Skip to content

Commit d54ef50

Browse files
cgeerscgeers
committed
feat(volume_access): regional roles
1 parent d344336 commit d54ef50

File tree

3 files changed

+106
-139
lines changed

3 files changed

+106
-139
lines changed

‎modules/Makefile‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,8 @@ lint:
2626
yq '.Resources.EventBridgeRuleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
2727
yq '.Resources.OrganizationRoleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
2828
yq '.Resources.OrganizationRuleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
29-
yq '.Resources.ScanningKmsKeyStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
30-
yq '.Resources.OrganizationRoleStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
31-
yq '.Resources.OrganizationKMSKeyStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
29+
yq '.Resources.AccountStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
30+
yq '.Resources.OrganizationStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
3231

3332
publish:
3433
aws s3 cp foundational.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/foundational.cft.yaml

‎modules/volume_access.cft.yaml‎

Lines changed: 102 additions & 135 deletions
Original file line numberDiff line numberDiff line change
@@ -66,88 +66,7 @@ Conditions:
6666
- Ref: IsOrganizational
6767
- 'true'
6868

69-
Resources:
70-
ScanningRole:
71-
Type: AWS::IAM::Role
72-
Properties:
73-
RoleName: !Sub sysdig-secure-scanning-${NameSuffix}
74-
AssumeRolePolicyDocument:
75-
Version: "2012-10-17"
76-
Statement:
77-
- Effect: "Allow"
78-
Principal:
79-
AWS: !Ref TrustedIdentity
80-
Action: "sts:AssumeRole"
81-
Condition:
82-
StringEquals:
83-
sts:ExternalId: !Ref ExternalID
84-
Policies:
85-
- PolicyName: !Sub sysdig-secure-scanning-${NameSuffix}
86-
PolicyDocument:
87-
Version: "2012-10-17"
88-
Statement:
89-
- Sid: "Read"
90-
Effect: "Allow"
91-
Action:
92-
- "ec2:Describe*"
93-
Resource: "*"
94-
- Sid: "AllowKMSKeysListing"
95-
Effect: "Allow"
96-
Action:
97-
- "kms:ListKeys"
98-
- "kms:ListAliases"
99-
- "kms:ListResourceTags"
100-
Resource: "*"
101-
- Sid: "AllowKMSEncryptDecrypt"
102-
Effect: "Allow"
103-
Action:
104-
- "kms:DescribeKey"
105-
- "kms:Encrypt"
106-
- "kms:Decrypt"
107-
- "kms:ReEncrypt*"
108-
- "kms:GenerateDataKey*"
109-
- "kms:CreateGrant"
110-
Resource: "*"
111-
Condition:
112-
StringLike:
113-
"kms:ViaService": "ec2.*.amazonaws.com"
114-
- Sid: "CreateTaggedSnapshotFromVolume"
115-
Effect: "Allow"
116-
Action:
117-
- "ec2:CreateSnapshot"
118-
Resource: "*"
119-
- Sid: "CopySnapshots"
120-
Effect: "Allow"
121-
Action:
122-
- "ec2:CopySnapshot"
123-
Resource: "*"
124-
- Sid: "SnapshotTags"
125-
Effect: "Allow"
126-
Action:
127-
- "ec2:CreateTags"
128-
Resource: "*"
129-
Condition:
130-
StringEquals:
131-
"ec2:CreateAction": ["CreateSnapshot", "CopySnapshot"]
132-
"aws:RequestTag/CreatedBy": "Sysdig"
133-
- Sid: "ec2SnapshotShare"
134-
Effect: "Allow"
135-
Action:
136-
- "ec2:ModifySnapshotAttribute"
137-
Resource: "*"
138-
Condition:
139-
StringEqualsIgnoreCase:
140-
"aws:ResourceTag/CreatedBy": "Sysdig"
141-
StringEquals:
142-
"ec2:Add/userId": !Ref ScanningAccountID
143-
- Sid: "ec2SnapshotDelete"
144-
Effect: "Allow"
145-
Action:
146-
- "ec2:DeleteSnapshot"
147-
Resource: "*"
148-
Condition:
149-
StringEqualsIgnoreCase:
150-
"aws:ResourceTag/CreatedBy": "Sysdig"
69+
Resources:
15170
AdministrationRole:
15271
Type: AWS::IAM::Role
15372
Properties:
@@ -186,10 +105,10 @@ Resources:
186105
ManagedPolicyArns:
187106
- arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser
188107
- arn:aws:iam::aws:policy/AWSCloudFormationFullAccess
189-
ScanningKmsKeyStackSet:
108+
AccountStackSet:
190109
Type: AWS::CloudFormation::StackSet
191110
Properties:
