[SSPROD-40007] Adding necessary permissions for CFT serverless scanni…

…ng (#118)
sysdiglabs · May 2, 2024 · cee7459 · cee7459
1 parent 20f2d71
commit cee7459
Show file tree

Hide file tree

Showing 6 changed files with 27 additions and 0 deletions.
diff --git a/templates_cspm/CloudAgentlessRole.yaml b/templates_cspm/CloudAgentlessRole.yaml
@@ -65,6 +65,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
 
 Outputs:
   RoleARN:

diff --git a/templates_cspm/OrgCloudAgentlessRole.yaml b/templates_cspm/OrgCloudAgentlessRole.yaml
@@ -67,6 +67,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
   RoleStackSet:
     Type: AWS::CloudFormation::StackSet
     Properties:
@@ -138,3 +141,6 @@ Resources:
                       - Effect: "Allow"
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
+                      - Effect: "Allow"
+                        Action: "lambda:GetRuntimeManagementConfig"
+                        Resource: "*"
diff --git a/templates_cspm_cloudlogs/FullInstall.yaml b/templates_cspm_cloudlogs/FullInstall.yaml
@@ -78,6 +78,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"
     Properties:

diff --git a/templates_cspm_cloudlogs/OrgFullInstall.yaml b/templates_cspm_cloudlogs/OrgFullInstall.yaml
@@ -83,6 +83,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
   CloudLogsRole:
     Type: "AWS::IAM::Role"
     Properties:
@@ -192,3 +195,6 @@ Resources:
                       - Effect: "Allow"
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
+                      - Effect: "Allow"
+                        Action: "lambda:GetRuntimeManagementConfig"
+                        Resource: "*"
diff --git a/templates_cspm_eventbridge/FullInstall.yaml b/templates_cspm_eventbridge/FullInstall.yaml
@@ -90,6 +90,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role
     Properties:

diff --git a/templates_cspm_eventbridge/OrgFullInstall.yaml b/templates_cspm_eventbridge/OrgFullInstall.yaml
@@ -134,6 +134,9 @@ Resources:
               - Effect: "Allow"
                 Action: "macie2:ListClassificationJobs"
                 Resource: "*"
+              - Effect: "Allow"
+                Action: "lambda:GetRuntimeManagementConfig"
+                Resource: "*"
   EventBridgeRole:
     Type: AWS::IAM::Role
     Properties:
@@ -247,6 +250,9 @@ Resources:
                       - Effect: "Allow"
                         Action: "macie2:ListClassificationJobs"
                         Resource: "*"
+                      - Effect: "Allow"
+                        Action: "lambda:GetRuntimeManagementConfig"
+                        Resource: "*"
           EventBridgeRole:
             Type: AWS::IAM::Role
             Properties: