Skip to content

Commit f3fd29d

Browse files
matteopasamatteopasa
committed
update org cspm eb
1 parent 190322f commit f3fd29d

File tree

1 file changed

+138
-78
lines changed

1 file changed

+138
-78
lines changed

‎templates_cspm_eventbridge/OrgFullInstall.yaml‎

Lines changed: 138 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ Metadata:
1111
- EventBridgeRoleName
1212
- ExternalID
1313
- TrustedIdentity
14-
- EventBusARN
14+
- ApiKey
15+
- IngestionUrl
16+
- RateLimit
1517
- Regions
1618
- OrganizationUnitIDs
1719
- EventBridgeState
@@ -25,8 +27,12 @@ Metadata:
2527
default: "External ID (Sysdig use only)"
2628
TrustedIdentity:
2729
default: "Trusted Identity (Sysdig use only)"
28-
EventBusARN:
29-
default: "Target Event Bus (Sysdig use only)"
30+
ApiKey:
31+
default: "API Key (Sysdig use only)"
32+
IngestionUrl:
33+
default: "Endpoint URL (Sysdig use only)"
34+
RateLimit:
35+
default: "Rate Limit (Sysdig use only)"
3036
Regions:
3137
default: "EventBridge Regions (Sysdig use only)"
3238
OrganizationUnitIDs:
@@ -49,9 +55,16 @@ Parameters:
4955
TrustedIdentity:
5056
Type: String
5157
Description: The Role in Sysdig's AWS Account with permissions to your account
52-
EventBusARN:
58+
ApiKey:
5359
Type: String
54-
Description: The destination in Sysdig's AWS account where your events are sent
60+
Description: API key for Sysdig Secure authentication
61+
IngestionUrl:
62+
Type: String
63+
Description: Sysdig Secure API endpoint URL
64+
RateLimit:
65+
Type: Number
66+
Description: Maximum invocations per second for the API destination
67+
Default: 300
5568
Regions:
5669
Type: String
5770
Description: Comma separated list of regions to monitor with EventBridge
@@ -192,15 +205,25 @@ Resources:
192205
PolicyDocument:
193206
Version: "2012-10-17"
194207
Statement:
195-
- Effect: Allow
196-
Action: 'events:PutEvents'
197-
Resource: !Sub ${EventBusARN}
198-
- Effect: Allow
208+
- Sid: "InvokeApiDestination"
209+
Effect: Allow
210+
Action:
211+
- "events:InvokeApiDestination"
212+
Resource:
213+
- !Sub "arn:aws:events:*:*:api-destination/${EventBridgeRoleName}-destination/*"
214+
- Sid: "CloudTrailEventRuleAccess"
215+
Effect: Allow
199216
Action:
200217
- "events:DescribeRule"
201218
- "events:ListTargetsByRule"
202219
Resource:
203-
- !Sub arn:aws:events:*:*:rule/${EventBridgeRoleName}
220+
- !Sub "arn:aws:events:*:*:rule/${EventBridgeRoleName}"
221+
- Sid: "ValidationAccess"
222+
Effect: Allow
223+
Action:
224+
- "events:DescribeApiDestination"
225+
- "events:DescribeConnection"
226+
Resource: "*"
204227
RolesStackSet:
205228
Type: AWS::CloudFormation::StackSet
206229
Properties:
@@ -317,15 +340,25 @@ Resources:
317340
PolicyDocument:
318341
Version: "2012-10-17"
319342
Statement:
320-
- Effect: Allow
321-
Action: 'events:PutEvents'
322-
Resource: !Sub ${EventBusARN}
323-
- Effect: Allow
343+
- Sid: "InvokeApiDestination"
344+
Effect: Allow
345+
Action:
346+
- "events:InvokeApiDestination"
347+
Resource:
348+
- !Sub "arn:aws:events:*:*:api-destination/${EventBridgeRoleName}-destination/*"
349+
- Sid: "CloudTrailEventRuleAccess"
350+
Effect: Allow
324351
Action:
325352
- "events:DescribeRule"
326353
- "events:ListTargetsByRule"
327354
Resource:
328-
- !Sub arn:aws:events:*:*:rule/${EventBridgeRoleName}
355+
- !Sub "arn:aws:events:*:*:rule/${EventBridgeRoleName}"
356+
- Sid: "ValidationAccess"
357+
Effect: Allow
358+
Action:
359+
- "events:DescribeApiDestination"
360+
- "events:DescribeConnection"
361+
Resource: "*"
329362
EBRuleStackSet:
330363
Type: AWS::CloudFormation::StackSet
331364
Properties:
@@ -346,58 +379,76 @@ Resources:
346379
Parameters:
347380
- ParameterKey: EventBridgeRoleName
348381
