Revamp cloudformation templates for Cloudlogs module (#106)

templates_cloudlogs/CloudLogs.yaml

@@ -1,6 +1,6 @@
 AWSTemplateFormatVersion: "2010-09-09"
 Description: >
-  CloudFormation template for provisioning
+  CloudFormation single template for provisioning
   the necessary resources for the `cloud-logs`
   component.
 

templates_cloudlogs/Makefile

@@ -5,18 +5,21 @@ S3_PREFIX ?= "test"
 # We need the REGION or the TemplateURLs might be created for a different region, resulting in a deployment error
 S3_REGION ?= "eu-west-1" # ireland
 SECURE_API_TOKEN ?= ""
-STACK_NAME = "CloudLogsTest"
+STACK_NAME = "CloudlogsTest"
+STACK_NAME_ORG = "OrgCloudlogsTest"
 
 .PHONY: packaged-template.yaml
+.PHONY: packaged-template-org.yaml
 
 validate:
 	aws cloudformation validate-template --template-body file://./CloudLogs.yaml
+	aws cloudformation validate-template --template-body file://./OrgCloudLogs.yaml
 
 lint:
 	cfn-lint *.yaml
 
 packaged-template.yaml:
-	aws s3 rm s3://$(S3_BUCKET)/cloudlogs/$(S3_PREFIX) --recursive
+	aws s3 rm s3://$(S3_BUCKET)/cloudlogs/single/$(S3_PREFIX) --recursive
 
 	aws cloudformation package \
 		--region $(S3_REGION) \
@@ -35,7 +38,31 @@ test: packaged-template.yaml
 			"SysdigSecureAPIToken=$(SECURE_API_TOKEN)"
 
 ci: packaged-template.yaml
-	aws s3 cp ./packaged-template.yaml s3://$(S3_BUCKET)/cloudlogs/$(S3_PREFIX)/entry-point.yaml
+	aws s3 cp ./packaged-template.yaml s3://$(S3_BUCKET)/cloudlogs/single/$(S3_PREFIX)/entry-point.yaml
 
 clean:
 	aws cloudformation delete-stack --stack-name $(STACK_NAME)
+
+packaged-template-org.yaml:
+	aws s3 rm s3://$(S3_BUCKET)/cloudlogs/org/$(S3_PREFIX) --recursive
+	aws cloudformation package \
+		--region $(S3_REGION) \
+		--template-file OrgCloudlogs.yaml \
+		--s3-bucket $(S3_BUCKET) \
+		--s3-prefix cspm/$(S3_PREFIX) \
+		--force-upload \
+		--output-template-file packaged-template-org.yaml
+
+test-org: packaged-template-org.yaml
+	aws cloudformation deploy \
+		--stack-name $(STACK_NAME_ORG) \
+		--template-file packaged-template-org.yaml \
+		--capabilities "CAPABILITY_NAMED_IAM" "CAPABILITY_AUTO_EXPAND" \
+		--parameter-overrides \
+			"SysdigSecureAPIToken=$(SECURE_API_TOKEN)"
+
+ci-org: packaged-template-org.yaml
+	aws s3 cp ./packaged-template-org.yaml s3://$(S3_BUCKET)/cloudlogs/org/$(S3_PREFIX)/entry-point.yaml
+
+clean-org:
+	aws cloudformation delete-stack --stack-name $(STACK_NAME_ORG)

