ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-08-19 09:30:21 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
0b9791ffdc6eae51a1176efc1e9cb426ba293ddd
prowler/permissions/templates/cloudformation/prowler-scan-role.yml
T

631 lines
26 KiB
YAML
Raw Blame History

AWSTemplateFormatVersion: "2010-09-09"
Description: |
This template creates the ProwlerScan IAM Role either locally in this account or across
multiple accounts via StackSets. It can deploy both simultaneously or just one option.
The role includes all read-only permissions to scan your accounts for security issues.
Contains two AWS managed policies (SecurityAudit and ViewOnlyAccess) and an inline policy.
This template is designed to be used in Prowler Cloud, but can also be used in other Prowler deployments.
If you are deploying this template to be used in Prowler Cloud please do not edit the AccountId, IAMPrincipal and ExternalId parameters.
Parameters:
# Core Prowler IAM Role Parameters
ExternalId:
Description: |
This is the External ID that Prowler will use to assume the ProwlerScan IAM Role.
Type: String
MinLength: 1
AllowedPattern: ".+"
ConstraintDescription: "ExternalId must not be empty."
AccountId:
Description: |
AWS Account ID that will assume the role created, if you are deploying this template to be used in Prowler Cloud please do not edit this.
Type: String
Default: "232136659152"
MinLength: 12
MaxLength: 12
AllowedPattern: "[0-9]{12}"
ConstraintDescription: "AccountId must be a valid AWS Account ID."
IAMPrincipal:
Description: |
The IAM principal type and name that will be allowed to assume the role created, leave an * for all the IAM principals in your AWS account. If you are deploying this template to be used in Prowler Cloud please do not edit this.
Type: String
Default: role/prowler*
EnableOrganizations:
Description: |
Enable AWS Organizations discovery permissions. Set to true only when deploying this role in the management account.
This adds read-only Organizations permissions (e.g. ListAccounts, DescribeOrganization) and StackSet management permissions.
Type: String
Default: false
AllowedValues:
- true
- false
EnableS3Integration:
Description: |
Enable S3 integration for storing Prowler scan reports.
Type: String
Default: false
AllowedValues:
- true
- false
S3IntegrationBucketName:
Description: |
The S3 bucket name where Prowler will store scan reports for your cloud providers.
Type: String
Default: ""
S3IntegrationBucketAccountId:
Description: |
The AWS Account ID owner of the S3 Bucket.
Type: String
Default: ""
# Deployment Control Parameters
DeployStackSet:
Description: |
Set to true to deploy the ProwlerScan role across multiple accounts using StackSets.
Requires delegated administrator permissions for CloudFormation StackSets.
Type: String
Default: false
AllowedValues:
- true
- false
DeployLocalRole:
Description: |
Set to true to deploy the ProwlerScan role in this account (the account where this template is deployed).
Can be used independently or in conjunction with StackSet deployment.
Type: String
Default: true
AllowedValues:
- true
- false
# StackSet Configuration Parameters
AWSOrganizationalUnitId:
Description: |
AWS Organizations OU to deploy this stackset to (e.g., ou-xxxx-yyyyyyyy or r-xxxx for root).
Only required if DeployStackSet is true.
Type: String
Default: ""
AllowedPattern: '^(ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}|r-[a-z0-9]{4,32})?$'
RetainStacksOnAccountRemoval:
Description: |
When an account is removed from the Organization or OU, should the ProwlerScan role remain in that account?
False (Recommended for security): Automatically deletes the role when accounts leave, following principle of least privilege.
True: Retains the role even after account removal, useful if accounts may temporarily leave and rejoin.
Type: String
Default: false
AllowedValues:
- true
- false
DeployFromDelegatedAdmin:
Description: |
Is this StackSet being deployed from a Delegated Administrator account (not the Organization Management Account)?
True: Deploying from a delegated admin account - uses CallAs: DELEGATED_ADMIN.
False: Deploying from the Organization Management Account - omits CallAs property.
Only required if DeployStackSet is true.
Type: String
Default: false
AllowedValues:
- true
- false
FailureTolerancePercentage:
Description: |
The percentage of accounts in which stack operations can fail before CloudFormation stops the operation.
Only applies when DeployStackSet is true.
Type: Number
Default: 10
MinValue: 0
MaxValue: 100
Conditions:
OrganizationsEnabled: !Equals [!Ref EnableOrganizations, true]
S3IntegrationEnabled: !Equals [!Ref EnableS3Integration, true]
DeployStackSetEnabled: !Equals [!Ref DeployStackSet, true]
DeployLocalRoleEnabled: !Equals [!Ref DeployLocalRole, true]
UseDelegatedAdmin: !Equals [!Ref DeployFromDelegatedAdmin, true]
Rules:
S3IntegrationRequiresParams:
RuleCondition: !Equals [!Ref EnableS3Integration, "true"]
Assertions:
- Assert: !Not [!Equals [!Ref S3IntegrationBucketName, ""]]
AssertDescription: "S3IntegrationBucketName is required when EnableS3Integration is true."
- Assert: !Not [!Equals [!Ref S3IntegrationBucketAccountId, ""]]
AssertDescription: "S3IntegrationBucketAccountId is required when EnableS3Integration is true."
Resources:
# Local ProwlerScan Role (deployed in this account)
ProwlerScan:
Type: AWS::IAM::Role
Condition: DeployLocalRoleEnabled
Properties:
RoleName: ProwlerScan
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
AWS: !Sub "arn:${AWS::Partition}:iam::${AccountId}:root"
Action: "sts:AssumeRole"
Condition:
StringEquals:
"sts:ExternalId": !Sub ${ExternalId}
StringLike:
"aws:PrincipalArn": !Sub "arn:${AWS::Partition}:iam::${AccountId}:${IAMPrincipal}"
MaxSessionDuration: 3600
ManagedPolicyArns:
- !Sub "arn:${AWS::Partition}:iam::aws:policy/SecurityAudit"
- !Sub "arn:${AWS::Partition}:iam::aws:policy/job-function/ViewOnlyAccess"
Policies:
- PolicyName: ProwlerScan
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: AllowMoreReadOnly
Effect: Allow
Action:
- "account:Get*"
- "amplify:ListApps"
- "amplify:ListBranches"
- "appstream:Describe*"
- "appstream:List*"
- "backup:List*"
- "backup:Get*"
- "bedrock:List*"
- "bedrock:Get*"
- "cloudtrail:GetInsightSelectors"
- "codeartifact:List*"
- "codebuild:BatchGet*"
- "codebuild:ListReportGroups"
- "cognito-idp:GetUserPoolMfaConfig"
- "datapipeline:DescribePipelines"
- "datapipeline:GetPipelineDefinition"
- "datapipeline:ListPipelines"
- "dlm:Get*"
- "drs:Describe*"
- "ds:Get*"
- "ds:Describe*"
- "ds:List*"
- "dynamodb:GetResourcePolicy"
- "ec2:GetEbsEncryptionByDefault"
- "ec2:GetSnapshotBlockPublicAccessState"
- "ec2:GetInstanceMetadataDefaults"
- "ecr:Describe*"
- "ecr:GetRegistryScanningConfiguration"
- "ecr:BatchGetImage"
- "ecr:GetDownloadUrlForLayer"
- "elasticfilesystem:DescribeBackupPolicy"
- "glue:GetConnections"
- "glue:GetSecurityConfiguration*"
- "glue:SearchTables"
- "glue:GetMLTransforms"
- "lambda:GetFunction*"
- "logs:FilterLogEvents"
- "lightsail:GetRelationalDatabases"
- "macie2:GetMacieSession"
- "macie2:GetAutomatedDiscoveryConfiguration"
- "rolesanywhere:ListProfiles"
- "rolesanywhere:ListTagsForResource"
- "rolesanywhere:ListTrustAnchors"
- "s3:GetAccountPublicAccessBlock"
- "shield:DescribeProtection"
- "shield:GetSubscriptionState"
- "securityhub:GetFindings"
- "servicecatalog:Describe*"
- "servicecatalog:List*"
- "ssm:GetDocument"
- "ssm-incidents:List*"
- "states:ListTagsForResource"
- "support:Describe*"
- "tag:GetTagKeys"
- "wellarchitected:List*"
Resource: "*"
- Sid: AllowSecurityHubImportFindings
Effect: Allow
Action:
- "securityhub:BatchImportFindings"
Resource: "*"
- Sid: AllowAPIGatewayReadOnly
Effect: Allow
Action:
- "apigateway:GET"
Resource:
- !Sub "arn:${AWS::Partition}:apigateway:*::/restapis/*"
- !Sub "arn:${AWS::Partition}:apigateway:*::/apis/*"
- !Sub "arn:${AWS::Partition}:apigateway:*::/domainnames"
- !Sub "arn:${AWS::Partition}:apigateway:*::/domainnames/*"
- !If
- OrganizationsEnabled
- PolicyName: ProwlerOrganizations
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: AllowOrganizationsReadOnly
Effect: Allow
Action:
- "organizations:DescribeAccount"
- "organizations:DescribeOrganization"
- "organizations:ListAccounts"
- "organizations:ListAccountsForParent"
- "organizations:ListOrganizationalUnitsForParent"
- "organizations:ListRoots"
- "organizations:ListTagsForResource"
Resource: "*"
- Sid: AllowStackSetManagement
Effect: Allow
Action:
- "organizations:RegisterDelegatedAdministrator"
Resource: "*"
- Sid: AllowCreateStackSetSLR
Effect: Allow
Action:
- "iam:CreateServiceLinkedRole"
Resource: !Sub "arn:${AWS::Partition}:iam::*:role/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/*"
- !Ref AWS::NoValue
- !If
- S3IntegrationEnabled
- PolicyName: S3Integration
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- "s3:PutObject"
Resource:
- !Sub "arn:${AWS::Partition}:s3:::${S3IntegrationBucketName}/*"
Condition:
StringEquals:
"s3:ResourceAccount": !Sub ${S3IntegrationBucketAccountId}
- Effect: Allow
Action:
- "s3:ListBucket"
Resource:
- !Sub "arn:${AWS::Partition}:s3:::${S3IntegrationBucketName}"
Condition:
StringEquals:
"s3:ResourceAccount": !Sub ${S3IntegrationBucketAccountId}
- Effect: Allow
Action:
- "s3:DeleteObject"
Resource:
- !Sub "arn:${AWS::Partition}:s3:::${S3IntegrationBucketName}/*test-prowler-connection.txt"
Condition:
StringEquals:
"s3:ResourceAccount": !Sub ${S3IntegrationBucketAccountId}
- !Ref AWS::NoValue
Tags:
- Key: "Service"
Value: "https://prowler.com"
- Key: "Support"
Value: "support@prowler.com"
- Key: "CloudFormation"
Value: "true"
- Key: "Name"
Value: "ProwlerScan"
# StackSet for deploying ProwlerScan role across multiple accounts
ProwlerScanStackSet:
Type: AWS::CloudFormation::StackSet
Condition: DeployStackSetEnabled
Properties:
StackSetName: !Sub "${AWS::StackName}-ProwlerScan-StackSet"
Description: Organizational StackSet to Deploy ProwlerScan IAM Role across accounts
PermissionModel: SERVICE_MANAGED
CallAs: !If [UseDelegatedAdmin, DELEGATED_ADMIN, !Ref "AWS::NoValue"]
Capabilities:
- CAPABILITY_NAMED_IAM
AutoDeployment:
Enabled: True
RetainStacksOnAccountRemoval: !Ref RetainStacksOnAccountRemoval
OperationPreferences:
FailureTolerancePercentage: !Ref FailureTolerancePercentage
MaxConcurrentPercentage: 100
Parameters:
- ParameterKey: ExternalId
ParameterValue: !Ref ExternalId
- ParameterKey: AccountId
ParameterValue: !Ref AccountId
- ParameterKey: IAMPrincipal
ParameterValue: !Ref IAMPrincipal
- ParameterKey: EnableOrganizations
ParameterValue: !Ref EnableOrganizations
- ParameterKey: EnableS3Integration
ParameterValue: !Ref EnableS3Integration
- ParameterKey: S3IntegrationBucketName
ParameterValue: !Ref S3IntegrationBucketName
- ParameterKey: S3IntegrationBucketAccountId
ParameterValue: !Ref S3IntegrationBucketAccountId
StackInstancesGroup:
- DeploymentTargets:
OrganizationalUnitIds:
- !Ref AWSOrganizationalUnitId
Regions:
- us-east-1
TemplateBody: |
AWSTemplateFormatVersion: "2010-09-09"
Description: |
This template creates the ProwlerScan IAM Role in this account with
all read-only permissions to scan your account for security issues.
Contains two AWS managed policies (SecurityAudit and ViewOnlyAccess) and an inline policy.
It sets the trust policy on that IAM Role to permit Prowler to assume that role.
This template is designed to be used in Prowler Cloud, but can also be used in other Prowler deployments.
** DEPLOYED VIA SERVICE-MANAGED STACKSET **
This stack was automatically deployed across your organization using CloudFormation StackSets
with SERVICE_MANAGED permissions. It will auto-deploy to new accounts and can be centrally managed.
Parameters:
ExternalId:
Description: |
This is the External ID that Prowler will use to assume the role ProwlerScan IAM Role.
Type: String
MinLength: 1
AllowedPattern: ".+"
ConstraintDescription: "ExternalId must not be empty."
AccountId:
Description: |
AWS Account ID that will assume the role created, if you are deploying this template to be used in Prowler Cloud please do not edit this.
Type: String
Default: "232136659152"
MinLength: 12
MaxLength: 12
AllowedPattern: "[0-9]{12}"
ConstraintDescription: "AccountId must be a valid AWS Account ID."
IAMPrincipal:
Description: |
The IAM principal type and name that will be allowed to assume the role created, leave an * for all the IAM principals in your AWS account. If you are deploying this template to be used in Prowler Cloud please do not edit this.
Type: String
Default: role/prowler*
EnableOrganizations:
Description: |
Enable AWS Organizations discovery permissions. Set to true only when deploying this role in the management account.
This adds read-only Organizations permissions (e.g. ListAccounts, DescribeOrganization) and StackSet management permissions.
Type: String
Default: false
AllowedValues:
- true
- false
EnableS3Integration:
Description: |
Enable S3 integration for storing Prowler scan reports.
Type: String
Default: false
AllowedValues:
- true
- false
S3IntegrationBucketName:
Description: |
The S3 bucket name where Prowler will store scan reports for your cloud providers.
Type: String
Default: ""
S3IntegrationBucketAccountId:
Description: |
The AWS Account ID owner of the S3 Bucket.
Type: String
Default: ""
Conditions:
OrganizationsEnabled: !Equals [!Ref EnableOrganizations, true]
S3IntegrationEnabled: !Equals [!Ref EnableS3Integration, true]
Resources:
ProwlerScan:
Type: AWS::IAM::Role
Properties:
RoleName: ProwlerScan
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Principal:
AWS: !Sub "arn:${AWS::Partition}:iam::${AccountId}:root"
Action: "sts:AssumeRole"
Condition:
StringEquals:
"sts:ExternalId": !Sub ${ExternalId}
StringLike:
"aws:PrincipalArn": !Sub "arn:${AWS::Partition}:iam::${AccountId}:${IAMPrincipal}"
MaxSessionDuration: 3600
ManagedPolicyArns:
- !Sub "arn:${AWS::Partition}:iam::aws:policy/SecurityAudit"
- !Sub "arn:${AWS::Partition}:iam::aws:policy/job-function/ViewOnlyAccess"
Policies:
- PolicyName: ProwlerScan
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: AllowMoreReadOnly
Effect: Allow
Action:
- "account:Get*"
- "appstream:Describe*"
- "appstream:List*"
- "backup:List*"
- "backup:Get*"
- "bedrock:List*"
- "bedrock:Get*"
- "cloudtrail:GetInsightSelectors"
- "codeartifact:List*"
- "codebuild:BatchGet*"
- "codebuild:ListReportGroups"
- "cognito-idp:GetUserPoolMfaConfig"
- "dlm:Get*"
- "drs:Describe*"
- "ds:Get*"
- "ds:Describe*"
- "ds:List*"
- "dynamodb:GetResourcePolicy"
- "ec2:GetEbsEncryptionByDefault"
- "ec2:GetSnapshotBlockPublicAccessState"
- "ec2:GetInstanceMetadataDefaults"
- "ecr:Describe*"
- "ecr:GetRegistryScanningConfiguration"
- "ecr:BatchGetImage"
- "ecr:GetDownloadUrlForLayer"
- "elasticfilesystem:DescribeBackupPolicy"
- "glue:GetConnections"
- "glue:GetSecurityConfiguration*"
- "glue:SearchTables"
- "glue:GetMLTransforms"
- "lambda:GetFunction*"
- "logs:FilterLogEvents"
- "lightsail:GetRelationalDatabases"
- "macie2:GetMacieSession"
- "macie2:GetAutomatedDiscoveryConfiguration"
- "s3:GetAccountPublicAccessBlock"
- "shield:DescribeProtection"
- "shield:GetSubscriptionState"
- "securityhub:GetFindings"
- "servicecatalog:Describe*"
- "servicecatalog:List*"
- "ssm:GetDocument"
- "ssm-incidents:List*"
- "states:ListTagsForResource"
- "support:Describe*"
- "tag:GetTagKeys"
- "wellarchitected:List*"
Resource: "*"
- Sid: AllowSecurityHubImportFindings
Effect: Allow
Action:
- "securityhub:BatchImportFindings"
Resource: "*"
- Sid: AllowAPIGatewayReadOnly
Effect: Allow
Action:
- "apigateway:GET"
Resource:
- !Sub "arn:${AWS::Partition}:apigateway:*::/restapis/*"
- !Sub "arn:${AWS::Partition}:apigateway:*::/apis/*"
- !Sub "arn:${AWS::Partition}:apigateway:*::/domainnames"
- !Sub "arn:${AWS::Partition}:apigateway:*::/domainnames/*"
- !If
- OrganizationsEnabled
- PolicyName: ProwlerOrganizations
PolicyDocument:
Version: "2012-10-17"
Statement:
- Sid: AllowOrganizationsReadOnly
Effect: Allow
Action:
- "organizations:DescribeAccount"
- "organizations:DescribeOrganization"
- "organizations:ListAccounts"
- "organizations:ListAccountsForParent"
- "organizations:ListOrganizationalUnitsForParent"
- "organizations:ListRoots"
- "organizations:ListTagsForResource"
Resource: "*"
- Sid: AllowStackSetManagement
Effect: Allow
Action:
- "organizations:RegisterDelegatedAdministrator"
Resource: "*"
- Sid: AllowCreateStackSetSLR
Effect: Allow
Action:
- "iam:CreateServiceLinkedRole"
Resource: !Sub "arn:${AWS::Partition}:iam::*:role/aws-service-role/member.org.stacksets.cloudformation.amazonaws.com/*"
- !Ref AWS::NoValue
- !If
- S3IntegrationEnabled
- PolicyName: S3Integration
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- "s3:PutObject"
Resource:
- !Sub "arn:${AWS::Partition}:s3:::${S3IntegrationBucketName}/*"
Condition:
StringEquals:
"s3:ResourceAccount": !Sub ${S3IntegrationBucketAccountId}
- Effect: Allow
Action:
- "s3:ListBucket"
Resource:
- !Sub "arn:${AWS::Partition}:s3:::${S3IntegrationBucketName}"
Condition:
StringEquals:
"s3:ResourceAccount": !Sub ${S3IntegrationBucketAccountId}
- Effect: Allow
Action:
- "s3:DeleteObject"
Resource:
- !Sub "arn:${AWS::Partition}:s3:::${S3IntegrationBucketName}/*test-prowler-connection.txt"
Condition:
StringEquals:
"s3:ResourceAccount": !Sub ${S3IntegrationBucketAccountId}
- !Ref AWS::NoValue
Tags:
- Key: "Service"
Value: "https://prowler.com"
- Key: "Support"
Value: "support@prowler.com"
- Key: "CloudFormation"
Value: "true"
- Key: "Name"
Value: "ProwlerScan"
Outputs:
ProwlerScanRoleArn:
Description: "ARN of the ProwlerScan IAM Role"
Value: !GetAtt ProwlerScan.Arn
Export:
Name: !Sub "${AWS::StackName}-ProwlerScanRoleArn"
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
default: Deployment Options
Parameters:
- DeployLocalRole
- DeployStackSet
- Label:
default: Required Prowler Configuration
Parameters:
- ExternalId
- AccountId
- IAMPrincipal
- EnableOrganizations
- EnableS3Integration
- Label:
default: Optional S3 Integration
Parameters:
- S3IntegrationBucketName
- S3IntegrationBucketAccountId
- Label:
default: StackSet Configuration (Required if DeployStackSet is true)
Parameters:
- AWSOrganizationalUnitId
- DeployFromDelegatedAdmin
- RetainStacksOnAccountRemoval
- FailureTolerancePercentage
Outputs:
LocalProwlerScanRoleArn:
Condition: DeployLocalRoleEnabled
Description: "ARN of the ProwlerScan IAM Role deployed locally in this account"
Value: !GetAtt ProwlerScan.Arn
Export:
Name: !Sub "${AWS::StackName}-ProwlerScanRoleArn"
StackSetId:
Condition: DeployStackSetEnabled
Description: "StackSet ID for the ProwlerScan role deployment across accounts"
Value: !Ref ProwlerScanStackSet
Reference in New Issue View Git Blame Copy Permalink