fix(modules): stackset exec role perms (#129)

sysdiglabs · Sep 10, 2024 · f89a3bf · f89a3bf
1 parent 7bccfe6
commit f89a3bf
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/modules/log_ingestion.events.cft.yaml b/modules/log_ingestion.events.cft.yaml
@@ -136,6 +136,7 @@ Resources:
           - sts:AssumeRole
       ManagedPolicyArns:
       - arn:aws:iam::aws:policy/AmazonEventBridgeFullAccess
+      - arn:aws:iam::aws:policy/AWSCloudFormationFullAccess
   EventBridgeRole:
     Type: AWS::IAM::Role
     Properties:

diff --git a/modules/volume_access.cft.yaml b/modules/volume_access.cft.yaml
@@ -185,6 +185,7 @@ Resources:
           - sts:AssumeRole
       ManagedPolicyArns:
       - arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser
+      - arn:aws:iam::aws:policy/AWSCloudFormationFullAccess
   ScanningKmsKeyStackSet:
     Type: AWS::CloudFormation::StackSet
     Properties:
@@ -255,6 +256,7 @@ Resources:
                   Principal:
                     AWS:
                     - !Sub "arn:aws:iam::${AWS::AccountId}:root"
+                    - !Sub arn:aws:iam::${AWS::AccountId}:role/sysdig-secure-scanning-stackset-execution-${NameSuffix}
                   Action: "kms:*"
                   Resource: "*"
           ScanningKmsAlias:
@@ -466,6 +468,12 @@ Resources:
                     - !Sub "arn:aws:iam::${AWS::AccountId}:root"
                   Action: "kms:*"
                   Resource: "*"
+                - Sid: "AllowDeploymentManagement"
+                  Effect: "Allow"
+                  Principal:
+                    Service: "cloudformation.amazonaws.com"
+                  Action: "kms:*"
+                  Resource: "*"
           ScanningKmsAlias:
             Type: 'AWS::KMS::Alias'
             Properties: