqs:DeleteMessage'
193+
- 'sqs:ReceiveMessage'
194+
Resource:
195+
- !Sub "arn:aws:sqs:*:${AWS::AccountId}:*"
196+
- PolicyName: !Sub "${AWS::StackName}-TriggerScan"
197+
PolicyDocument:
198+
Statement:
199+
- Effect: Allow
200+
Action:
201+
- "codebuild:StartBuild"
202+
Resource:
203+
- !Sub "arn:aws:codebuild:${AWS::Region}:${AWS::AccountId}:project/${BuildProject}"
204+
- PolicyName: !Sub "${AWS::StackName}-ECRReader"
205+
PolicyDocument:
206+
Version: "2012-10-17"
207+
Statement:
208+
- Effect: Allow
209+
Action:
210+
- "ecr:GetAuthorizationToken"
211+
- "ecr:BatchCheckLayerAvailability"
212+
- "ecr:GetDownloadUrlForLayer"
213+
- "ecr:DescribeImages"
214+
- "ecr:BatchGetImage"
215+
Resource: "*"
216+
- PolicyName: !Sub "${AWS::StackName}-SSMReader"
217+
PolicyDocument:
218+
Version: "2012-10-17"
219+
Statement:
220+
- Effect: Allow
221+
Action:
222+
- "ssm:GetParameters"
223+
Resource: "*"

0 commit comments

Comments
 (0)