192-
StackSetName: !Sub sysdig-secure-scanning-kms-${NameSuffix}
111+
StackSetName: !Sub sysdig-secure-scanning-account-${NameSuffix}
193112
Description: "A CloudFormation template that creates a KMS key in the account where it is launched, and grants permissions to the specified IAM role"
194113
AdministrationRoleARN: !GetAtt AdministrationRole.Arn
195114
ExecutionRoleName: !Ref ExecutionRole
@@ -208,6 +127,10 @@ Resources:
208127
ParameterValue: !Ref NameSuffix
209128
- ParameterKey: ScanningAccountID
210129
ParameterValue: !Ref ScanningAccountID
130+
- ParameterKey: TrustedIdentity
131+
ParameterValue: !Ref TrustedIdentity
132+
- ParameterKey: ExternalID
133+
ParameterValue: !Ref ExternalID
211134
StackInstancesGroup:
212135
- DeploymentTargets:
213136
Accounts:
@@ -226,7 +149,94 @@ Resources:
226149
ScanningAccountID:
227150
Type: String
228151
Description: The AWS Account ID of the Sysdig Scanning Account
152+
TrustedIdentity:
153+
Type: String
154+
Description: The Role in Sysdig's AWS Account with permissions to your account
155+
ExternalID:
156+
Type: String
157+
Description: Sysdig assigned token that proves you own this account
229158
Resources:
159+
ScanningRole:
160+
Type: AWS::IAM::Role
161+
Properties:
162+
RoleName: !Sub sysdig-secure-scanning-${NameSuffix}-${AWS::Region}
163+
AssumeRolePolicyDocument:
164+
Version: "2012-10-17"
165+
Statement:
166+
- Effect: "Allow"
167+
Principal:
168+
AWS: !Ref TrustedIdentity
169+
Action: "sts:AssumeRole"
170+
Condition:
171+
StringEquals:
172+
sts:ExternalId: !Ref ExternalID
173+
Policies:
174+
- PolicyName: !Sub sysdig-secure-scanning-${NameSuffix}
175+
PolicyDocument:
176+
Version: "2012-10-17"
177+
Statement:
178+
- Sid: "Read"
179+
Effect: "Allow"
180+
Action:
181+
- "ec2:Describe*"
182+
Resource: "*"
183+
- Sid: "AllowKMSKeysListing"
184+
Effect: "Allow"
185+
Action:
186+
- "kms:ListKeys"
187+
- "kms:ListAliases"
188+
- "kms:ListResourceTags"
189+
Resource: "*"
190+
- Sid: "AllowKMSEncryptDecrypt"
191+
Effect: "Allow"
192+
Action:
193+
- "kms:DescribeKey"
194+
- "kms:Encrypt"
195+
- "kms:Decrypt"
196+
- "kms:ReEncrypt*"
197+
- "kms:GenerateDataKey*"
198+
- "kms:CreateGrant"
199+
Resource: "*"
200+
Condition:
201+
StringLike:
202+
"kms:ViaService": "ec2.*.amazonaws.com"
203+
- Sid: "CreateTaggedSnapshotFromVolume"
204+
Effect: "Allow"
205+
Action:
206+
- "ec2:CreateSnapshot"
207+
Resource: "*"
208+
- Sid: "CopySnapshots"
209+
Effect: "Allow"
210+
Action:
211+
- "ec2:CopySnapshot"
212+
Resource: "*"
213+
- Sid: "SnapshotTags"
214+
Effect: "Allow"
215+
Action:
216+
- "ec2:CreateTags"
217+
Resource: "*"
218+
Condition:
219+
StringEquals:
220+
"ec2:CreateAction": ["CreateSnapshot", "CopySnapshot"]
221+
"aws:RequestTag/CreatedBy": "Sysdig"
222+
- Sid: "ec2SnapshotShare"
223+
Effect: "Allow"
224+
Action:
225+
- "ec2:ModifySnapshotAttribute"
226+
Resource: "*"
227+
Condition:
228+
StringEqualsIgnoreCase:
229+
"aws:ResourceTag/CreatedBy": "Sysdig"
230+
StringEquals:
231+
"ec2:Add/userId": !Ref ScanningAccountID
232+
- Sid: "ec2SnapshotDelete"
233+
Effect: "Allow"
234+
Action:
235+
- "ec2:DeleteSnapshot"
236+
Resource: "*"
237+
Condition:
238+
StringEqualsIgnoreCase:
239+
"aws:ResourceTag/CreatedBy": "Sysdig"
230240
ScanningKmsKey:
231241
Type: 'AWS::KMS::Key'
232242
Properties:
@@ -242,7 +252,7 @@ Resources:
242252
Principal:
243253
AWS:
244254
- !Sub arn:aws:iam::${ScanningAccountID}:root
245-
- !Sub arn:aws:iam::${AWS::AccountId}:role/sysdig-secure-scanning-${NameSuffix}
255+
- !GetAtt ScanningRole.Arn
246256
Action:
247257
- "kms:Encrypt"
248258
- "kms:Decrypt"
@@ -265,12 +275,12 @@ Resources:
265275
Properties:
266276
AliasName: !Sub alias/sysdig-secure-scanning-${NameSuffix}
267277
TargetKeyId: !Ref ScanningKmsKey
268-
OrganizationRoleStackSet:
278+
