mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 06:45:08 +00:00
76 lines
2.7 KiB
YAML
76 lines
2.7 KiB
YAML
---
|
|
AWSTemplateFormatVersion: '2010-09-09'
|
|
Description: Prowler Auditing Role - in Control Tower pick AWSControlTowerStackSetRole for IAM role and AWSControlTowerExecution for execution
|
|
|
|
Parameters:
|
|
|
|
AuditorAccountId:
|
|
Default: 987600001234
|
|
Description: AWS Account ID where the audit tooling executes
|
|
Type: Number
|
|
AuditRolePathName:
|
|
Default: '/audit/prowler/XA_AuditRole_Prowler'
|
|
Description: Path for role name in audit tooling account
|
|
Type: String
|
|
|
|
Resources:
|
|
XAAuditRole:
|
|
Type: "AWS::IAM::Role"
|
|
Properties: # /audit/prowler/XA_AuditRole_Prowler
|
|
RoleName: XA_AuditRole_Prowler
|
|
Path: "/audit/prowler/"
|
|
ManagedPolicyArns:
|
|
- arn:aws:iam::aws:policy/SecurityAudit
|
|
- arn:aws:iam::aws:policy/AWSOrganizationsReadOnlyAccess
|
|
- arn:aws:iam::aws:policy/IAMReadOnlyAccess
|
|
AssumeRolePolicyDocument:
|
|
Version: "2012-10-17"
|
|
Statement:
|
|
- Effect: "Allow"
|
|
Principal:
|
|
AWS: # TODO: review permissions to see if this can be narrowed down - code build only perhaps
|
|
- !Sub "arn:aws:iam::${AuditorAccountId}:root"
|
|
Action:
|
|
- "sts:AssumeRole"
|
|
- Effect: "Allow"
|
|
Principal:
|
|
Service:
|
|
- "codebuild.amazonaws.com"
|
|
Action:
|
|
- "sts:AssumeRole"
|
|
# TODO: restrict to only AuditorAccount only
|
|
Policies:
|
|
- PolicyName: "ProwlerPolicyAdditions"
|
|
PolicyDocument:
|
|
Version: "2012-10-17"
|
|
Statement:
|
|
- Sid: "ProwlerPolicyAdditions"
|
|
Effect: "Allow"
|
|
Resource: "*"
|
|
Action:
|
|
- "acm:describecertificate"
|
|
- "acm:listcertificates"
|
|
- "apigateway:GET"
|
|
- "cloudtrail:GetEventSelectors"
|
|
- "ec2:GetEbsEncryptionByDefault"
|
|
- "es:describeelasticsearchdomainconfig"
|
|
- "guardduty:ListDetectors"
|
|
- "guardduty:GetDetector"
|
|
- "logs:DescribeLogGroups"
|
|
- "logs:DescribeMetricFilters"
|
|
- "s3:GetEncryptionConfiguration"
|
|
- "ses:getidentityverificationattributes"
|
|
- "sns:listsubscriptionsbytopic"
|
|
- "support:*"
|
|
- "trustedadvisor:Describe*"
|
|
|
|
Metadata:
|
|
cfn_nag:
|
|
rules_to_suppress:
|
|
- id: W28
|
|
reason: "the role name is intentionally static"
|
|
- id: W11
|
|
reason: "the policy grants read/view/audit access only, to all resources, by design"
|
|
- id: F3
|
|
reason: "Support does not allow or deny access to individual actions"
|