Revamp cloudformation templates for Cloudlogs module

[gi-erre]

Revamp CloudLogs templates in order to provision all the necessary resoruces to fully support the organizational case. Now the end result is the same as applying the alternative terraform module(s).

Note that, before this change, only one CloudLogs template was used for both the Single and Organization case, while an additional role needed to be provisioned in the Organizational case for Sysdig's systems to properly work. This means that also the Makefile taking care of publishing the templates has been updated accordingly, along with the necessary changes in Sysdig's backend.

[nkraemer-sysdig]

So if I'm reading this correctly, after this change:

The single account (cloudlogs only) install will create:

• A cloudlogs Role & policy in this account

The org (cloudlogs only) install will create:

• A cloudlogs Role & policy in the management account only

The single (cloudlogs + CSPM) is unchanged, and will create:

• A cloudlogs Role & policy in this account
• A cspm Role & policy in this account

The org (cloudlogs + CSPM) will create:

• a cspm role & policy in every account
• a cloudlogs role & policy in only the management account

Noting that this will need changes in the cloudauth BE to encode the new template/changed template names

[gi-erre]

So if I'm reading this correctly, after this change:

The single account (cloudlogs only) install will create:

* A cloudlogs Role & policy in this account

Correct ✅

The org (cloudlogs only) install will create:

* A cloudlogs Role & policy in the management account only

In this case we are also creating a CSPM role in the management account only. This basically replicates what already is happening with terraform at UI level when we combine the different modules, in the CFT case we need to include everything in the same template. Please check this line for the CSPM role addition.

The single (cloudlogs + CSPM) is unchanged, and will create:

* A cloudlogs Role & policy in this account

* A cspm Role & policy in this account

Correct ✅

The org (cloudlogs + CSPM) will create:

* a cspm role & policy in **every** account

* a cloudlogs role & policy in **only** the management account

Correct ✅

Noting that this will need changes in the cloudauth BE to encode the new template/changed template names

Yep, there's an open PR about that where we change the references according to the changes made in this PR :)

[nkraemer-sysdig]

Perfect! That makes sense to me, thanks

[cgeers]

👍