-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add cloudformation templates to create the eks service account roles
- Loading branch information
Showing
9 changed files
with
266 additions
and
5 deletions.
There are no files selected for viewing
53 changes: 53 additions & 0 deletions
53
...am-roles/organization-eks-iam-role/deepfence-cloud-scanner-organization-iam-role.template
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| AWSTemplateFormatVersion: '2010-09-09' | ||
| Description: Deepfence Cloud Scanner IAM role for Organization Deployment | ||
| Metadata: | ||
| AWS::CloudFormation::Interface: | ||
| ParameterGroups: | ||
| - Label: | ||
| default: Configuration | ||
| Parameters: | ||
| - TaskIAMRole | ||
| - ParentStackName | ||
| - CloudScannerAccountId | ||
| ParameterLabels: | ||
| TaskIAMRole: | ||
| default: If SecurityAudit role is chosen, cloud scanner may not find configuration issues in some of the AWS resources like WAF. Also updates will happen only once every day. | ||
| ParentStackName: | ||
| default: Parent Stack Name | ||
| CloudScannerAccountId: | ||
| default: aws account where cloud scanner is deployed | ||
| Parameters: | ||
| TaskIAMRole: | ||
| Type: String | ||
| Description: Task Role | ||
| Default: arn:aws:iam::aws:policy/SecurityAudit | ||
| AllowedValues: | ||
| - arn:aws:iam::aws:policy/SecurityAudit | ||
| - arn:aws:iam::aws:policy/ReadOnlyAccess | ||
| ParentStackName: | ||
| Type: String | ||
| CloudScannerAccountId: | ||
| Type: String | ||
| Resources: | ||
| ReadOnlyRole: | ||
| Type: AWS::IAM::Role | ||
| Properties: | ||
| Path: / | ||
| RoleName: !Ref ParentStackName | ||
| AssumeRolePolicyDocument: !Sub | | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Principal": { | ||
| "AWS": "arn:aws:iam::${CloudScannerAccountId}:role/${ParentStackName}" | ||
| }, | ||
| "Action": "sts:AssumeRole" | ||
| } | ||
| ] | ||
| } | ||
| MaxSessionDuration: 3600 | ||
| ManagedPolicyArns: | ||
| - !Ref TaskIAMRole | ||
| Description: Provide AssumeRole permission to Deepfence Managed Cloud Scanner |
128 changes: 128 additions & 0 deletions
128
...organization-eks-iam-role/deepfence-cloud-scanner-organization-stackset-iam-role.template
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,128 @@ | ||
| AWSTemplateFormatVersion: '2010-09-09' | ||
| Description: Deepfence Cloud Scanner StackSet and EKS IAM role for Organization Deployment | ||
| Metadata: | ||
| AWS::CloudFormation::Interface: | ||
| ParameterGroups: | ||
| - Label: | ||
| default: Configuration | ||
| Parameters: | ||
| - TaskIAMRole | ||
| - OrganizationalUnitIds | ||
| ParameterLabels: | ||
| EKSClusterName: | ||
| default: EKS cluster where cloud-scanner will be deployed | ||
| EKSClusterOIDCURL: | ||
| default: The OpenID Connect URL without protocol (the "https://" prefix) | ||
| K8sNamespace: | ||
| default: k8s namespace for the cloud-scanner | ||
| K8sServiceAccountName: | ||
| default: k8s service account for the cloud-scanner | ||
| TaskIAMRole: | ||
| default: If SecurityAudit role is chosen, cloud scanner may not find configuration issues in some of the AWS resources like WAF. Also updates will happen only once every day. | ||
| OrganizationalUnitIds: | ||
| default: List of Organizational Unit IDs to deploy the StackSet (IAM Roles) | ||
| Parameters: | ||
| EKSClusterName: | ||
| Type: String | ||
| EKSClusterOIDCURL: | ||
| Type: String | ||
| Description: The OpenID Connect URL without protocol (the "https://" prefix) | ||
| K8sNamespace: | ||
| Type: String | ||
| Default: deepfence | ||
| K8sServiceAccountName: | ||
| Type: String | ||
| Default: deepfence-cloud-scanner | ||
| TaskIAMRole: | ||
| Type: String | ||
| Description: Task Role | ||
| Default: arn:aws:iam::aws:policy/SecurityAudit | ||
| AllowedValues: | ||
| - arn:aws:iam::aws:policy/SecurityAudit | ||
| - arn:aws:iam::aws:policy/ReadOnlyAccess | ||
| OrganizationalUnitIds: | ||
| Type: List<String> | ||
| Description: Organizational Unit IDs | ||
| Resources: | ||
| ReadOnlyRole: | ||
| Type: AWS::IAM::Role | ||
| Properties: | ||
| Path: / | ||
| RoleName: !Ref 'AWS::StackName' | ||
| AssumeRolePolicyDocument: !Sub | | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Principal": { | ||
| "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/${EKSClusterOIDCURL}" | ||
