Update permissions in AWS trust-relationship CFT templates (#117)

* Remove unnecessary permission in AWS trust-relationship CFT templates Removing account:GetContactInformation since it is no longer a required permission for the CSPM feature to work. * Add macie2:ListClassificationJobs permission
sysdiglabs · Mar 11, 2024 · 20f2d71 · 20f2d71
1 parent e3afb31
commit 20f2d71
Show file tree

Hide file tree

Showing 6 changed files with 9 additions and 9 deletions.
diff --git a/templates_cspm/CloudAgentlessRole.yaml b/templates_cspm/CloudAgentlessRole.yaml
@@ -63,7 +63,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
 
 Outputs:

diff --git a/templates_cspm/OrgCloudAgentlessRole.yaml b/templates_cspm/OrgCloudAgentlessRole.yaml
@@ -65,7 +65,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
   RoleStackSet:
     Type: AWS::CloudFormation::StackSet
@@ -136,5 +136,5 @@ Resources:
                           - "arn:aws:waf-regional:*:*:rule/*"
                           - "arn:aws:waf-regional:*:*:rulegroup/*"
                       - Effect: "Allow"
-                        Action: "account:GetContactInformation"
+                        Action: "macie2:ListClassificationJobs"
                         Resource: "*"
diff --git a/templates_cspm_cloudlogs/FullInstall.yaml b/templates_cspm_cloudlogs/FullInstall.yaml
@@ -76,7 +76,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"

diff --git a/templates_cspm_cloudlogs/OrgFullInstall.yaml b/templates_cspm_cloudlogs/OrgFullInstall.yaml
@@ -81,7 +81,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"
@@ -190,5 +190,5 @@ Resources:
                           - "arn:aws:waf-regional:*:*:rule/*"
                           - "arn:aws:waf-regional:*:*:rulegroup/*"
                       - Effect: "Allow"
-                        Action: "account:GetContactInformation"
+                        Action: "macie2:ListClassificationJobs"
                         Resource: "*"
diff --git a/templates_cspm_eventbridge/FullInstall.yaml b/templates_cspm_eventbridge/FullInstall.yaml
@@ -88,7 +88,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role

diff --git a/templates_cspm_eventbridge/OrgFullInstall.yaml b/templates_cspm_eventbridge/OrgFullInstall.yaml
@@ -132,7 +132,7 @@ Resources:
                   - "arn:aws:waf-regional:*:*:rule/*"
                   - "arn:aws:waf-regional:*:*:rulegroup/*"
               - Effect: "Allow"
-                Action: "account:GetContactInformation"
+                Action: "macie2:ListClassificationJobs"
                 Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role
@@ -245,7 +245,7 @@ Resources:
                           - "arn:aws:waf-regional:*:*:rule/*"
                           - "arn:aws:waf-regional:*:*:rulegroup/*"
                       - Effect: "Allow"
-                        Action: "account:GetContactInformation"
+                        Action: "macie2:ListClassificationJobs"
                         Resource: "*"
           EventBridgeRole:
             Type: AWS::IAM::Role