Skip to content

Commit d1881fa

Browse files
jdnojdno
authored
Merge pull request #336 from jdno/wiz-role
Deploy custom role for Wiz integration
2 parents f3ae744 + 463b19e commit d1881fa

File tree

5 files changed

+250
-7
lines changed

5 files changed

+250
-7
lines changed

‎terragrunt/modules/wiz/_terraform.tf

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
terraform {
2+
required_version = "~> 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = "~> 4.20"
8+
}
9+
}
10+
}
11+

‎terragrunt/modules/wiz/main.tf

+184-5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,185 @@
1-
module "wiz" {
2-
source = "https://s3-us-east-2.amazonaws.com/wizio-public/deployment-v2/aws/wiz-aws-native-terraform-terraform-module.zip"
3-
remote-arn = "arn:aws:iam::830522659852:role/prod-us43-AssumeRoleDelegator"
4-
external-id = "fc959d31-537c-4108-8b87-9af9e0c9b8d2"
5-
data-scanning = false
1+
resource "aws_iam_role_policy" "tf-policy" {
2+
name = "WizCustomPolicy"
3+
role = aws_iam_role.user-role-tf.id
4+
5+
policy = jsonencode({
6+
"Statement" : [
7+
{
8+
"Action" : [
9+
"acm:GetCertificate",
10+
"apigateway:GET",
11+
"backup:DescribeGlobalSettings",
12+
"backup:GetBackupVaultAccessPolicy",
13+
"backup:GetBackupVaultNotifications",
14+
"backup:ListBackupVaults",
15+
"backup:ListTags",
16+
"cloudtrail:GetInsightSelectors",
17+
"cloudtrail:ListTrails",
18+
"codebuild:BatchGetProjects",
19+
"codebuild:GetResourcePolicy",
20+
"codebuild:ListProjects",
21+
"cognito-identity:DescribeIdentityPool",
22+
"connect:ListInstances",
23+
"connect:ListInstanceAttributes",
24+
"connect:ListInstanceStorageConfigs",
25+
"connect:ListSecurityKeys",
26+
"connect:ListLexBots",
27+
"connect:ListLambdaFunctions",
28+
"connect:ListApprovedOrigins",
29+
"connect:ListIntegrationAssociations",
30+
"dynamodb:DescribeExport",
31+
"dynamodb:DescribeKinesisStreamingDestination",
32+
"dynamodb:ListExports",
33+
"ec2:GetEbsEncryptionByDefault",
34+
"ec2:SearchTransitGatewayRoutes",
35+
"ecr:BatchGetImage",
36+
"ecr:DescribeImages",
37+
"ecr:GetAuthorizationToken",
38+
"ecr:GetDownloadUrlForLayer",
39+
"ecr:ListTagsForResource",
40+
"ecr:GetRegistryPolicy",
41+
"ecr:DescribeRegistry",
42+
"ecr-public:BatchGetImage",
43+
"ecr-public:DescribeImages",
44+
"ecr-public:GetAuthorizationToken",
45+
"ecr-public:GetDownloadUrlForLayer",
46+
"ecr-public:ListTagsForResource",
47+
"ecr-public:GetRegistryPolicy",
48+
"eks:ListTagsForResource",
49+
"elasticfilesystem:DescribeAccessPoints",
50+
"elasticfilesystem:DescribeFileSystemPolicy",
51+
"elasticmapreduce:GetAutoTerminationPolicy",
52+
"elasticmapreduce:GetManagedScalingPolicy",
53+
"emr-serverless:ListApplications",
54+
"emr-serverless:ListJobRuns",
55+
"ssm:GetDocument",
56+
"ssm:GetServiceSetting",
57+
"glacier:GetDataRetrievalPolicy",
58+
"glacier:GetVaultLock",
59+
"glue:GetConnection",
60+
"glue:GetSecurityConfiguration",
61+
"glue:GetTags",
62+
"health:DescribeAffectedAccountsForOrganization",
63+
"health:DescribeAffectedEntities",
64+
"health:DescribeAffectedEntitiesForOrganization",
65+
"health:DescribeEntityAggregates",
66+
"health:DescribeEventAggregates",
67+
"health:DescribeEventDetails",
68+
"health:DescribeEventDetailsForOrganization",
69+
"health:DescribeEventTypes",
70+
"health:DescribeEvents",
71+
"health:DescribeEventsForOrganization",
72+
"health:DescribeHealthServiceStatusForOrganization",
73+
"kafka:ListClusters",
74+
"kendra:DescribeDataSource",
75+
"kendra:DescribeIndex",
76+
"kendra:ListDataSources",
77+
"kendra:ListIndices",
78+
"kendra:ListTagsForResource",
79+
"kinesisanalytics:ListApplications",
80+
"kinesisanalytics:DescribeApplication",
81+
"kinesisanalytics:ListTagsForResource",
82+
"kinesisvideo:ListStreams",
83+
"kinesisvideo:ListTagsForStream",
84+
"kinesisvideo:GetDataEndpoint",
85+
"kms:GetKeyRotationStatus",
86+
"kms:ListResourceTags",
87+
"lambda:GetFunction",
88+
"lambda:GetLayerVersion",
89+
"logs:ListTagsForResource",
90+
"profile:GetDomain",
91+
"profile:ListDomains",
92+
"profile:ListIntegrations",
93+
"s3:GetBucketNotification",
94+
"s3:GetMultiRegionAccessPointPolicy",
95+
"s3:ListMultiRegionAccessPoints",
96+
"ses:DescribeActiveReceiptRuleSet",
97+
"ses:GetAccount",
98+
"ses:GetConfigurationSet",
99+
"ses:GetConfigurationSetEventDestinations",
100+
"ses:GetDedicatedIps",
101+
"ses:GetEmailIdentity",
102+
"ses:ListConfigurationSets",
103+
"ses:ListDedicatedIpPools",
104+
"ses:ListReceiptFilters",
105+
"voiceid:DescribeDomain",
106+
"wafv2:GetLoggingConfiguration",
107+
"wafv2:GetWebACLForResource",
108+
"wisdom:GetAssistant",
109+
"macie2:ListFindings",
110+
"macie2:GetFindings",
111+
"identitystore:List*",
112+
"identitystore:Describe*",
113+
"sso-directory:Describe*",
114+
"sso-directory:ListMembersInGroup",
115+
"cloudwatch:GetMetricStatistics"
116+
],
117+
"Effect" : "Allow",
118+
"Resource" : "*"
119+
},
120+
{
121+
"Action" : [
122+
"ec2:CopySnapshot",
123+
"ec2:CreateSnapshot",
124+
"ec2:GetEbsEncryptionByDefault",
125+
"ec2:DescribeSnapshots"
126+
],
127+
"Effect" : "Allow",
128+
"Resource" : "*"
129+
},
130+
{
131+
"Action" : [
132+
"ec2:CreateTags"
133+
],
134+
"Effect" : "Allow",
135+
"Resource" : "arn:aws:ec2:*::snapshot/*"
136+
},
137+
{
138+
"Action" : "kms:CreateAlias",
139+
"Effect" : "Allow",
140+
"Resource" : [
141+
"arn:aws:kms:*:*:alias/wizKey",
142+
"arn:aws:kms:*:*:key/*"
143+
]
144+
},
145+
{
146+
"Action" : [
147+
"kms:GetKeyPolicy",
148+
"kms:PutKeyPolicy"
149+
],
150+
"Condition" : {
151+
"StringEquals" : {
152+
"aws:ResourceTag/wiz" : "auto-gen-cmk"
153+
}
154+
},
155+
"Effect" : "Allow",
156+
"Resource" : "*"
157+
},
158+
{
159+
"Action" : [
160+
"ec2:DeleteSnapshot",
161+
"ec2:ModifySnapshotAttribute"
162+
],
163+
"Condition" : {
164+
"StringEquals" : {
165+
"ec2:ResourceTag/wiz" : "auto-gen-snapshot"
166+
}
167+
},
168+
"Effect" : "Allow",
169+
"Resource" : "*"
170+
},
171+
{
172+
"Action" : [
173+
"s3:GetObject"
174+
],
175+
"Effect" : "Deny",
176+
"Resource" : [
177+
"*"
178+
],
179+
"Sid" : "WizAccessS3"
180+
}
181+
]
182+
"Version" : "2012-10-17"
183+
}
184+
)
6185
}