OrganizationStackSet:
269279
Type: AWS::CloudFormation::StackSet
270280
Condition: IsOrganizational
271281
Properties:
272-
StackSetName: !Sub sysdig-secure-scanning-organization-roles-${NameSuffix}
273-
Description: IAM Role used to create IAM roles scan organization accounts/regions
282+
StackSetName: !Sub sysdig-secure-scanning-organization-${NameSuffix}
283+
Description: Installs KMS key, alias, and IAM role for use with Sysdig Agentless Scanning
274284
PermissionModel: SERVICE_MANAGED
275285
Capabilities:
276286
- "CAPABILITY_NAMED_IAM"
@@ -283,6 +293,7 @@ Resources:
283293
MaxConcurrentPercentage: 100
284294
FailureTolerancePercentage: 90
285295
ConcurrencyMode: SOFT_FAILURE_TOLERANCE
296+
RegionConcurrencyType: PARALLEL
286297
Parameters:
287298
- ParameterKey: NameSuffix
288299
ParameterValue: !Ref NameSuffix
@@ -295,7 +306,7 @@ Resources:
295306
StackInstancesGroup:
296307
- DeploymentTargets:
297308
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
298-
Regions: [!Ref "AWS::Region"]
309+
Regions: !Ref Regions
299310
TemplateBody: |
300311
AWSTemplateFormatVersion: "2010-09-09"
301312
Description: IAM Role used by Sysdig Secure Vulnerability Scanning
@@ -319,7 +330,7 @@ Resources:
319330
ScanningRole:
320331
Type: AWS::IAM::Role
321332
Properties:
322-
RoleName: !Sub sysdig-secure-scanning-${NameSuffix}
333+
RoleName: !Sub sysdig-secure-scanning-${NameSuffix}-${AWS::Region}
323334
AssumeRolePolicyDocument:
324335
Version: "2012-10-17"
325336
Statement:
@@ -397,50 +408,6 @@ Resources:
397408
Condition:
398409
StringEqualsIgnoreCase:
399410
"aws:ResourceTag/CreatedBy": "Sysdig"
400-
OrganizationKMSKeyStackSet:
401-
Type: AWS::CloudFormation::StackSet
402-
Condition: IsOrganizational
403-
DependsOn:
404-
- OrganizationRoleStackSet
405-
Properties:
406-
StackSetName: !Sub sysdig-secure-scanning-organization-kmskey-${NameSuffix}
407-
Description: IAM Role used to create KMS Keys to scan organization accounts/regions
408-
PermissionModel: SERVICE_MANAGED
409-
Capabilities:
410-
- "CAPABILITY_NAMED_IAM"
411-
AutoDeployment:
412-
Enabled: true
413-
RetainStacksOnAccountRemoval: false
414-
ManagedExecution:
415-
Active: true
416-
OperationPreferences:
417-
MaxConcurrentPercentage: 100
418-
FailureTolerancePercentage: 90
419-
ConcurrencyMode: SOFT_FAILURE_TOLERANCE
420-
RegionConcurrencyType: PARALLEL
421-
Parameters:
422-
- ParameterKey: NameSuffix
423-
ParameterValue: !Ref NameSuffix
424-
- ParameterKey: ScanningAccountID
425-
ParameterValue: !Ref ScanningAccountID
426-
StackInstancesGroup:
427-
- DeploymentTargets:
428-
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
429-
Regions: !Ref Regions
430-
TemplateBody: |
431-
AWSTemplateFormatVersion: "2010-09-09"
432-
Description: "Template to create KMS Key and Alias for Sysdig Agentless Scanning"
433-
Parameters:
434-
NameSuffix:
435-
Type: String
436-
Description: Suffix to append to the resource name identifiers
437-
AllowedPattern: '[0-9a-z]+'
438-
MaxLength: 8
439-
MinLength: 4
440-
ScanningAccountID:
441-
Type: String
442-
Description: The AWS Account ID of the Sysdig Scanning Account
443-
Resources:
444411
ScanningKmsKey:
445412
Type: 'AWS::KMS::Key'
446413
Properties:
@@ -456,7 +423,7 @@ Resources:
456423
Principal:
457424
AWS:
458425
- !Sub arn:aws:iam::${ScanningAccountID}:root
459-
- !Sub arn:aws:iam::${AWS::AccountId}:role/sysdig-secure-scanning-${NameSuffix}
426+
- !GetAtt ScanningRole.Arn
460427
Action:
461428
- "kms:Encrypt"
462429
- "kms:Decrypt"

‎modules/volume_access.components.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,8 @@
66
"aws": {
77
"roleName": "sysdig-secure-scanning-{{NameSuffix}}"
88
}
9-
}
9+
},
10+
"version": "v0.2.0"
1011
},
1112
{
1213
"type": "COMPONENT_CRYPTO_KEY",

0 commit comments

Comments
 (0)