| }, | ||
| "Action": "sts:AssumeRoleWithWebIdentity", | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "${EKSClusterOIDCURL}:sub": "system:serviceaccount:${K8sNamespace}:${K8sServiceAccountName}", | ||
| "${EKSClusterOIDCURL}:aud": "sts.amazonaws.com" | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| MaxSessionDuration: 3600 | ||
| ManagedPolicyArns: | ||
| - !Ref TaskIAMRole | ||
| - arn:aws:iam::aws:policy/AWSOrganizationsReadOnlyAccess | ||
| Policies: | ||
| - PolicyName: !Sub "${AWS::StackName}-AllowAssumeRoleInChildAccounts" | ||
| PolicyDocument: !Sub | | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Resource": ["arn:aws:iam::*:role/${AWS::StackName}"], | ||
| "Action": "sts:AssumeRole" | ||
| } | ||
| ] | ||
| } | ||
| Description: Provide AssumeRole permission to Deepfence Cloud Scanner on child accounts | ||
| StackSet: | ||
| Type: AWS::CloudFormation::StackSet | ||
| Properties: | ||
| Description: 'Deploy IAM role across accounts in the Organization to provide permission to Cloud Scanner' | ||
| AutoDeployment: | ||
| Enabled: true | ||
| RetainStacksOnAccountRemoval: false | ||
| Capabilities: | ||
| - CAPABILITY_NAMED_IAM | ||
| ManagedExecution: | ||
| Active: true | ||
| OperationPreferences: | ||
| FailureToleranceCount: 99 | ||
| MaxConcurrentCount: 100 | ||
| RegionConcurrencyType: PARALLEL | ||
| Parameters: | ||
| - ParameterKey: TaskIAMRole | ||
| ParameterValue: !Ref TaskIAMRole | ||
| - ParameterKey: ParentStackName | ||
| ParameterValue: !Ref 'AWS::StackName' | ||
| - ParameterKey: CloudScannerAccountId | ||
| ParameterValue: !Ref 'AWS::AccountId' | ||
| PermissionModel: SERVICE_MANAGED | ||
| StackInstancesGroup: | ||
| - DeploymentTargets: | ||
| AccountFilterType: NONE | ||
| OrganizationalUnitIds: !Ref OrganizationalUnitIds | ||
| Regions: | ||
| - !Ref AWS::Region | ||
| StackSetName: !Ref AWS::StackName | ||
| TemplateURL: https://deepfence-public.s3.amazonaws.com/cloud-scanner/self-hosted/eks-iam-roles/organization-eks-iam-role/deepfence-cloud-scanner-organization-iam-role.template | ||
| Outputs: | ||
| EKSClusterName: | ||
| Value: !Ref EKSClusterName | ||
| K8sNamespace: | ||
| Value: !Ref K8sNamespace | ||
| K8sServiceAccountName: | ||
| Value: !Ref K8sServiceAccountName | ||
| ReadOnlyRoleIAMRoleARN: | ||
| Value: !GetAtt ReadOnlyRole.Arn |
File renamed without changes.
58 changes: 58 additions & 0 deletions
58
...oles/single-account-eks-iam-role/deepfence-cloud-scanner-single-account-iam-role.template
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| --- | ||
| AWSTemplateFormatVersion: '2010-09-09' | ||
| Description: 'Deepfence Cloud Scanner Single account EKS IRSA role' | ||
| Parameters: | ||
| EKSClusterName: | ||
| Type: String | ||
| EKSClusterOIDCURL: | ||
| Type: String | ||
| Description: The OpenID Connect URL without protocol (the "https://" prefix) | ||
| K8sNamespace: | ||
| Type: String | ||
| Default: deepfence | ||
| K8sServiceAccountName: | ||
| Type: String | ||
| Default: deepfence-cloud-scanner | ||
| TaskIAMRole: | ||
| Type: String | ||
| Description: Task Role | ||
| Default: arn:aws:iam::aws:policy/SecurityAudit | ||
| AllowedValues: | ||
| - arn:aws:iam::aws:policy/SecurityAudit | ||
| - arn:aws:iam::aws:policy/ReadOnlyAccess | ||
| Resources: | ||
| ReadOnlyRole: | ||
| Type: AWS::IAM::Role | ||
| Properties: | ||
| Path: "/" | ||
| RoleName: !Sub "${AWS::StackName}-cloud-scanner-role" | ||
| ManagedPolicyArns: | ||
| - !Ref TaskIAMRole | ||
| AssumeRolePolicyDocument: !Sub | | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Principal": { | ||
| "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/${EKSClusterOIDCURL}" | ||
| }, | ||
| "Action": "sts:AssumeRoleWithWebIdentity", | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "${EKSClusterOIDCURL}:sub": "system:serviceaccount:${K8sNamespace}:${K8sServiceAccountName}", | ||
| "${EKSClusterOIDCURL}:aud": "sts.amazonaws.com" | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| } | ||
| Outputs: | ||
| EKSClusterName: | ||
| Value: !Ref EKSClusterName | ||
| K8sNamespace: | ||
| Value: !Ref K8sNamespace | ||
| K8sServiceAccountName: | ||
| Value: !Ref K8sServiceAccountName | ||
| ReadOnlyRoleIAMRoleARN: | ||
| Value: !GetAtt ReadOnlyRole.Arn |
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Empty file.