ParameterValue: !Ref EventBridgeRoleName
349-
- ParameterKey: EventBusARN
350-
ParameterValue: !Ref EventBusARN
382+
- ParameterKey: ApiKey
383+
ParameterValue: !Ref ApiKey
384+
- ParameterKey: IngestionUrl
385+
ParameterValue: !Ref IngestionUrl
386+
- ParameterKey: RateLimit
387+
ParameterValue: !Ref RateLimit
351388
- ParameterKey: EventBridgeState
352389
ParameterValue: !Ref EventBridgeState
390+
- ParameterKey: EventBridgeEventPattern
391+
ParameterValue: !Ref EventBridgeEventPattern
353392
StackInstancesGroup:
354393
- DeploymentTargets:
355394
OrganizationalUnitIds: !Split [ ",", !Ref OrganizationUnitIDs]
356395
Regions: !Split [ ",", !Ref Regions]
357396
TemplateBody: |
358397
AWSTemplateFormatVersion: "2010-09-09"
359-
Description: EventBridge Resources that forward CloudTrail logs to Sysdig Secure
398+
Description: EventBridge Resources with API Destinations that forward CloudTrail logs to Sysdig Secure
360399
Parameters:
361400
EventBridgeRoleName:
362401
Type: String
363402
Description: A unique identifier used to create an IAM Role and EventBridge Rule
364-
EventBusARN:
403+
ApiKey:
404+
Type: String
405+
Description: API key for Sysdig Secure authentication
406+
IngestionUrl:
365407
Type: String
366-
Description: The destination in Sysdig's AWS account where your events are sent
408+
Description: Sysdig Secure API endpoint URL
409+
RateLimit:
410+
Type: Number
411+
Description: Maximum invocations per second for the API destination
367412
EventBridgeState:
368413
Type: String
369414
Description: The state of the EventBridge Rule
370-
Default: ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS
415+
Default: ENABLED
371416
AllowedValues:
372-
- ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS
373417
- ENABLED
374-
- DISABLED
375-
Resources:
418+
- DISABLED
419+
EventBridgeEventPattern:
420+
Type: String
421+
Description: JSON pattern for the EventBridge rule's event pattern
422+
Resources:
423+
EventBridgeConnection:
424+
Type: AWS::Events::Connection
425+
Properties:
426+
Name: !Sub ${EventBridgeRoleName}-connection
427+
AuthorizationType: API_KEY
428+
AuthParameters:
429+
ApiKeyAuthParameters:
430+
ApiKeyName: X-Api-Key
431+
ApiKeyValue: !Ref ApiKey
432+
433+
EventBridgeApiDestination:
434+
Type: AWS::Events::ApiDestination
435+
Properties:
436+
Name: !Sub ${EventBridgeRoleName}-destination
437+
ConnectionArn: !GetAtt EventBridgeConnection.Arn
438+
InvocationEndpoint: !Ref IngestionUrl
439+
HttpMethod: POST
440+
InvocationRateLimitPerSecond: !Ref RateLimit
441+
376442
EventBridgeRule:
377-
Type: "AWS::Events::Rule"
443+
Type: AWS::Events::Rule
378444
Properties:
379-
Name: !Sub ${EventBridgeRoleName}
380-
Description: Capture all CloudTrail events
381-
EventPattern:
382-
detail-type:
383-
- 'AWS API Call via CloudTrail'
384-
- 'AWS Console Sign In via CloudTrail'
385-
- 'AWS Service Event via CloudTrail'
386-
- 'Object Access Tier Changed'
387-
- 'Object ACL Updated'
388-
- 'Object Created'
389-
- 'Object Deleted'
390-
- 'Object Restore Completed'
391-
- 'Object Restore Expired'
392-
- 'Object Restore Initiated'
393-
- 'Object Storage Class Changed'
394-
- 'Object Tags Added'
395-
- 'Object Tags Deleted'
396-
- 'GuardDuty Finding'
397-
State: !Sub ${EventBridgeState}
445+
Name: !Ref EventBridgeRoleName
446+
Description: Capture all CloudTrail events for Sysdig Secure
447+
EventPattern: !Ref EventBridgeEventPattern
448+
State: !Ref EventBridgeState
398449
Targets:
399-
- Id: !Sub ${EventBridgeRoleName}
400-
Arn: !Sub ${EventBusARN}
450+
- Id: !Ref EventBridgeRoleName
451+
Arn: !GetAtt EventBridgeApiDestination.Arn
401452
RoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/${EventBridgeRoleName}"
