Adding permissions to AWS trust relationship role to CFTs (#116)

* Adding permissions to AWS trust relationship role Change summary: ---------------- For each of the templates deploying CSPM / trust-relationship role, adding policy with specific permissions to retrieve data for new resource types being collected in CSPM. - The change covers both single and org install templates. - Validated the CFT templates using make lint and validate. * Remove new permissions change from native templates * Fix linting
sysdiglabs · Feb 27, 2024 · e3afb31 · e3afb31
1 parent 1c9a039
commit e3afb31
Show file tree

Hide file tree

Showing 6 changed files with 164 additions and 3 deletions.
diff --git a/templates_cspm/CloudAgentlessRole.yaml b/templates_cspm/CloudAgentlessRole.yaml
@@ -47,6 +47,24 @@ Resources:
                 sts:ExternalId: !Ref ExternalID
       ManagedPolicyArns:
         - arn:aws:iam::aws:policy/SecurityAudit
+      Policies:
+        - PolicyName: !Ref RoleName
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: "Allow"
+                Action: "elasticfilesystem:DescribeAccessPoints"
+                Resource: "*"
+              - Effect: "Allow"
+                Action:
+                  - "waf-regional:ListRules"
+                  - "waf-regional:ListRuleGroups"
+                Resource:
+                  - "arn:aws:waf-regional:*:*:rule/*"
+                  - "arn:aws:waf-regional:*:*:rulegroup/*"
+              - Effect: "Allow"
+                Action: "account:GetContactInformation"
+                Resource: "*"
 
 Outputs:
   RoleARN:

diff --git a/templates_cspm/OrgCloudAgentlessRole.yaml b/templates_cspm/OrgCloudAgentlessRole.yaml
@@ -49,6 +49,24 @@ Resources:
                 sts:ExternalId: !Sub ${ExternalID}
       ManagedPolicyArns:
         - arn:aws:iam::aws:policy/SecurityAudit
+      Policies:
+        - PolicyName: !Sub ${RoleName}
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: "Allow"
+                Action: "elasticfilesystem:DescribeAccessPoints"
+                Resource: "*"
+              - Effect: "Allow"
+                Action:
+                  - "waf-regional:ListRules"
+                  - "waf-regional:ListRuleGroups"
+                Resource:
+                  - "arn:aws:waf-regional:*:*:rule/*"
+                  - "arn:aws:waf-regional:*:*:rulegroup/*"
+              - Effect: "Allow"
+                Action: "account:GetContactInformation"
+                Resource: "*"
   RoleStackSet:
     Type: AWS::CloudFormation::StackSet
     Properties:
@@ -101,5 +119,22 @@ Resources:
                       StringEquals:
                         sts:ExternalId: !Sub ${ExternalID}
               ManagedPolicyArns:
-                - arn:aws:iam::aws:policy/SecurityAudit      
-        
+                - arn:aws:iam::aws:policy/SecurityAudit
+              Policies:
+                - PolicyName: !Sub ${RoleName}
+                  PolicyDocument:
+                    Version: "2012-10-17"
+                    Statement:
+                      - Effect: "Allow"
+                        Action: "elasticfilesystem:DescribeAccessPoints"
+                        Resource: "*"
+                      - Effect: "Allow"
+                        Action:
+                          - "waf-regional:ListRules"
+                          - "waf-regional:ListRuleGroups"
+                        Resource:
+                          - "arn:aws:waf-regional:*:*:rule/*"
+                          - "arn:aws:waf-regional:*:*:rulegroup/*"
+                      - Effect: "Allow"
+                        Action: "account:GetContactInformation"
+                        Resource: "*"
diff --git a/templates_cspm_cloudlogs/FullInstall.yaml b/templates_cspm_cloudlogs/FullInstall.yaml
@@ -60,6 +60,24 @@ Resources:
                 sts:ExternalId: !Ref ExternalID
       ManagedPolicyArns:
         - arn:aws:iam::aws:policy/SecurityAudit
+      Policies:
+        - PolicyName: !Ref CSPMRoleName
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: "Allow"
+                Action: "elasticfilesystem:DescribeAccessPoints"
+                Resource: "*"
+              - Effect: "Allow"
+                Action:
+                  - "waf-regional:ListRules"
+                  - "waf-regional:ListRuleGroups"
+                Resource:
+                  - "arn:aws:waf-regional:*:*:rule/*"
+                  - "arn:aws:waf-regional:*:*:rulegroup/*"
+              - Effect: "Allow"
+                Action: "account:GetContactInformation"
+                Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"
     Properties:

diff --git a/templates_cspm_cloudlogs/OrgFullInstall.yaml b/templates_cspm_cloudlogs/OrgFullInstall.yaml
@@ -65,6 +65,24 @@ Resources:
                 sts:ExternalId: !Sub ${ExternalID}
       ManagedPolicyArns:
         - arn:aws:iam::aws:policy/SecurityAudit
+      Policies:
+        - PolicyName: !Sub ${CSPMRoleName}
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: "Allow"
+                Action: "elasticfilesystem:DescribeAccessPoints"
+                Resource: "*"
+              - Effect: "Allow"
+                Action:
+                  - "waf-regional:ListRules"
+                  - "waf-regional:ListRuleGroups"
+                Resource:
+                  - "arn:aws:waf-regional:*:*:rule/*"
+                  - "arn:aws:waf-regional:*:*:rulegroup/*"
+              - Effect: "Allow"
+                Action: "account:GetContactInformation"
+                Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"
     Properties:
@@ -156,3 +174,21 @@ Resources:
                         sts:ExternalId: !Sub ${ExternalID}
               ManagedPolicyArns:
                 - arn:aws:iam::aws:policy/SecurityAudit
+              Policies:
+                - PolicyName: !Sub ${CSPMRoleName}
+                  PolicyDocument:
+                    Version: "2012-10-17"
+                    Statement:
+                      - Effect: "Allow"
+                        Action: "elasticfilesystem:DescribeAccessPoints"
+                        Resource: "*"
+                      - Effect: "Allow"
+                        Action:
+                          - "waf-regional:ListRules"
+                          - "waf-regional:ListRuleGroups"
+                        Resource:
+                          - "arn:aws:waf-regional:*:*:rule/*"
+                          - "arn:aws:waf-regional:*:*:rulegroup/*"
+                      - Effect: "Allow"
+                        Action: "account:GetContactInformation"
+                        Resource: "*"
diff --git a/templates_cspm_eventbridge/FullInstall.yaml b/templates_cspm_eventbridge/FullInstall.yaml
@@ -72,6 +72,24 @@ Resources:
                 sts:ExternalId: !Ref ExternalID
       ManagedPolicyArns:
         - arn:aws:iam::aws:policy/SecurityAudit
+      Policies:
+        - PolicyName: !Ref RoleName
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: "Allow"
+                Action: "elasticfilesystem:DescribeAccessPoints"
+                Resource: "*"
+              - Effect: "Allow"
+                Action:
+                  - "waf-regional:ListRules"
+                  - "waf-regional:ListRuleGroups"
+                Resource:
+                  - "arn:aws:waf-regional:*:*:rule/*"
+                  - "arn:aws:waf-regional:*:*:rulegroup/*"
+              - Effect: "Allow"
+                Action: "account:GetContactInformation"
+                Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role
     Properties:

diff --git a/templates_cspm_eventbridge/OrgFullInstall.yaml b/templates_cspm_eventbridge/OrgFullInstall.yaml
@@ -116,6 +116,24 @@ Resources:
                 sts:ExternalId: !Sub ${ExternalID}
       ManagedPolicyArns:
         - arn:aws:iam::aws:policy/SecurityAudit
+      Policies:
+        - PolicyName: !Sub ${CSPMRoleName}
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: "Allow"
+                Action: "elasticfilesystem:DescribeAccessPoints"
+                Resource: "*"
+              - Effect: "Allow"
+                Action:
+                  - "waf-regional:ListRules"
+                  - "waf-regional:ListRuleGroups"
+                Resource:
+                  - "arn:aws:waf-regional:*:*:rule/*"
+                  - "arn:aws:waf-regional:*:*:rulegroup/*"
+              - Effect: "Allow"
+                Action: "account:GetContactInformation"
+                Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role
     Properties:
@@ -210,7 +228,25 @@ Resources:
                       StringEquals:
                         sts:ExternalId: !Sub ${ExternalID}
               ManagedPolicyArns:
-                - arn:aws:iam::aws:policy/SecurityAudit        
+                - arn:aws:iam::aws:policy/SecurityAudit
+              Policies:
+                - PolicyName: !Sub ${CSPMRoleName}
+                  PolicyDocument:
+                    Version: "2012-10-17"
+                    Statement:
+                      - Effect: "Allow"
+                        Action: "elasticfilesystem:DescribeAccessPoints"
+                        Resource: "*"
+                      - Effect: "Allow"
+                        Action:
+                          - "waf-regional:ListRules"
+                          - "waf-regional:ListRuleGroups"
+                        Resource:
+                          - "arn:aws:waf-regional:*:*:rule/*"
+                          - "arn:aws:waf-regional:*:*:rulegroup/*"
+                      - Effect: "Allow"
+                        Action: "account:GetContactInformation"
+                        Resource: "*"
           EventBridgeRole:
             Type: AWS::IAM::Role
             Properties: