Skip to content

Commit 664dfaa

Browse files
LMAX-iwnfLMAX-iwnf
authored
feat(RAIN-94239): Rm modify terraform to add a policy (#127)
* Adding a new policy to avoid iam policy char limit Adding permission for FIS and codeartifact Adding tag call permissions for ses,backup,amp * Fix bug * remove empty line * Added comments to the code to explain why we need another policy Added explanation to the README file as well * Add terraform doc * Adding permission for kinesis video Adding permission for compute optimizer * Revise the name for the policy to be more verbose * Fix typo * Updated the doc * Move new permissions all into the new policy Updated readme
1 parent 109ff6c commit 664dfaa

File tree

2 files changed

+104
-3
lines changed

2 files changed

+104
-3
lines changed

‎README.md

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,15 @@ Terraform module for configuring an integration with Lacework and AWS for cloud
3838
| Name | Type |
3939
|------|------|
4040
| [aws_iam_policy.lacework_audit_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
41+
| [aws_iam_policy.lacework_audit_policy_2025_1](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
4142
| [aws_iam_role_policy_attachment.lacework_audit_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
43+
| [aws_iam_role_policy_attachment.lacework_audit_policy_attachment_b](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
4244
| [aws_iam_role_policy_attachment.security_audit_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
4345
| [lacework_integration_aws_cfg.default](https://registry.terraform.io/providers/lacework/lacework/latest/docs/resources/integration_aws_cfg) | resource |
4446
| [random_id.uniq](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
4547
| [time_sleep.wait_time](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
4648
| [aws_iam_policy_document.lacework_audit_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
49+
| [aws_iam_policy_document.lacework_audit_policy_2025_1](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
4750
| [lacework_metric_module.lwmetrics](https://registry.terraform.io/providers/lacework/lacework/latest/docs/data-sources/metric_module) | data source |
4851

4952
## Inputs
@@ -76,6 +79,7 @@ Terraform module for configuring an integration with Lacework and AWS for cloud
7679
## Lacework Audit Policy
7780

7881
The Lacework audit policy extends the SecurityAudit policy to facilitate the reading of additional configuration resources.
82+
As of 1/22/2025, we have exceeded the limit of 6144 characters for a single policy, thus every service starting with KINESISVIDEO are in a new policy: lwaudit-policy-${random_id.uniq.hex}-2025-1
7983
The audit policy is comprised of the following permissions:
8084

8185
| sid | actions | resources |
@@ -174,14 +178,18 @@ The audit policy is comprised of the following permissions:
174178
| | compute-optimizer:GetEBSVolumeRecommendations | |
175179
| | compute-optimizer:GetEC2InstanceRecommendations | |
176180
| | compute-optimizer:GetEnrollmentStatus | |
177-
| | compute-optimizer:GetEnrollmentStatusesForOrganization | |
178181
| | compute-optimizer:GetLambdaFunctionRecommendations | |
179182
| | compute-optimizer:GetRecommendationPreferences | |
180183
| | compute-optimizer:GetRecommendationSummaries | |
184+
| | compute-optimizer:GetEcsServiceRecommendations | |
185+
| | compute-optimizer:GetLicenseRecommendations | |
181186
| KINESISANALYTICS | kinesisanalytics:ListApplicationSnapshots | |
182187
| | kinesisanalytics:ListApplicationVersions | |
183188
| | kinesisanalytics:DescribeApplicationVersion | |
184189
| | kinesisanalytics:DescribeApplication | |
190+
| KINESISVIDEO | kinesisvideo:GetSignalingChannelEndpoint | * |
191+
| | kinesisvideo:GetDataEndpoint | |
192+
| | kinesisvideo:DescribeImageGenerationConfiguration | |
185193
| AMP | aps:ListScrapers | * |
186194
| | aps:DescribeScraper | |
187195
| | aps:ListWorkspaces | |
@@ -195,3 +203,23 @@ The audit policy is comprised of the following permissions:
195203
| PERSONALIZE | personalize:Describe* | |
196204
| | personalize:List* | |
197205
| | personalize:GetSolutionMetrics | |
206+
| CODEARTIFACT | codeartifact:ListDomains | * |
207+
| | codeartifact:DescribeDomain | |
208+
| | codeartifact:DescribeRepository | |
209+
| | codeartifact:ListPackages | |
210+
| | codeartifact:GetRepositoryEndpoint | |
211+
| | codeartifact:DescribePackage | |
212+
| | codeartifact:ListPackageVersions | |
213+
| | codeartifact:DescribePackageVersion | |
214+
| | codeartifact:GetPackageVersionReadme | |
215+
| | codeartifact:ListPackageVersionDependencies | |
216+
| | codeartifact:ListPackageVersionAssets | |
217+
| | codeartifact:GetPackageVersionAsset | |
218+
| FIS | fis:ListActions | * |
219+
| | fis:GetAction | |
220+
| | fis:ListExperimentTemplates | |
221+
| | fis:GetExperimentTemplate | |
222+
| | fis:ListTargetAccountConfigurations | |
223+
| | fis:ListExperiments | |
224+
| | fis:GetExperiment | |
225+
| | fis:ListExperimentResolvedTargets | |

