[SSPROD-40004] Adding permissions for aws-templates for the getFunction call (#119)

* Adding permissions for templates

* grouping

* small fix

Author: miguelpais

templates_cspm/CloudAgentlessRole.yaml

@@ -66,7 +66,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
 
 Outputs:

templates_cspm/OrgCloudAgentlessRole.yaml

@@ -68,7 +68,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
   RoleStackSet:
     Type: AWS::CloudFormation::StackSet
@@ -142,5 +144,7 @@ Resources:
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
                       - Effect: "Allow"
-                        Action: "lambda:GetRuntimeManagementConfig"
+                        Action:
+                          - "lambda:GetRuntimeManagementConfig"
+                          - "lambda:GetFunction"
                         Resource: "*"

templates_cspm_cloudlogs/FullInstall.yaml

@@ -79,7 +79,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"

templates_cspm_cloudlogs/OrgFullInstall.yaml

@@ -84,7 +84,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"
@@ -196,5 +198,7 @@ Resources:
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
                       - Effect: "Allow"
-                        Action: "lambda:GetRuntimeManagementConfig"
+                        Action:
+                          - "lambda:GetRuntimeManagementConfig"
+                          - "lambda:GetFunction"
                         Resource: "*"

templates_cspm_eventbridge/FullInstall.yaml

@@ -91,7 +91,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role

templates_cspm_eventbridge/OrgFullInstall.yaml

@@ -135,7 +135,9 @@ Resources:
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
               - Effect: "Allow"
-                Action: "lambda:GetRuntimeManagementConfig"
+                Action:
+                  - "lambda:GetRuntimeManagementConfig"
+                  - "lambda:GetFunction"
                 Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role
@@ -251,7 +253,9 @@ Resources:
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
                       - Effect: "Allow"
-                        Action: "lambda:GetRuntimeManagementConfig"
+                        Action:
+                          - "lambda:GetRuntimeManagementConfig"
+                          - "lambda:GetFunction"
                         Resource: "*"
           EventBridgeRole:
             Type: AWS::IAM::Role