Skip to content

Commit f1e5366

Browse files
miguelpaismiguelpais
authored
[SSPROD-48724] CFT template for VM Workload Scanning (#139)
1 parent 57c2dcc commit f1e5366

File tree

3 files changed

+293
-4
lines changed

3 files changed

+293
-4
lines changed

‎modules/Makefile

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,16 @@ PARAM_TRUSTED_IDENTITY ?= arn:aws:iam:::role/$(PARAM_NAME_SUFFIX)
1111
PARAM_TARGET_EVENT_BUS_ARN ?= arn:aws:events:us-east-1::event-bus/default
1212
PARAM_BUCKET_ARN ?= arn:aws:s3:::cloudtrail-$(PARAM_NAME_SUFFIX)
1313
PARAM_REGIONS ?= us-east-1
14+
PARAM_LAMBDA_SCANNING_ENABLED ?= true
1415

1516
.PHONY: validate lint deploy test clean
1617
validate: export AWS_PAGER=""
1718
validate:
18-
aws cloudformation validate-template --template-body file://./foundational.cft.yaml
19-
aws cloudformation validate-template --template-body file://./log_ingestion.events.cft.yaml
20-
aws cloudformation validate-template --template-body file://./log_ingestion.s3.cft.yaml
21-
aws cloudformation validate-template --template-body file://./volume_access.cft.yaml
19+
aws --region us-east-1 cloudformation validate-template --template-body file://./foundational.cft.yaml
20+
aws --region us-east-1 cloudformation validate-template --template-body file://./log_ingestion.events.cft.yaml
21+
aws --region us-east-1 cloudformation validate-template --template-body file://./log_ingestion.s3.cft.yaml
22+
aws --region us-east-1 cloudformation validate-template --template-body file://./volume_access.cft.yaml
23+
aws --region us-east-1 cloudformation validate-template --template-body file://./vm_workload_scanning.cft.yaml
2224

2325
lint:
2426
cfn-lint *.cft.yaml
@@ -28,12 +30,14 @@ lint:
2830
yq '.Resources.OrganizationRuleStackSet.Properties.TemplateBody' log_ingestion.events.cft.yaml | cfn-lint -
2931
yq '.Resources.AccountStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
3032
yq '.Resources.OrganizationStackSet.Properties.TemplateBody' volume_access.cft.yaml | cfn-lint -
33+
yq '.Resources.ScanningOrgStackSet.Properties.TemplateBody' vm_workload_scanning.cft.yaml | cfn-lint -
3134

3235
publish:
3336
aws s3 cp foundational.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/foundational.cft.yaml
3437
aws s3 cp log_ingestion.s3.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/log_ingestion.s3.cft.yaml
3538
aws s3 cp log_ingestion.events.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/log_ingestion.events.cft.yaml
3639
aws s3 cp volume_access.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/volume_access.cft.yaml
40+
aws s3 cp vm_workload_scanning.cft.yaml s3://$(S3_BUCKET)/modules/$(S3_PREFIX)/vm_workload_scanning.cft.yaml
3741

3842
deploy:
3943
aws cloudformation deploy \
@@ -83,10 +87,23 @@ deploy:
8387
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
8488
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
8589

90+
aws cloudformation deploy \
91+
--stack-name $(STACK_NAME)-VMWorkloadScanning-$(PARAM_NAME_SUFFIX) \
92+
--template-file vm_workload_scanning.cft.yaml \
93+
--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
94+
--parameter-overrides \
95+
"NameSuffix=$(PARAM_NAME_SUFFIX)" \
96+
"ExternalID=$(PARAM_EXTERNAL_ID)" \
97+
"TrustedIdentity=$(PARAM_TRUSTED_IDENTITY)" \
98+
"LambdaScanningEnabled"=$(PARAM_LAMBDA_SCANNING_ENABLED) \
99+
"IsOrganizational=$(PARAM_IS_ORGANIZATIONAL)" \
100+
"OrganizationalUnitIDs=$(PARAM_ORGANIZATIONAL_UNIT_IDS)"
101+
86102
clean:
87103
aws cloudformation delete-stack --stack-name $(STACK_NAME)-Foundational-$(PARAM_NAME_SUFFIX)
88104
aws cloudformation delete-stack --stack-name $(STACK_NAME)-LogIngestion-EventBridge-$(PARAM_NAME_SUFFIX)
89105
aws cloudformation delete-stack --stack-name $(STACK_NAME)-LogIngestion-S3-$(PARAM_NAME_SUFFIX)
90106
aws cloudformation delete-stack --stack-name $(STACK_NAME)-VolumeAccess-$(PARAM_NAME_SUFFIX)
107+
aws cloudformation delete-stack --stack-name $(STACK_NAME)-VMWorkloadScanning-$(PARAM_NAME_SUFFIX)
91108

92109

‎modules/vm_workload_scanning.cft.yaml

Lines changed: 260 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,260 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: Sysdig Secure Agentless Workload Scanning Onboarding
3+
Metadata:
4+
AWS::CloudFormation::Interface:
5+
ParameterGroups:
6+
- Label:
7+
default: Sysdig Assigned Settings (Do not change)
8+
Parameters:
9+
- NameSuffix
10+
- ExternalID
11+
- TrustedIdentity
12+
- LambdaScanningEnabled
13+
- IsOrganizational
14+
- OrganizationalUnitIDs
15+
ParameterLabels:
16+
NameSuffix:
17+
default: Name Suffix
18+
ExternalID:
19+
default: External ID
20+
TrustedIdentity:
21+
default: Trusted Identity
22+
LambdaScanningEnabled:
23+
default: Enable Lambda Scanning
24+
IsOrganizational:
25+
default: Is Organizational Deployment?
26+
OrganizationalUnitIDs:
27+
default: Organizational Unit IDs
28+
Parameters:
29+
NameSuffix:
30+
Type: String
31+
Description: Suffix to append to the resource name identifiers
32+
AllowedPattern: '[0-9a-z]+'
33+
MaxLength: 8
34+
MinLength: 4
35+
ExternalID:
36+
Type: String
37+
Description: Sysdig assigned token that proves you own this account
38+
TrustedIdentity:
39+
Type: String
40+
Description: The Role in Sysdig's AWS Account with permissions to your account
41+
LambdaScanningEnabled:
42+
Type: String
43+
Description: Enable Lambda function scanning
44+
Default: 'false'
45+
AllowedValues:
46+
- 'true'
47+
- 'false'
48+
IsOrganizational:
49+
Type: String
50+
Description: Whether this is an organizational deployment
51+
Default: 'false'
52+
AllowedValues:
53+
- 'true'
54+
- 'false'
55+
OrganizationalUnitIDs:
56+
Type: CommaDelimitedList
57+
Description: Comma-separated list of organizational unit IDs to deploy (required for organizational deployments)
58+
59+
Conditions:
60+
IsOrganizational:
61+
Fn::Equals:
62+
- Ref: IsOrganizational
63+
- 'true'
64+
IsNotOrganizational:
65+
Fn::Equals:
66+
- Ref: IsOrganizational
67+
- 'false'
68+
IsNotOrganizationalAndLambdaEnabled:
69+
Fn::And:
70+
- Fn::Equals:
71+
- Ref: IsOrganizational
72+
- 'false'
73+
- Fn::Equals:
74+
- Ref: LambdaScanningEnabled
75+
- 'true'
76+
77+
Resources:
78+
ScanningRole:
79+
Type: AWS::IAM::Role
80+
Condition: IsNotOrganizational
81+
Properties:
82+
RoleName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
83+
AssumeRolePolicyDocument:
84+
Version: '2012-10-17'
85+
Statement:
86+
- Effect: Allow
87+
Principal:
88+
AWS:
89+
Ref: TrustedIdentity
90+
Action: ['sts:AssumeRole']
91+
Condition:
92+
StringEquals:
93+
sts:ExternalId:
94+
Ref: ExternalID
95+
ECRPolicy:
96+
Type: AWS::IAM::Policy
97+
Condition: IsNotOrganizational
98+
Properties:
99+
PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}-ecr
100+
Roles:
101+
- !Ref ScanningRole
102+
PolicyDocument:
103+
Version: '2012-10-17'
104+
Statement:
105+
- Effect: Allow
106+
Action:
107+
- ecr:GetDownloadUrlForLayer
108+
- ecr:BatchGetImage
109+
- ecr:BatchCheckLayerAvailability
110+
- ecr:ListImages
111+
- ecr:GetAuthorizationToken
112+
Resource: '*'
113+
LambdaPolicy:
114+
Type: AWS::IAM::Policy
115+
Condition: IsNotOrganizationalAndLambdaEnabled
116+
Properties:
117+
PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}-lambda
118+
Roles:
119+
- !Ref ScanningRole
120+
PolicyDocument:
121+
Version: '2012-10-17'
122+
Statement:
123+
- Effect: Allow
124+
Action:
125+
- lambda:GetFunction
126+
- lambda:GetFunctionConfiguration
127+
- lambda:GetRuntimeManagementConfig
128+
- lambda:ListFunctions
129+
- lambda:ListTagsForResource
130+
- lambda:GetLayerVersionByArn
131+
- lambda:GetLayerVersion
132+
- lambda:ListLayers
133+
- lambda:ListLayerVersions
134+
Resource: '*'
135+
136+
137+
ScanningOrgStackSet:
138+