‎terragrunt/modules/wiz/outputs.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
output "wiz_connector_arn" {
2-
value = module.wiz.role_arn
1+
output "role_arn" {
2+
value = aws_iam_role.user-role-tf.arn
33
}

‎terragrunt/modules/wiz/role.tf

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
resource "aws_iam_role" "user-role-tf" {
2+
name = var.rolename
3+
assume_role_policy = jsonencode(
4+
{
5+
"Version" : "2012-10-17",
6+
"Statement" : [
7+
{
8+
"Effect" : "Allow",
9+
"Principal" : {
10+
"AWS" : var.remote-arn
11+
},
12+
"Action" : "sts:AssumeRole",
13+
"Condition" : {
14+
"StringEquals" : {
15+
"sts:ExternalId" : var.external-id
16+
}
17+
}
18+
}
19+
]
20+
}
21+
)
22+
}
23+
24+
data "aws_iam_policy" "view_only_access" {
25+
arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
26+
}
27+
28+
data "aws_iam_policy" "security_audit" {
29+
arn = "arn:aws:iam::aws:policy/SecurityAudit"
30+
}
31+
32+
resource "aws_iam_role_policy_attachment" "view_only_access_role_policy_attach" {
33+
role = aws_iam_role.user-role-tf.name
34+
policy_arn = data.aws_iam_policy.view_only_access.arn
35+
}
36+
resource "aws_iam_role_policy_attachment" "security_audit_role_policy_attach" {
37+
role = aws_iam_role.user-role-tf.name
38+
policy_arn = data.aws_iam_policy.security_audit.arn
39+
}

‎terragrunt/modules/wiz/variables.tf

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
variable "external-id" {
2+
type = string
3+
default = "fc959d31-537c-4108-8b87-9af9e0c9b8d2"
4+
}
5+
6+
variable "rolename" {
7+
type = string
8+
default = "WizAccess-Role"
9+
}
10+
11+
variable "remote-arn" {
12+
type = string
13+
default = "arn:aws:iam::830522659852:role/prod-us43-AssumeRoleDelegator"
14+
}

0 commit comments

Comments
 (0)