[SSPROD-40007] Adding necessary permissions for CFT serverless scanning (#118)

Author: miguelpais

templates_cspm/CloudAgentlessRole.yaml

@@ -65,6 +65,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
 
 Outputs:
   RoleARN:

templates_cspm/OrgCloudAgentlessRole.yaml

@@ -67,6 +67,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
   RoleStackSet:
     Type: AWS::CloudFormation::StackSet
     Properties:
@@ -138,3 +141,6 @@ Resources:
                       - Effect: "Allow"
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
+                      - Effect: "Allow"
+                        Action: "lambda:GetRuntimeManagementConfig"
+                        Resource: "*"

templates_cspm_cloudlogs/FullInstall.yaml

@@ -78,6 +78,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"
     Properties:

templates_cspm_cloudlogs/OrgFullInstall.yaml

@@ -83,6 +83,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"
     Properties:
@@ -192,3 +195,6 @@ Resources:
                       - Effect: "Allow"
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
+                      - Effect: "Allow"
+                        Action: "lambda:GetRuntimeManagementConfig"
+                        Resource: "*"

templates_cspm_eventbridge/FullInstall.yaml

@@ -90,6 +90,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role
     Properties:

templates_cspm_eventbridge/OrgFullInstall.yaml

@@ -134,6 +134,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role
     Properties:
@@ -247,6 +250,9 @@ Resources:
                       - Effect: "Allow"
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
+                      - Effect: "Allow"
+                        Action: "lambda:GetRuntimeManagementConfig"
+                        Resource: "*"
           EventBridgeRole:
             Type: AWS::IAM::Role
             Properties: