Skip to content

feat(modules): Support for include/exclude parameters #145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 15 commits into from
Apr 7, 2025
Merged

feat(modules): Support for include/exclude parameters #145

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
1634d1e
feat(modules): Support for include/exclude parameters
ravinadhruve10 Feb 24, 2025
2285bce
Honor include/exclude params in deployment targets
ravinadhruve10 Mar 28, 2025
2055672
Update cfn-lint version
ravinadhruve10 Mar 28, 2025
8025f50
Test without cfn-lint version
ravinadhruve10 Mar 28, 2025
727bc46
Temp remove to avoid lint checks
ravinadhruve10 Mar 28, 2025
af308bf
Add back the commented lines
ravinadhruve10 Mar 28, 2025
d8cc60c
Fix version command for GHA
ravinadhruve10 Mar 28, 2025
11d86a0
Fix length function
ravinadhruve10 Mar 28, 2025
90377bf
Get rid of extensions
ravinadhruve10 Mar 28, 2025
63f097d
Lint fixes
ravinadhruve10 Mar 28, 2025
3f4aa80
Update all templates
ravinadhruve10 Mar 29, 2025
ca4ce17
Remove PARAM_EXCLUDE_OU_IDS since its a NOOP
ravinadhruve10 Apr 3, 2025
46f9e28
Support migration by always checking OrganizationalUnitIDs first
ravinadhruve10 Apr 4, 2025
6e70dfe
Update modules README
ravinadhruve10 Apr 7, 2025
49c2728
Fix typo
ravinadhruve10 Apr 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci-modules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ jobs:
- name: cfn-lint
uses: scottbrenner/cfn-lint-action@v2
with:
version: 1.18.3
version: "==1.18.3"

- name: Lint
working-directory: modules
Expand Down
30 changes: 25 additions & 5 deletions modules/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,11 @@ deploy:
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
"Partition=${PARAM_PARTITION}"
"Partition=${PARAM_PARTITION}" \
"RootOUID=$(PARAM_ROOT_OU_ID)" \
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
aws cloudformation deploy \
--stack-name $(STACK_NAME)-LogIngestion-EventBridge-$(PARAM_NAME_SUFFIX) \
--template-file log_ingestion.events.cft.yaml \
Expand All @@ -63,7 +67,11 @@ deploy:
"TargetEventBusARN=$(PARAM_TARGET_EVENT_BUS_ARN)" \
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
"Partition=${PARAM_PARTITION}"
"Partition=${PARAM_PARTITION}" \
"RootOUID=$(PARAM_ROOT_OU_ID)" \
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
aws cloudformation deploy \
--stack-name $(STACK_NAME)-LogIngestion-S3-$(PARAM_NAME_SUFFIX) \
--template-file log_ingestion.s3.cft.yaml \
Expand All @@ -74,7 +82,11 @@ deploy:
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
"BucketARN=$(PARAM_BUCKET_ARN)" \
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
"RootOUID=$(PARAM_ROOT_OU_ID)" \
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"
aws cloudformation deploy \
--stack-name $(STACK_NAME)-VolumeAccess-$(PARAM_NAME_SUFFIX) \
--template-file volume_access.cft.yaml \
Expand All @@ -85,7 +97,11 @@ deploy:
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
"Regions=$(PARAM_REGIONS)" \
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
"RootOUID=$(PARAM_ROOT_OU_ID)" \
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"

aws cloudformation deploy \
--stack-name $(STACK_NAME)-VMWorkloadScanning-$(PARAM_NAME_SUFFIX) \
Expand All @@ -97,7 +113,11 @@ deploy:
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
"LambdaScanningEnabled"=$(PARAM_LAMBDA_SCANNING_ENABLED) \
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)" \
"RootOUID=$(PARAM_ROOT_OU_ID)" \
"IncludeOUIDs=$(PARAM_INCLUDE_OU_IDS)" \
"IncludeAccounts=$(PARAM_INCLUDE_ACCOUNTS)" \
"ExcludeAccounts=$(PARAM_EXCLUDE_ACCOUNTS)"

clean:
aws cloudformation delete-stack --stack-name $(STACK_NAME)-Foundational-$(PARAM_NAME_SUFFIX)
Expand Down
103 changes: 100 additions & 3 deletions modules/foundational.cft.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,10 @@ Metadata:
- IsOrganizational
- OrganizationalUnitIDs
- Partition
- RootOUID
- IncludeOUIDs
- IncludeAccounts
- ExcludeAccounts
ParameterLabels:
NameSuffix:
default: Name Suffix
Expand All @@ -22,9 +26,17 @@ Metadata:
IsOrganizational:
default: Is Organizational
OrganizationalUnitIDs:
default: Organizational Unit IDs
default: (TO BE DEPRECATED Please work with Sysdig to migrate and use IncludeOUIDs) Organizational Unit IDs
Partition:
default: AWS Partition
RootOUID:
default: Root Organization Unit ID
IncludeOUIDs:
default: Include Organizational Unit IDs
IncludeAccounts:
default: Include AWS accounts
ExcludeAccounts:
default: Exclude AWS accounts
Parameters:
NameSuffix:
Type: String
Expand All @@ -47,16 +59,78 @@ Parameters:
- 'false'
OrganizationalUnitIDs:
Type: CommaDelimitedList
Description: Comma separated list of organizational unit IDs to deploy
Description: (WARNING - TO BE DEPRECATED Please work with Sysdig to migrate your installs to use IncludeOUIDs instead) Comma separated list of organizational unit IDs to deploy
Partition:
Type: String
Description: AWS Partition of your account or organization to create resources in
Default: 'aws'
RootOUID:
Type: CommaDelimitedList
Description: Root Organizational Unit ID of your AWS organization
IncludeOUIDs:
Type: CommaDelimitedList
Description: Comma separated list of organizational unit IDs to be included for deployment
IncludeAccounts:
Type: CommaDelimitedList
Description: Comma separated list of AWS accounts in your organization to be included for deployment
ExcludeAccounts:
Type: CommaDelimitedList
Description: Comma separated list of AWS accounts in your organization to be excluded for deployment
Conditions:
IsOrganizational:
Fn::Equals:
- Ref: IsOrganizational
- 'true'
# First check if old param OrganizationalUnitIDs configured - support till we DEPRECATE it
IsOldOuidConfigured:
!And
- !Condition IsOrganizational
- !Not
- !Equals
- !Join ["", !Ref OrganizationalUnitIDs]
- ''

# Else, check for new Inclusion and Exclusion params
# INCLUSIONS
OUInclusionsConfigured:
!And
- !Condition IsOrganizational
- !Not
- !Equals
- !Join ["", !Ref IncludeOUIDs]
- ''
AccountInclusionsConfigured:
!And
- !Condition IsOrganizational
- !Not
- !Equals
- !Join ["", !Ref IncludeAccounts]
- ''
# -----------------------------------------------------------------------------------------------------
# Remove below condition once AWS issue is fixed and replace with using UNION filter -
# https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-cloudformation/issues/100
# -----------------------------------------------------------------------------------------------------
# XXX: due to AWS bug of not having UNION filter fully working, there is no way to add those extra accounts requested.
# to not miss out on those extra accounts, deploy the cloud resources across entire org and noop the UNION filter.
# i.e till we can't deploy UNION, we deploy it all
AllowedInclusions:
!And
- !Condition OUInclusionsConfigured
- !Not
- !Condition AccountInclusionsConfigured

# EXCLUSIONS
# cannot do OU exclusions from ExcludeOUIDs since CFT templates are static and don't have a way to fetch dynamic data from AWS
AccountExclusionsConfigured:
!And
- !Condition IsOrganizational
- !Equals
- !Join ["", !Ref IncludeAccounts]
- ''
- !Not
- !Equals
- !Join ["", !Ref ExcludeAccounts]
- ''
Resources:
ConfigPostureRole:
Type: AWS::IAM::Role
Expand Down Expand Up @@ -166,7 +240,30 @@ Resources:
Ref: Partition
StackInstancesGroup:
- DeploymentTargets:
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
OrganizationalUnitIds:
Fn::If:
- IsOldOuidConfigured
- !Ref OrganizationalUnitIDs
- Fn::If:
- AllowedInclusions
- !Ref IncludeOUIDs
- !Ref RootOUID
AccountFilterType:
Fn::If:
- IsOldOuidConfigured
- !Ref 'AWS::NoValue'
- Fn::If:
- AccountExclusionsConfigured
- "DIFFERENCE"
- "NONE"
Accounts:
Fn::If:
- IsOldOuidConfigured
- !Ref 'AWS::NoValue'
- Fn::If:
- AccountExclusionsConfigured
- !Ref ExcludeAccounts
- !Ref 'AWS::NoValue'
Regions:
- Ref: AWS::Region
TemplateBody: |
Expand Down
128 changes: 124 additions & 4 deletions modules/log_ingestion.events.cft.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,10 @@ Metadata:
- IsOrganizational
- OrganizationalUnitIDs
- Partition
- RootOUID
- IncludeOUIDs
- IncludeAccounts
- ExcludeAccounts
ParameterLabels:
NameSuffix:
default: Name Suffix
Expand All @@ -37,9 +41,17 @@ Metadata:
IsOrganizational:
default: Is Organizational
OrganizationalUnitIDs:
default: Organizational Unit IDs
default: (TO BE DEPRECATED Please work with Sysdig to migrate and use IncludeOUIDs) Organizational Unit IDs
Partition:
default: AWS Partition
RootOUID:
default: Root Organization Unit ID
IncludeOUIDs:
default: Include Organizational Unit IDs
IncludeAccounts:
default: Include AWS accounts
ExcludeAccounts:
default: Exclude AWS accounts
Parameters:
NameSuffix:
Type: String
Expand All @@ -61,7 +73,7 @@ Parameters:
Description: Comma separated list of regions to monitor with EventBridge
OrganizationalUnitIDs:
Type: CommaDelimitedList
Description: Comma separated list of organizational unit IDs to deploy
Description: (WARNING - TO BE DEPRECATED Please work with Sysdig to migrate your installs to use IncludeOUIDs instead) Comma separated list of organizational unit IDs to deploy
RuleState:
Type: String
Description: The state of the EventBridge Rule
Expand Down Expand Up @@ -103,11 +115,73 @@ Parameters:
Type: String
Description: AWS Partition of your account or organization to create resources in
Default: 'aws'
RootOUID:
Type: CommaDelimitedList
Description: Root Organizational Unit ID of your AWS organization
IncludeOUIDs:
Type: CommaDelimitedList
Description: Comma separated list of organizational unit IDs to be included for deployment
IncludeAccounts:
Type: CommaDelimitedList
Description: Comma separated list of AWS accounts in your organization to be included for deployment
ExcludeAccounts:
Type: CommaDelimitedList
Description: Comma separated list of AWS accounts in your organization to be excluded for deployment
Conditions:
IsOrganizational:
Fn::Equals:
- Ref: IsOrganizational
- 'true'
# First check if old param OrganizationalUnitIDs configured - support till we DEPRECATE it
IsOldOuidConfigured:
!And
- !Condition IsOrganizational
- !Not
- !Equals
- !Join ["", !Ref OrganizationalUnitIDs]
- ''

# Else, check for new Inclusion and Exclusion params
# INCLUSIONS
OUInclusionsConfigured:
!And
- !Condition IsOrganizational
- !Not
- !Equals
- !Join ["", !Ref IncludeOUIDs]
- ''
AccountInclusionsConfigured:
!And
- !Condition IsOrganizational
- !Not
- !Equals
- !Join ["", !Ref IncludeAccounts]
- ''
# -----------------------------------------------------------------------------------------------------
# Remove below condition once AWS issue is fixed and replace with using UNION filter -
# https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-cloudformation/issues/100
# -----------------------------------------------------------------------------------------------------
# XXX: due to AWS bug of not having UNION filter fully working, there is no way to add those extra accounts requested.
# to not miss out on those extra accounts, deploy the cloud resources across entire org and noop the UNION filter.
# i.e till we can't deploy UNION, we deploy it all
AllowedInclusions:
!And
- !Condition OUInclusionsConfigured
- !Not
- !Condition AccountInclusionsConfigured

# EXCLUSIONS
# cannot do OU exclusions from ExcludeOUIDs since CFT templates are static and don't have a way to fetch dynamic data from AWS
AccountExclusionsConfigured:
!And
- !Condition IsOrganizational
- !Equals
- !Join ["", !Ref IncludeAccounts]
- ''
- !Not
- !Equals
- !Join ["", !Ref ExcludeAccounts]
- ''
Resources:
AdministrationRole:
Type: AWS::IAM::Role
Expand Down Expand Up @@ -288,7 +362,30 @@ Resources:
ParameterValue: !Ref Partition
StackInstancesGroup:
- DeploymentTargets:
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
OrganizationalUnitIds:
Fn::If:
- IsOldOuidConfigured
- !Ref OrganizationalUnitIDs
- Fn::If:
- AllowedInclusions
- !Ref IncludeOUIDs
- !Ref RootOUID
AccountFilterType:
Fn::If:
- IsOldOuidConfigured
- !Ref 'AWS::NoValue'
- Fn::If:
- AccountExclusionsConfigured
- "DIFFERENCE"
- "NONE"
Accounts:
Fn::If:
- IsOldOuidConfigured
- !Ref 'AWS::NoValue'
- Fn::If:
- AccountExclusionsConfigured
- !Ref ExcludeAccounts
- !Ref 'AWS::NoValue'
Regions: [!Ref "AWS::Region"]
TemplateBody: |
AWSTemplateFormatVersion: "2010-09-09"
Expand Down Expand Up @@ -376,7 +473,30 @@ Resources:
ParameterValue: !Ref Partition
StackInstancesGroup:
- DeploymentTargets:
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
OrganizationalUnitIds:
Fn::If:
- IsOldOuidConfigured
- !Ref OrganizationalUnitIDs
- Fn::If:
- AllowedInclusions
- !Ref IncludeOUIDs
- !Ref RootOUID
AccountFilterType:
Fn::If:
- IsOldOuidConfigured
- !Ref 'AWS::NoValue'
- Fn::If:
- AccountExclusionsConfigured
- "DIFFERENCE"
- "NONE"
Accounts:
Fn::If:
- IsOldOuidConfigured
- !Ref 'AWS::NoValue'
- Fn::If:
- AccountExclusionsConfigured
- !Ref ExcludeAccounts
- !Ref 'AWS::NoValue'
Regions: !Ref Regions
TemplateBody: |
AWSTemplateFormatVersion: "2010-09-09"
Expand Down
Loading
Loading