‎main.tf

Lines changed: 75 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ locals {
55
lacework_audit_policy_name = (
66
length(var.lacework_audit_policy_name) > 0 ? var.lacework_audit_policy_name : "lwaudit-policy-${random_id.uniq.hex}"
77
)
8+
lacework_audit_policy_name_2025_1 = "${local.lacework_audit_policy_name}-2025-1"
89
version_file = "${abspath(path.module)}/VERSION"
910
module_name = "terraform-aws-config"
1011
module_version = fileexists(local.version_file) ? file(local.version_file) : ""
@@ -167,6 +168,7 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
167168
"ses:ListRecommendations",
168169
"ses:ListSuppressedDestinations",
169170
"ses:GetSuppressedDestination",
171+
"ses:ListTagsForResource",
170172
]
171173
resources = ["*"]
172174
}
@@ -197,6 +199,7 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
197199
"backup:ListRecoveryPointsByResource",
198200
"backup:ListReportPlans",
199201
"backup:ListRestoreJobs",
202+
"backup:ListTags",
200203
]
201204
resources = ["*"]
202205
}
@@ -220,10 +223,11 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
220223
"compute-optimizer:GetEBSVolumeRecommendations",
221224
"compute-optimizer:GetEC2InstanceRecommendations",
222225
"compute-optimizer:GetEnrollmentStatus",
223-
"compute-optimizer:GetEnrollmentStatusesForOrganization",
224226
"compute-optimizer:GetLambdaFunctionRecommendations",
225227
"compute-optimizer:GetRecommendationPreferences",
226-
"compute-optimizer:GetRecommendationSummaries"
228+
"compute-optimizer:GetRecommendationSummaries",
229+
"compute-optimizer:GetEcsServiceRecommendations",
230+
"compute-optimizer:GetLicenseRecommendations",
227231
]
228232
resources = ["*"]
229233
}
@@ -237,6 +241,58 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
237241
]
238242
resources = ["*"]
239243
}
244+
}
245+
246+
# AWS iam allows only 6144 characters in a single policy
247+
# We've come to a point where there are too many actions in a single policy which is causing the policy to exceed the limit
248+
# So we needed a new policy to accommodate the overflow of actions, thus we added this new policy "lacework_audit_policy_2025_1"
249+
# Which representing the first new policy in 2025
250+
data "aws_iam_policy_document" "lacework_audit_policy_2025_1" {
251+
count = var.use_existing_iam_role_policy ? 0 : 1
252+
version = "2012-10-17"
253+
254+
statement {
255+
sid = "CODEARTIFACT"
256+
actions = ["codeartifact:ListDomains",
257+
"codeartifact:DescribeDomain",
258+
"codeartifact:DescribeRepository",
259+
"codeartifact:ListPackages",
260+
"codeartifact:GetRepositoryEndpoint",
261+
"codeartifact:DescribePackage",
262+
"codeartifact:ListPackageVersions",
263+
"codeartifact:DescribePackageVersion",
264+
"codeartifact:GetPackageVersionReadme",
265+
"codeartifact:ListPackageVersionDependencies",
266+
"codeartifact:ListPackageVersionAssets",
267+
"codeartifact:GetPackageVersionAsset",
268+
"codeartifact:ListTagsForResource",
269+
]
270+
resources = ["*"]
271+
}
272+
273+
statement {
274+
sid = "FIS"
275+
actions = ["fis:ListActions",
276+
"fis:GetAction",
277+
"fis:ListExperimentTemplates",
278+
"fis:GetExperimentTemplate",
279+
"fis:ListTargetAccountConfigurations",
280+
"fis:ListExperiments",
281+
"fis:GetExperiment",
282+
"fis:ListExperimentResolvedTargets",
283+
"fis:ListTagsForResource",
284+
]
285+
resources = ["*"]
286+
}
287+
288+
statement {
289+
sid = "KINESISVIDEO"
290+
actions = ["kinesisvideo:GetSignalingChannelEndpoint",
291+
"kinesisvideo:GetDataEndpoint",
292+
"kinesisvideo:DescribeImageGenerationConfiguration",
293+
]
294+
resources = ["*"]
295+
}
240296

