Skip to content

Commit b2527f7

Browse files
cgeerscgeers
committed
feat(volume_access): regional roles
1 parent d344336 commit b2527f7

File tree

3 files changed

+107
-139
lines changed

3 files changed

+107
-139
lines changed

‎modules/Makefile‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,8 @@ lint:
2626
yq '.Resources.EventBridgeRuleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
2727
yq '.Resources.OrganizationRoleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
2828
yq '.Resources.OrganizationRuleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
29-
yq '.Resources.ScanningKmsKeyStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
30-
yq '.Resources.OrganizationRoleStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
31-
yq '.Resources.OrganizationKMSKeyStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
29+
yq '.Resources.AccountStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
30+
yq '.Resources.OrganizationStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
3231

3332
publish:
3433
aws s3 cp foundational.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/foundational.cft.yaml

‎modules/volume_access.cft.yaml‎

Lines changed: 103 additions & 135 deletions
Original file line numberDiff line numberDiff line change
@@ -66,88 +66,7 @@ Conditions:
6666
- Ref: IsOrganizational
6767
- 'true'
6868

69-
Resources:
70-
ScanningRole:
71-
Type: AWS::IAM::Role
72-
Properties:
73-
RoleName: !Sub sysdig-secure-scanning-${NameSuffix}
74-
AssumeRolePolicyDocument:
75-
Version: "2012-10-17"
76-
Statement:
77-
- Effect: "Allow"
78-
Principal:
79-
AWS: !Ref TrustedIdentity
80-
Action: "sts:AssumeRole"
81-
Condition:
82-
StringEquals:
83-
sts:ExternalId: !Ref ExternalID
84-
Policies:
85-
- PolicyName: !Sub sysdig-secure-scanning-${NameSuffix}
86-
PolicyDocument:
87-
Version: "2012-10-17"
88-
Statement:
89-
- Sid: "Read"
90-
Effect: "Allow"
91-
Action:
92-
- "ec2:Describe*"
93-
Resource: "*"
94-
- Sid: "AllowKMSKeysListing"
95-
Effect: "Allow"
96-
Action:
97-
- "kms:ListKeys"
98-
- "kms:ListAliases"
99-
- "kms:ListResourceTags"
100-
Resource: "*"
101-
- Sid: "AllowKMSEncryptDecrypt"
102-
Effect: "Allow"
103-
Action:
104-
- "kms:DescribeKey"
105-
- "kms:Encrypt"
106-
- "kms:Decrypt"
107-
- "kms:ReEncrypt*"
108-
- "kms:GenerateDataKey*"
109-
- "kms:CreateGrant"
110-
Resource: "*"
111-
Condition:
112-
StringLike:
113-
"kms:ViaService": "ec2.*.amazonaws.com"
114-
- Sid: "CreateTaggedSnapshotFromVolume"
115-
Effect: "Allow"
116-
Action:
117-
- "ec2:CreateSnapshot"
118-
Resource: "*"
119-
- Sid: "CopySnapshots"
120-
Effect: "Allow"
121-
Action:
122-
- "ec2:CopySnapshot"
123-
Resource: "*"
124-
- Sid: "SnapshotTags"
125-
Effect: "Allow"
126-
Action:
127-
- "ec2:CreateTags"
128-
Resource: "*"
129-
Condition:
130-
StringEquals:
131-
"ec2:CreateAction": ["CreateSnapshot", "CopySnapshot"]
132-
"aws:RequestTag/CreatedBy": "Sysdig"
133-
- Sid: "ec2SnapshotShare"
134-
Effect: "Allow"
135-
Action:
136-
- "ec2:ModifySnapshotAttribute"
137-
Resource: "*"
138-
Condition:
139-
StringEqualsIgnoreCase:
140-
"aws:ResourceTag/CreatedBy": "Sysdig"
141-
StringEquals:
142-
"ec2:Add/userId": !Ref ScanningAccountID
143-
- Sid: "ec2SnapshotDelete"
144-
Effect: "Allow"
145-
Action:
146-
- "ec2:DeleteSnapshot"
147-
Resource: "*"
148-
Condition:
149-
StringEqualsIgnoreCase:
150-
"aws:ResourceTag/CreatedBy": "Sysdig"
69+
Resources:
15170
AdministrationRole:
15271
Type: AWS::IAM::Role
15372
Properties:
@@ -186,10 +105,11 @@ Resources:
186105
ManagedPolicyArns:
187106
- arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser
188107
- arn:aws:iam::aws:policy/AWSCloudFormationFullAccess
189-
ScanningKmsKeyStackSet:
108+
- arn:aws:iam::aws:policy/IAMFullAccess
109+
AccountStackSet:
190110
Type: AWS::CloudFormation::StackSet