402453
MgmtAccEBRuleStackSet:
403454
Type: AWS::CloudFormation::StackSet
@@ -425,16 +476,20 @@ Resources:
425476
Parameters:
426477
- ParameterKey: EventBridgeRoleName
427478
ParameterValue: !Ref EventBridgeRoleName
428-
- ParameterKey: EventBusARN
429-
ParameterValue: !Ref EventBusARN
479+
- ParameterKey: ApiKey
480+
ParameterValue: !Ref ApiKey
481+
- ParameterKey: IngestionUrl
482+
ParameterValue: !Ref IngestionUrl
483+
- ParameterKey: RateLimit
484+
ParameterValue: !Ref RateLimit
430485
- ParameterKey: EventBridgeState
431486
ParameterValue: !Ref EventBridgeState
432487
- ParameterKey: EventBridgeEventPattern
433-
ParameterValue: !Ref EventBridgeEventPattern
488+
ParameterValue: !Ref EventBridgeEventPattern
434489
StackInstancesGroup:
435490
- DeploymentTargets:
436-
Accounts:
437-
- !Ref AWS::AccountId
491+
Accounts:
492+
- !Ref AWS::AccountId
438493
Regions: !Split [ ",", !Ref Regions]
439494
TemplateBody: |
440495
AWSTemplateFormatVersion: "2010-09-09"
@@ -443,48 +498,53 @@ Resources:
443498
EventBridgeRoleName:
444499
Type: String
445500
Description: A unique identifier used to create an IAM Role and EventBridge Rule
446-
EventBusARN:
501+
ApiKey:
502+
Type: String
503+
Description: API key for authentication
504+
IngestionUrl:
447505
Type: String
448-
Description: The destination in Sysdig's AWS account where your events are sent
506+
Description: Target endpoint URL for the API destination
507+
RateLimit:
508+
Type: Number
509+
Description: Maximum invocations per second for the API destination
449510
EventBridgeState:
450511
Type: String
451512
Description: The state of the EventBridge Rule
452-
Default: ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS
513+
Default: ENABLED
453514
AllowedValues:
454-
- ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS
455515
- ENABLED
456516
- DISABLED
457517
EventBridgeEventPattern:
458518
Type: String
459519
Description: JSON pattern for the EventBridge rule's event pattern
460-
Default: |
461-
{
462-
"detail-type": [
463-
"AWS API Call via CloudTrail",
464-
"AWS Console Sign In via CloudTrail",
465-
"AWS Service Event via CloudTrail",
466-
"Object Access Tier Changed",
467-
"Object ACL Updated",
468-
"Object Created",
469-
"Object Deleted",
470-
"Object Restore Completed",
471-
"Object Restore Expired",
472-
"Object Restore Initiated",
473-
"Object Storage Class Changed",
474-
"Object Tags Added",
475-
"Object Tags Deleted",
476-
"GuardDuty Finding"
477-
]
478-
}
479-
Resources:
520+
Resources:
521+
EventBridgeConnection:
522+
Type: AWS::Events::Connection
523+
Properties:
524+
Name: !Sub ${EventBridgeRoleName}-connection
525+
AuthorizationType: API_KEY
526+
AuthParameters:
527+
ApiKeyAuthParameters:
528+
ApiKeyName: X-Api-Key
529+
ApiKeyValue: !Ref ApiKey
530+
531+
EventBridgeApiDestination:
532+
Type: AWS::Events::ApiDestination
533+
Properties:
534+
Name: !Sub ${EventBridgeRoleName}-destination
535+
ConnectionArn: !GetAtt EventBridgeConnection.Arn
536+
InvocationEndpoint: !Ref IngestionUrl
537+
HttpMethod: POST
538+
InvocationRateLimitPerSecond: !Ref RateLimit
539+
480540
EventBridgeRule:
481-
Type: "AWS::Events::Rule"
541+
Type: AWS::Events::Rule
482542
Properties:
483543
Name: !Sub ${EventBridgeRoleName}
484544
Description: Capture all CloudTrail events
485545
EventPattern: !Ref EventBridgeEventPattern
486-
State: !Sub ${EventBridgeState}
546+
State: !Ref EventBridgeState
487547
Targets:
488548
- Id: !Sub ${EventBridgeRoleName}
489-
Arn: !Sub ${EventBusARN}
549+
Arn: !GetAtt EventBridgeApiDestination.Arn
490550
RoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/${EventBridgeRoleName}"

0 commit comments

Comments
 (0)