241297
statement {
242298
sid = "AMP"
@@ -248,6 +304,7 @@ data "aws_iam_policy_document" "lacework_audit_policy" {
248304
"aps:DescribeWorkspace",
249305
"aps:ListRuleGroupsNamespaces",
250306
"aps:DescribeRuleGroupsNamespace",
307+
"aps:ListTagsForResource",
251308
]
252309
resources = ["*"]
253310
}
@@ -278,20 +335,36 @@ resource "aws_iam_policy" "lacework_audit_policy" {
278335
tags = var.tags
279336
}
280337

338+
resource "aws_iam_policy" "lacework_audit_policy_2025_1" {
339+
count = var.use_existing_iam_role_policy ? 0 : 1
340+
name = local.lacework_audit_policy_name_2025_1
341+
description = "An audit policy to allow Lacework to read configs (extends SecurityAudit), this is the second policy"
342+
policy = data.aws_iam_policy_document.lacework_audit_policy_2025_1[0].json
343+
tags = var.tags
344+
}
345+
281346
resource "aws_iam_role_policy_attachment" "lacework_audit_policy_attachment" {
282347
count = var.use_existing_iam_role_policy ? 0 : 1
283348
role = local.iam_role_name
284349
policy_arn = aws_iam_policy.lacework_audit_policy[0].arn
285350
depends_on = [module.lacework_cfg_iam_role]
286351
}
287352

353+
resource "aws_iam_role_policy_attachment" "lacework_audit_policy_attachment_b" {
354+
count = var.use_existing_iam_role_policy ? 0 : 1
355+
role = local.iam_role_name
356+
policy_arn = aws_iam_policy.lacework_audit_policy_2025_1[0].arn
357+
depends_on = [module.lacework_cfg_iam_role]
358+
}
359+
288360
# wait for X seconds for things to settle down in the AWS side
289361
# before trying to create the Lacework external integration
290362
resource "time_sleep" "wait_time" {
291363
create_duration = var.wait_time
292364
depends_on = [
293365
aws_iam_role_policy_attachment.security_audit_policy_attachment,
294366
aws_iam_role_policy_attachment.lacework_audit_policy_attachment,
367+
aws_iam_role_policy_attachment.lacework_audit_policy_attachment_b,
295368
]
296369
}
297370

0 commit comments

Comments
 (0)