Skip to content

Commit f7e7e7e

Browse files
gi-erregi-erre
authored
Revamp cloudformation templates for Cloudlogs module (#106)
1 parent a350829 commit f7e7e7e

File tree

4 files changed

+128
-46
lines changed

4 files changed

+128
-46
lines changed

‎templates_cloudlogs/CloudLogs.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
AWSTemplateFormatVersion: "2010-09-09"
22
Description: >
3-
CloudFormation template for provisioning
3+
CloudFormation single template for provisioning
44
the necessary resources for the `cloud-logs`
55
component.
66

‎templates_cloudlogs/Makefile‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,21 @@ S3_PREFIX ?= "test"
55
# We need the REGION or the TemplateURLs might be created for a different region, resulting in a deployment error
66
S3_REGION ?= "eu-west-1" # ireland
77
SECURE_API_TOKEN ?= ""
8-
STACK_NAME = "CloudLogsTest"
8+
STACK_NAME = "CloudlogsTest"
9+
STACK_NAME_ORG = "OrgCloudlogsTest"
910

1011
.PHONY: packaged-template.yaml
12+
.PHONY: packaged-template-org.yaml
1113

1214
validate:
1315
aws cloudformation validate-template --template-body file://./CloudLogs.yaml
16+
aws cloudformation validate-template --template-body file://./OrgCloudLogs.yaml
1417

1518
lint:
1619
cfn-lint *.yaml
1720

1821
packaged-template.yaml:
19-
aws s3 rm s3://$(S3_BUCKET)/cloudlogs/$(S3_PREFIX) --recursive
22+
aws s3 rm s3://$(S3_BUCKET)/cloudlogs/single/$(S3_PREFIX) --recursive
2023

2124
aws cloudformation package \
2225
--region $(S3_REGION) \
@@ -35,7 +38,31 @@ test: packaged-template.yaml
3538
"SysdigSecureAPIToken=$(SECURE_API_TOKEN)"
3639

3740
ci: packaged-template.yaml
38-
aws s3 cp ./packaged-template.yaml s3://$(S3_BUCKET)/cloudlogs/$(S3_PREFIX)/entry-point.yaml
41+
aws s3 cp ./packaged-template.yaml s3://$(S3_BUCKET)/cloudlogs/single/$(S3_PREFIX)/entry-point.yaml
3942

4043
clean:
4144
aws cloudformation delete-stack --stack-name $(STACK_NAME)
45+
46+
packaged-template-org.yaml:
47+
aws s3 rm s3://$(S3_BUCKET)/cloudlogs/org/$(S3_PREFIX) --recursive
48+
aws cloudformation package \
49+
--region $(S3_REGION) \
50+
--template-file OrgCloudlogs.yaml \
51+
--s3-bucket $(S3_BUCKET) \
52+
--s3-prefix cspm/$(S3_PREFIX) \
53+
--force-upload \
54+
--output-template-file packaged-template-org.yaml
55+
56+
test-org: packaged-template-org.yaml
57+
aws cloudformation deploy \
58+
--stack-name $(STACK_NAME_ORG) \
59+
--template-file packaged-template-org.yaml \
60+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
61+
--parameter-overrides \
62+
"SysdigSecureAPIToken=$(SECURE_API_TOKEN)"
63+
64+
ci-org: packaged-template-org.yaml
65+
aws s3 cp ./packaged-template-org.yaml s3://$(S3_BUCKET)/cloudlogs/org/$(S3_PREFIX)/entry-point.yaml
66+
67+
clean-org:
68+
aws cloudformation delete-stack --stack-name $(STACK_NAME_ORG)

‎templates_cloudlogs/OrgCloudLogs.yaml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
AWSTemplateFormatVersion: "2010-09-09"
2+
Description: >
3+
CloudFormation organizational template for provisioning
4+
the necessary resources for the `cloud-logs`
5+
component and the read-only role required to itneract with
6+
the target organizational environment.
7+
8+
Metadata:
9+
AWS::CloudFormation::Interface:
10+
ParameterGroups:
11+
- Label:
12+
default: "Sysdig Settings (Do not change)"
13+
Parameters:
14+
- CSPMRoleName
15+
- CloudLogsRoleName
16+
- ExternalID
17+
- TrustedIdentity
18+
- BucketARN
19+
20+
ParameterLabels:
21+
CSPMRoleName:
22+
default: "CSPM Role Name (Sysdig use only)"
23+
CloudLogsRoleName:
24+
default: "CloudLogs Role Name (Sysdig use only)"
25+
ExternalID:
26+
default: "External ID (Sysdig use only)"
27+
TrustedIdentity:
28+
default: "Trusted Identity (Sysdig use only)"
29+
BucketARN:
30+
default: "Bucket ARN"
31+
32+
Parameters:
33+
CSPMRoleName:
34+
Type: String
35+
Description: The name of the read-only IAM Role that Sysdig will use to interact with the target environment
36+
CloudLogsRoleName:
37+
Type: String
38+
Description: The name of the IAM Role that will enable access to the Cloudtrail logs.
39+
ExternalID:
40+
Type: String
41+
Description: Random string generated unique to a customer.
42+
TrustedIdentity:
43+
Type: String
44+
Description: The name of Sysdig trusted identity.
45+
BucketARN:
46+
Type: String
47+
Description: The ARN of your s3 bucket associated with your Cloudtrail trail.
48+
49+
Resources:
50+
CloudLogsRole:
51+
Type: "AWS::IAM::Role"
52+
Properties:
53+
RoleName: !Ref CloudLogsRoleName
54+
AssumeRolePolicyDocument:
55+
Version: "2012-10-17"
56+
Statement:
57+
- Effect: "Allow"
58+
Principal:
59+
AWS: !Ref TrustedIdentity
60+
Action:
61+
- "sts:AssumeRole"
62+
Condition:
63+
StringEquals:
64+
"sts:ExternalId": !Ref ExternalID
65+
CloudLogsRolePolicies:
66+
Type: "AWS::IAM::Policy"
67+
Properties:
68+
PolicyName: "CloudlogsS3Access"
69+
PolicyDocument:
70+
Version: "2012-10-17"
71+
Statement:
72+
- Sid: "CloudlogsS3Access"
73+
Effect: "Allow"
74+
Action:
75+
- "s3:Get*"
76+
- "s3:List*"
77+
Resource:
78+
- !Sub '${BucketARN}'
79+
- !Sub '${BucketARN}/*'
80+
Roles:
81+
- Ref: "CloudLogsRole"
82+
CloudAgentlessRole:
83+
Type: "AWS::IAM::Role"
84+
Properties:
85+
RoleName: !Ref CSPMRoleName
86+
AssumeRolePolicyDocument:
87+
Version: "2012-10-17"
88+
Statement:
89+
- Effect: "Allow"
90+
Principal:
91+
AWS: !Ref TrustedIdentity
92+
Action: "sts:AssumeRole"
93+
Condition:
94+
StringEquals:
95+
sts:ExternalId: !Ref ExternalID
96+
ManagedPolicyArns:
97+
- arn:aws:iam::aws:policy/SecurityAudit

‎templates_cspm_cloudlogs/OrgFullInstall.yaml‎

Lines changed: 0 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -112,14 +112,10 @@ Resources:
112112
Parameters:
113113
- ParameterKey: CSPMRoleName
114114
ParameterValue: !Ref CSPMRoleName
115-
- ParameterKey: CloudLogsRoleName
116-
ParameterValue: !Ref CloudLogsRoleName
117115
- ParameterKey: TrustedIdentity
118116
ParameterValue: !Ref TrustedIdentity
119117
- ParameterKey: ExternalID
120118
ParameterValue: !Ref ExternalID
121-
- ParameterKey: BucketARN
122-
ParameterValue: !Ref BucketARN
123119
StackInstancesGroup:
124120
- DeploymentTargets:
125121
OrganizationalUnitIds: !Split [ ",", !Ref OrganizationUnitIDs]
@@ -131,15 +127,9 @@ Resources:
131127
CSPMRoleName:
132128
Type: String
133129
Description: A unique identifier used to create an IAM Role
134-
CloudLogsRoleName:
135-
Type: String
136-
Description: The name of the IAM Role that will enable access to the Cloudtrail logs.
137130
TrustedIdentity:
138131
Type: String
139132
Description: The Role in Sysdig's AWS Account with permissions to your account
140-
BucketARN:
141-
Type: String
142-
Description: The ARN of your s3 bucket associated with your Cloudtrail trail.
143133
ExternalID:
144134
Type: String
145135
Description: Sysdig ExternalID required for the policy creation
@@ -160,35 +150,3 @@ Resources:
160150
sts:ExternalId: !Sub ${ExternalID}
161151
ManagedPolicyArns:
162152
- arn:aws:iam::aws:policy/SecurityAudit
163-
CloudLogsRole:
164-
Type: "AWS::IAM::Role"
165-
Properties:
166-
RoleName: !Ref CloudLogsRoleName
167-
AssumeRolePolicyDocument:
168-
Version: "2012-10-17"
169-
Statement:
170-
- Effect: "Allow"
171-
Principal:
172-
AWS: !Ref TrustedIdentity
173-
Action:
174-
- "sts:AssumeRole"
175-
Condition:
176-
StringEquals:
177-
"sts:ExternalId": !Ref ExternalID
178-
CloudLogsRolePolicies:
179-
Type: "AWS::IAM::Policy"
180-
Properties:
181-
PolicyName: "CloudlogsS3Access"
182-
PolicyDocument:
183-
Version: "2012-10-17"
184-
Statement:
185-
- Sid: "CloudlogsS3Access"
186-
Effect: "Allow"
187-
Action:
188-
- "s3:Get*"
189-
- "s3:List*"
190-
Resource:
191-
- !Sub '${BucketARN}'
192-
- !Sub '${BucketARN}/*'
193-
Roles:
194-
- Ref: "CloudLogsRole"

0 commit comments

Comments
 (0)