Skip to content

Commit 0a4ca76

Browse files
cyphronixcyphronix
committed
final updates to kms+s3 perms
1 parent 8087634 commit 0a4ca76

File tree

2 files changed

+57
-73
lines changed

2 files changed

+57
-73
lines changed

‎aws_sra_examples/solutions/guardduty/guardduty_org/templates/sra-guardduty-org-delivery-kms-key.yaml

Lines changed: 13 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -70,14 +70,6 @@ Conditions:
7070

7171
Resources:
7272
rGuardDutyDeliveryKey:
73-
# temp retain for troubleshooting
74-
DeletionPolicy: Retain
75-
# checkov:skip=CKV_AWS_33:Ensure KMS key policy does not contain wildcard (*) principal
76-
# Metadata:
77-
# cfn_nag:
78-
# rules_to_suppress:
79-
# - id: F76
80-
# reason: "Opt-in regions may be used and so conditional policy is required"
8173
Type: AWS::KMS::Key
8274
Properties:
8375
Description: SRA GuardDuty Delivery Key
@@ -98,17 +90,20 @@ Resources:
9890
Action: kms:GenerateDataKey
9991
Resource: '*'
10092
Principal:
101-
Service: guardduty.amazonaws.com
102-
103-
# key permissions for potential opt-in regions (conditional)
104-
- Sid: Allow opt-in GuardDuty to encrypt logs
105-
Effect: Allow
106-
Action: kms:GenerateDataKey
107-
Resource: '*'
108-
Principal:
109-
Service:
110-
- guardduty.ap-southeast-4.amazonaws.com
93+
Service:
94+
- guardduty.amazonaws.com
95+
- guardduty.af-south-1.amazonaws.com
11196
- guardduty.ap-east-1.amazonaws.com
97+
- guardduty.ap-south-2.amazonaws.com
98+
- guardduty.ap-southeast-3.amazonaws.com
99+
- guardduty.ap-southeast-4.amazonaws.com
100+
- guardduty.ca-west-1.amazonaws.com
101+
- guardduty.eu-south-1.amazonaws.com
102+
- guardduty.eu-south-2.amazonaws.com
103+
- guardduty.eu-central-2.amazonaws.com
104+
- guardduty.me-south-1.amazonaws.com
105+
- guardduty.me-central-1.amazonaws.com
106+
- guardduty.il-central-1.amazonaws.com
112107

113108
- Sid: Allow alias creation during setup
114109
Effect: Allow

‎aws_sra_examples/solutions/guardduty/guardduty_org/templates/sra-guardduty-org-delivery-s3-bucket.yaml

Lines changed: 44 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -89,13 +89,6 @@ Resources:
8989
Value: !Ref pSRASolutionName
9090

9191
rGuardDutyDeliveryS3BucketPolicy:
92-
# temp retain for troubleshooting
93-
DeletionPolicy: Retain
94-
# Metadata:
95-
# cfn_nag:
96-
# rules_to_suppress:
97-
# - id: F16
98-
# reason: "Opt-in regions may be used and so conditional policy is required"
9992
Type: AWS::S3::BucketPolicy
10093
Properties:
10194
Bucket: !Ref rGuardDutyDeliveryS3Bucket
@@ -134,19 +127,18 @@ Resources:
134127
Principal:
135128
Service:
136129
- guardduty.amazonaws.com
137-
138-
# Bucket perm/location check allow for potential opt-in regions
139-
- Sid: AWSBucketPermissionsCheckOptinRegions
140-
Effect: Allow
141-
Action:
142-
- s3:GetBucketAcl
143-
- s3:GetBucketLocation
144-
- s3:ListBucket
145-
Resource: !Sub arn:aws:s3:::${rGuardDutyDeliveryS3Bucket}
146-
Principal:
147-
Service:
148-
- guardduty.ap-southeast-4.amazonaws.com
130+
- guardduty.af-south-1.amazonaws.com
149131
- guardduty.ap-east-1.amazonaws.com
132+
- guardduty.ap-south-2.amazonaws.com
133+
- guardduty.ap-southeast-3.amazonaws.com
134+
- guardduty.ap-southeast-4.amazonaws.com
135+
- guardduty.ca-west-1.amazonaws.com
136+
- guardduty.eu-south-1.amazonaws.com
137+
- guardduty.eu-south-2.amazonaws.com
138+
- guardduty.eu-central-2.amazonaws.com
139+
- guardduty.me-south-1.amazonaws.com
140+
- guardduty.me-central-1.amazonaws.com
141+
- guardduty.il-central-1.amazonaws.com
150142

151143
- Sid: AWSBucketDelivery
152144
Effect: Allow
@@ -158,19 +150,18 @@ Resources:
158150
Principal:
159151
Service:
160152
- guardduty.amazonaws.com
161-
162-
# Bucket delivery allow for potential opt-in regions
163-
- Sid: AWSBucketDeliveryOptinRegions
164-
Effect: Allow
165-
Action: s3:PutObject
166-
# Condition:
167-
# StringEquals:
168-
# s3:x-amz-acl: bucket-owner-full-control
169-
Resource: !Sub arn:aws:s3:::${rGuardDutyDeliveryS3Bucket}/*
170-
Principal:
171-
Service:
172-
- guardduty.ap-southeast-4.amazonaws.com
153+
- guardduty.af-south-1.amazonaws.com
173154
- guardduty.ap-east-1.amazonaws.com
155+
- guardduty.ap-south-2.amazonaws.com
156+
- guardduty.ap-southeast-3.amazonaws.com
157+
- guardduty.ap-southeast-4.amazonaws.com
158+
- guardduty.ca-west-1.amazonaws.com
159+
- guardduty.eu-south-1.amazonaws.com
160+
- guardduty.eu-south-2.amazonaws.com
161+
- guardduty.eu-central-2.amazonaws.com
162+
- guardduty.me-south-1.amazonaws.com
163+
- guardduty.me-central-1.amazonaws.com
164+
- guardduty.il-central-1.amazonaws.com
174165

175166
- Sid: DenyUnencryptedObjectUploads
176167
Effect: Deny
@@ -182,19 +173,18 @@ Resources:
182173
Principal:
183174
Service:
184175
- guardduty.amazonaws.com
185-
186-
# Unencryption object upload deny for potential opt-in regions
187-
- Sid: DenyUnencryptedObjectUploadsOptinRegions
188-
Effect: Deny
189-
Action: s3:PutObject
190-
Condition:
191-
StringNotEquals:
192-
s3:x-amz-server-side-encryption: aws:kms
193-
Resource: !Sub arn:aws:s3:::${rGuardDutyDeliveryS3Bucket}/*
194-
Principal:
195-
Service:
196-
- guardduty.ap-southeast-4.amazonaws.com
176+
- guardduty.af-south-1.amazonaws.com
197177
- guardduty.ap-east-1.amazonaws.com
178+
- guardduty.ap-south-2.amazonaws.com
179+
- guardduty.ap-southeast-3.amazonaws.com
180+
- guardduty.ap-southeast-4.amazonaws.com
181+
- guardduty.ca-west-1.amazonaws.com
182+
- guardduty.eu-south-1.amazonaws.com
183+
- guardduty.eu-south-2.amazonaws.com
184+
- guardduty.eu-central-2.amazonaws.com
185+
- guardduty.me-south-1.amazonaws.com
186+
- guardduty.me-central-1.amazonaws.com
187+
- guardduty.il-central-1.amazonaws.com
198188

199189
- Sid: DenyIncorrectEncryptionHeader
200190
Effect: Deny
@@ -206,19 +196,18 @@ Resources:
206196
Principal:
207197
Service:
208198
- guardduty.amazonaws.com
209-
210-
# Incorrect encryption header deny for potential opt-in regions
211-
- Sid: DenyIncorrectEncryptionHeaderOptinRegions
212-
Effect: Deny
213-
Action: s3:PutObject
214-
Condition:
215-
StringNotEquals:
216-
s3:x-amz-server-side-encryption-aws-kms-key-id: !Sub ${pGuardDutyOrgDeliveryKMSKeyArn}
217-
Resource: !Sub arn:aws:s3:::${rGuardDutyDeliveryS3Bucket}/*
218-
Principal:
219-
Service:
220-
- guardduty.ap-southeast-4.amazonaws.com
199+
- guardduty.af-south-1.amazonaws.com
221200
- guardduty.ap-east-1.amazonaws.com
201+
- guardduty.ap-south-2.amazonaws.com
202+
- guardduty.ap-southeast-3.amazonaws.com
203+
- guardduty.ap-southeast-4.amazonaws.com
204+
- guardduty.ca-west-1.amazonaws.com
205+
- guardduty.eu-south-1.amazonaws.com
206+
- guardduty.eu-south-2.amazonaws.com
207+
- guardduty.eu-central-2.amazonaws.com
208+
- guardduty.me-south-1.amazonaws.com
209+
- guardduty.me-central-1.amazonaws.com
210+
- guardduty.il-central-1.amazonaws.com
222211

223212

224213
Outputs:

0 commit comments

Comments
 (0)