191111
Properties:
192-
StackSetName: !Sub sysdig-secure-scanning-kms-${NameSuffix}
112+
StackSetName: !Sub sysdig-secure-scanning-account-${NameSuffix}
193113
Description: "A CloudFormation template that creates a KMS key in the account where it is launched, and grants permissions to the specified IAM role"
194114
AdministrationRoleARN: !GetAtt AdministrationRole.Arn
195115
ExecutionRoleName: !Ref ExecutionRole
@@ -208,6 +128,10 @@ Resources:
208128
ParameterValue: !Ref NameSuffix
209129
- ParameterKey: ScanningAccountID
210130
ParameterValue: !Ref ScanningAccountID
131+
- ParameterKey: TrustedIdentity
132+
ParameterValue: !Ref TrustedIdentity
133+
- ParameterKey: ExternalID
134+
ParameterValue: !Ref ExternalID
211135
StackInstancesGroup:
212136
- DeploymentTargets:
213137
Accounts:
@@ -226,7 +150,94 @@ Resources:
226150
ScanningAccountID:
227151
Type: String
228152
Description: The AWS Account ID of the Sysdig Scanning Account
153+
TrustedIdentity:
154+
Type: String
155+
Description: The Role in Sysdig's AWS Account with permissions to your account
156+
ExternalID:
157+
Type: String
158+
Description: Sysdig assigned token that proves you own this account
229159
Resources:
160+
ScanningRole:
161+
Type: AWS::IAM::Role
162+
Properties:
163+
RoleName: !Sub sysdig-secure-scanning-${NameSuffix}-${AWS::Region}
164+
AssumeRolePolicyDocument:
165+
Version: "2012-10-17"
166+
Statement:
167+
- Effect: "Allow"
168+
Principal:
169+
AWS: !Ref TrustedIdentity
170+
Action: "sts:AssumeRole"
171+
Condition:
172+
StringEquals:
173+
sts:ExternalId: !Ref ExternalID
174+
Policies:
175+
- PolicyName: !Sub sysdig-secure-scanning-${NameSuffix}
176+
PolicyDocument:
177+
Version: "2012-10-17"
178+
Statement:
179+
- Sid: "Read"
180+
Effect: "Allow"
181+
Action:
182+
- "ec2:Describe*"
183+
Resource: "*"
184+
- Sid: "AllowKMSKeysListing"
185+
Effect: "Allow"
186+
Action:
187+
- "kms:ListKeys"
188+
- "kms:ListAliases"
189+
- "kms:ListResourceTags"
190+
Resource: "*"
191+
- Sid: "AllowKMSEncryptDecrypt"
192+
Effect: "Allow"
193+
Action:
194+
- "kms:DescribeKey"
195+
- "kms:Encrypt"
196+
- "kms:Decrypt"
197+
- "kms:ReEncrypt*"
198+
- "kms:GenerateDataKey*"
199+
- "kms:CreateGrant"
200+
Resource: "*"
201+
Condition:
202+
StringLike:
203+
"kms:ViaService": "ec2.*.amazonaws.com"
204+
- Sid: "CreateTaggedSnapshotFromVolume"
205+
Effect: "Allow"
206+
Action:
207+
- "ec2:CreateSnapshot"
208+
Resource: "*"
209+
- Sid: "CopySnapshots"
210+
Effect: "Allow"
211+
Action:
212+
- "ec2:CopySnapshot"
213+
Resource: "*"
214+
- Sid: "SnapshotTags"
215+
Effect: "Allow"
216+
Action:
217+
- "ec2:CreateTags"
218+
Resource: "*"
219+
Condition:
220+
StringEquals:
221+
"ec2:CreateAction": ["CreateSnapshot", "CopySnapshot"]
222+
"aws:RequestTag/CreatedBy": "Sysdig"
223+
- Sid: "ec2SnapshotShare"
224+
Effect: "Allow"
225+
Action:
226+
- "ec2:ModifySnapshotAttribute"
227+
Resource: "*"
228+
Condition:
229+
StringEqualsIgnoreCase:
230+
"aws:ResourceTag/CreatedBy": "Sysdig"
231+
StringEquals:
232+
"ec2:Add/userId": !Ref ScanningAccountID
233+
- Sid: "ec2SnapshotDelete"
234+
Effect: "Allow"
235+
Action:
236+
- "ec2:DeleteSnapshot"
237+
Resource: "*"
238+
Condition:
239+
StringEqualsIgnoreCase:
240+
"aws:ResourceTag/CreatedBy": "Sysdig"
230241
ScanningKmsKey:
231242
Type: 'AWS::KMS::Key'
232243
Properties:
@@ -242,7 +253,7 @@ Resources:
242253
Principal:
243254
AWS:
244255
- !Sub arn:aws:iam::${ScanningAccountID}:root
245-
- !Sub arn:aws:iam::${AWS::AccountId}:role/sysdig-secure-scanning-${NameSuffix}
256+
- !GetAtt ScanningRole.Arn
246257
Action:
247258
- "kms:Encrypt"
248259
- "kms:Decrypt"
@@ -265,12 +276,12 @@ Resources:
265276
Properties:
266277
AliasName: !Sub alias/sysdig-secure-scanning-${NameSuffix}
267278
TargetKeyId: !Ref ScanningKmsKey
268-
OrganizationRoleStackSet:
279+
OrganizationStackSet:
269280
Type: AWS::CloudFormation::StackSet
270281
Condition: IsOrganizational
271282
Properties:
272-
StackSetName: !Sub sysdig-secure-scanning-organization-roles-${NameSuffix}
273-
Description: IAM Role used to create IAM roles scan organization accounts/regions
283+
StackSetName: !Sub sysdig-secure-scanning-organization-${NameSuffix}
284+
Description: Installs KMS key, alias, and IAM role for use with Sysdig Agentless Scanning
274285
PermissionModel: SERVICE_MANAGED
275286
Capabilities:
276287
- "CAPABILITY_NAMED_IAM"
@@ -283,6 +294,7 @@ Resources:
283294
MaxConcurrentPercentage: 100
284295
FailureTolerancePercentage: 90
285296
ConcurrencyMode: SOFT_FAILURE_TOLERANCE
297+
RegionConcurrencyType: PARALLEL
286298
Parameters:
287299
- ParameterKey: NameSuffix
288300
ParameterValue: !Ref NameSuffix
@@ -295,7 +307,7 @@ Resources:
295307
StackInstancesGroup:
296308
- DeploymentTargets:
297309
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
298-
Regions: [!Ref "AWS::Region"]
310+
Regions: !Ref Regions
299311
TemplateBody: |
300312
AWSTemplateFormatVersion: "2010-09-09"
301313
Description: IAM Role used by Sysdig Secure Vulnerability Scanning
@@ -319,7 +331,7 @@ Resources:
319331
ScanningRole:
320332
Type: AWS::IAM::Role
321333
Properties:
322-
RoleName: !Sub sysdig-secure-scanning-${NameSuffix}
334+
RoleName: !Sub sysdig-secure-scanning-${NameSuffix}-${AWS::Region}
323335
AssumeRolePolicyDocument:
324336
Version: "2012-10-17"
325337
Statement:
@@ -397,50 +409,6 @@ Resources:
397409
Condition:
398410
StringEqualsIgnoreCase:
399411
"aws:ResourceTag/CreatedBy": "Sysdig"
400-
OrganizationKMSKeyStackSet:
401-
Type: AWS::CloudFormation::StackSet
402-
Condition: IsOrganizational
403-
DependsOn:
404-
- OrganizationRoleStackSet
405-
Properties:
406-
StackSetName: !Sub sysdig-secure-scanning-organization-kmskey-${NameSuffix}
407-
Description: IAM Role used to create KMS Keys to scan organization accounts/regions
408-
PermissionModel: SERVICE_MANAGED
409-
Capabilities:
410-
- "CAPABILITY_NAMED_IAM"
411-
AutoDeployment:
412-
Enabled: true
413-
RetainStacksOnAccountRemoval: false
414-
ManagedExecution:
415-
Active: true
416-
OperationPreferences:
417-
MaxConcurrentPercentage: 100
418-
FailureTolerancePercentage: 90
419-
ConcurrencyMode: SOFT_FAILURE_TOLERANCE
420-
RegionConcurrencyType: PARALLEL
421-
Parameters:
422-
- ParameterKey: NameSuffix
423-
ParameterValue: !Ref NameSuffix
424-
- ParameterKey: ScanningAccountID
425-
ParameterValue: !Ref ScanningAccountID
426-
StackInstancesGroup:
427-
- DeploymentTargets:
428-
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
429-
Regions: !Ref Regions
430-
TemplateBody: |
431-
AWSTemplateFormatVersion: "2010-09-09"
432-
Description: "Template to create KMS Key and Alias for Sysdig Agentless Scanning"
433-
Parameters:
434-
NameSuffix:
435-
Type: String
436-
Description: Suffix to append to the resource name identifiers
437-
AllowedPattern: '[0-9a-z]+'
438-
MaxLength: 8
439-
MinLength: 4
440-
ScanningAccountID:
441-
Type: String
442-
Description: The AWS Account ID of the Sysdig Scanning Account
443-
Resources:
444412
ScanningKmsKey:
445413
Type: 'AWS::KMS::Key'
446414
Properties:
@@ -456,7 +424,7 @@ Resources:
456424
Principal:
457425
AWS:
458426
- !Sub arn:aws:iam::${ScanningAccountID}:root
459-
- !Sub arn:aws:iam::${AWS::AccountId}:role/sysdig-secure-scanning-${NameSuffix}
427+
- !GetAtt ScanningRole.Arn
460428
Action:
461429
- "kms:Encrypt"
462430
- "kms:Decrypt"

‎modules/volume_access.components.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,8 @@
66
"aws": {
77
"roleName": "sysdig-secure-scanning-{{NameSuffix}}"
88
}
9-
}
9+
},
10+
"version": "v0.2.0"
1011
},
1112
{
1213
"type": "COMPONENT_CRYPTO_KEY",

0 commit comments

Comments
 (0)