templates_cloudlogs/OrgCloudLogs.yaml

@@ -0,0 +1,97 @@
+AWSTemplateFormatVersion: "2010-09-09"
+Description: >
+  CloudFormation organizational template for provisioning
+  the necessary resources for the `cloud-logs`
+  component and the read-only role required to itneract with
+  the target organizational environment.
+
+Metadata:
+  AWS::CloudFormation::Interface:
+    ParameterGroups:
+      - Label:
+          default: "Sysdig Settings (Do not change)"
+        Parameters:
+          - CSPMRoleName
+          - CloudLogsRoleName
+          - ExternalID
+          - TrustedIdentity
+          - BucketARN
+
+    ParameterLabels:
+      CSPMRoleName:
+        default: "CSPM Role Name (Sysdig use only)"
+      CloudLogsRoleName:
+        default: "CloudLogs Role Name (Sysdig use only)"
+      ExternalID:
+        default: "External ID (Sysdig use only)"
+      TrustedIdentity:
+        default: "Trusted Identity (Sysdig use only)"
+      BucketARN:
+        default: "Bucket ARN"
+
+Parameters:
+  CSPMRoleName:
+    Type: String
+    Description: The name of the read-only IAM Role that Sysdig will use to interact with the target environment
+  CloudLogsRoleName:
+    Type: String
+    Description: The name of the IAM Role that will enable access to the Cloudtrail logs.
+  ExternalID:
+    Type: String
+    Description: Random string generated unique to a customer.
+  TrustedIdentity:
+    Type: String
+    Description: The name of Sysdig trusted identity.
+  BucketARN:
+    Type: String
+    Description: The ARN of your s3 bucket associated with your Cloudtrail trail.
+
+Resources:
+  CloudLogsRole:
+    Type: "AWS::IAM::Role"
+    Properties:
+      RoleName: !Ref CloudLogsRoleName
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: "Allow"
+            Principal:
+              AWS: !Ref TrustedIdentity
+            Action:
+              - "sts:AssumeRole"
+            Condition:
+              StringEquals:
+                "sts:ExternalId": !Ref ExternalID
+  CloudLogsRolePolicies:
+    Type: "AWS::IAM::Policy"
+    Properties:
+      PolicyName: "CloudlogsS3Access"
+      PolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Sid: "CloudlogsS3Access"
+            Effect: "Allow"
+            Action:
+              - "s3:Get*"
+              - "s3:List*"
+            Resource:
+              - !Sub '${BucketARN}'
+              - !Sub '${BucketARN}/*'
+      Roles:
+        - Ref: "CloudLogsRole"
+  CloudAgentlessRole:
+    Type: "AWS::IAM::Role"
+    Properties:
+      RoleName: !Ref CSPMRoleName
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: "Allow"
+            Principal:
+              AWS: !Ref TrustedIdentity
+            Action: "sts:AssumeRole"
+            Condition:
+              StringEquals:
+                sts:ExternalId: !Ref ExternalID
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/SecurityAudit

templates_cspm_cloudlogs/OrgFullInstall.yaml

@@ -112,14 +112,10 @@ Resources:
       Parameters:
         - ParameterKey: CSPMRoleName
           ParameterValue: !Ref CSPMRoleName
-        - ParameterKey: CloudLogsRoleName
-          ParameterValue: !Ref CloudLogsRoleName
         - ParameterKey: TrustedIdentity
           ParameterValue: !Ref TrustedIdentity
         - ParameterKey: ExternalID
           ParameterValue: !Ref ExternalID
-        - ParameterKey: BucketARN
-          ParameterValue: !Ref BucketARN
       StackInstancesGroup:
         - DeploymentTargets:
             OrganizationalUnitIds: !Split [ ",", !Ref OrganizationUnitIDs]
@@ -131,15 +127,9 @@ Resources:
           CSPMRoleName:
             Type: String
             Description: A unique identifier used to create an IAM Role
-          CloudLogsRoleName:
-            Type: String
-            Description: The name of the IAM Role that will enable access to the Cloudtrail logs.
           TrustedIdentity:
             Type: String
             Description: The Role in Sysdig's AWS Account with permissions to your account
-          BucketARN:
-            Type: String
-            Description: The ARN of your s3 bucket associated with your Cloudtrail trail.
           ExternalID:
             Type: String
             Description: Sysdig ExternalID required for the policy creation
@@ -160,35 +150,3 @@ Resources:
                         sts:ExternalId: !Sub ${ExternalID}
               ManagedPolicyArns:
                 - arn:aws:iam::aws:policy/SecurityAudit
-          CloudLogsRole:
-            Type: "AWS::IAM::Role"
-            Properties:
-              RoleName: !Ref CloudLogsRoleName
-              AssumeRolePolicyDocument:
-                Version: "2012-10-17"
-                Statement:
-                  - Effect: "Allow"
-                    Principal:
-                      AWS: !Ref TrustedIdentity
-                    Action:
-                      - "sts:AssumeRole"
-                    Condition:
-                      StringEquals:
-                        "sts:ExternalId": !Ref ExternalID
-          CloudLogsRolePolicies:
-            Type: "AWS::IAM::Policy"
-            Properties:
-              PolicyName: "CloudlogsS3Access"
-              PolicyDocument:
-                Version: "2012-10-17"
-                Statement:
-                  - Sid: "CloudlogsS3Access"
-                    Effect: "Allow"
-                    Action:
-                      - "s3:Get*"
-                      - "s3:List*"
-                    Resource:
-                      - !Sub '${BucketARN}'
-                      - !Sub '${BucketARN}/*'
-              Roles:
-                - Ref: "CloudLogsRole"