Type: AWS::CloudFormation::StackSet
139+
Condition: IsOrganizational
140+
Properties:
141+
StackSetName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
142+
Description: Creates IAM roles within an AWS organization for Agentless Workload Scanning
143+
PermissionModel: SERVICE_MANAGED
144+
Capabilities:
145+
- CAPABILITY_NAMED_IAM
146+
AutoDeployment:
147+
Enabled: true
148+
RetainStacksOnAccountRemoval: false
149+
ManagedExecution:
150+
Active: true
151+
OperationPreferences:
152+
MaxConcurrentPercentage: 100
153+
FailureTolerancePercentage: 90
154+
ConcurrencyMode: SOFT_FAILURE_TOLERANCE
155+
Parameters:
156+
- ParameterKey: NameSuffix
157+
ParameterValue:
158+
Ref: NameSuffix
159+
- ParameterKey: TrustedIdentity
160+
ParameterValue:
161+
Ref: TrustedIdentity
162+
- ParameterKey: ExternalID
163+
ParameterValue:
164+
Ref: ExternalID
165+
- ParameterKey: LambdaScanningEnabled
166+
ParameterValue:
167+
Ref: LambdaScanningEnabled
168+
StackInstancesGroup:
169+
- DeploymentTargets:
170+
OrganizationalUnitIds: !Ref OrganizationalUnitIDs
171+
Regions:
172+
- Ref: AWS::Region
173+
TemplateBody: |
174+
AWSTemplateFormatVersion: "2010-09-09"
175+
Description: IAM Role for Agentless Workload Scanning
176+
Parameters:
177+
NameSuffix:
178+
Type: String
179+
Description: Suffix to append to the resource name identifiers
180+
AllowedPattern: "[0-9a-z]+"
181+
MaxLength: 8
182+
MinLength: 4
183+
TrustedIdentity:
184+
Type: String
185+
Description: Trusted identity
186+
ExternalID:
187+
Type: String
188+
Description: external ID
189+
LambdaScanningEnabled:
190+
Type: String
191+
Description: Enable Lambda function scanning
192+
Default: 'false'
193+
Conditions:
194+
IsLambdaEnabled:
195+
Fn::Equals:
196+
- Ref: LambdaScanningEnabled
197+
- 'true'
198+
Resources:
199+
ScanningRole:
200+
Type: AWS::IAM::Role
201+
Properties:
202+
RoleName: !Sub sysdig-vm-workload-scanning-${NameSuffix}
203+
AssumeRolePolicyDocument:
204+
Version: "2012-10-17"
205+
Statement:
206+
- Effect: "Allow"
207+
Action: "sts:AssumeRole"
208+
Principal:
209+
AWS: !Ref TrustedIdentity
210+
Condition:
211+
StringEquals:
212+
sts:ExternalId: !Ref ExternalID
213+
ECRPolicy:
214+
Type: AWS::IAM::Policy
215+
Properties:
216+
PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}-ecr
217+
Roles:
218+
- !Ref ScanningRole
219+
PolicyDocument:
220+
Version: '2012-10-17'
221+
Statement:
222+
- Effect: Allow
223+
Action:
224+
- ecr:GetDownloadUrlForLayer
225+
- ecr:BatchGetImage
226+
- ecr:BatchCheckLayerAvailability
227+
- ecr:ListImages
228+
- ecr:GetAuthorizationToken
229+
Resource: '*'
230+
LambdaPolicy:
231+
Type: AWS::IAM::Policy
232+
Condition: IsLambdaEnabled
233+
Properties:
234+
PolicyName: !Sub sysdig-vm-workload-scanning-${NameSuffix}-lambda
235+
Roles:
236+
- !Ref ScanningRole
237+
PolicyDocument:
238+
Version: '2012-10-17'
239+
Statement:
240+
- Effect: Allow
241+
Action:
242+
- lambda:GetFunction
243+
- lambda:GetFunctionConfiguration
244+
- lambda:GetRuntimeManagementConfig
245+
- lambda:ListFunctions
246+
- lambda:ListTagsForResource
247+
- lambda:GetLayerVersionByArn
248+
- lambda:GetLayerVersion
249+
- lambda:ListLayers
250+
- lambda:ListLayerVersions
251+
Resource: '*'
252+
253+
254+
255+
Outputs:
256+
ScanningRoleARN:
257+
Description: ARN of the scanning role
258+
Value:
259+
Fn::Sub: sysdig-vm-workload-scanning-${NameSuffix}
260+

‎modules/vm_workload_scanning.components.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"type": "COMPONENT_TRUSTED_ROLE",
4+
"instance": "secure-vm-workload-scanning",
5+
"version": "v0.1.0",
6+
"trustedRoleMetadata": {
7+
"aws": {
8+
"roleName": "sysdig-vm-workload-scanning-{{NameSuffix}}"
9+
}
10+
}
11+
}
12+
]

0 commit comments

Comments
 (0)