Skip to content

Commit a0817c9

Browse files
lorenzo-mericilorenzo-merici
committed
revert templates changes
1 parent 4dfb86c commit a0817c9

File tree

4 files changed

+18
-294
lines changed

4 files changed

+18
-294
lines changed

‎templates_cloudlogs/CloudLogs.yaml

+7-81
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
AWSTemplateFormatVersion: "2010-09-09"
22
Description: >
3-
CloudFormation template for provisioning the necessary resources for the
4-
`cloud-logs` component. This includes IAM roles, policies, and optional SNS
5-
topic and subscription for CloudTrail notifications.
3+
CloudFormation single template for provisioning
4+
the necessary resources for the `cloud-logs`
5+
component.
66
77
Metadata:
88
AWS::CloudFormation::Interface:
@@ -14,9 +14,6 @@ Metadata:
1414
- ExternalID
1515
- TrustedIdentity
1616
- BucketARN
17-
- CreateTopic
18-
- TopicARN
19-
- Endpoint
2017

2118
ParameterLabels:
2219
CloudLogsRoleName:
@@ -27,50 +24,22 @@ Metadata:
2724
default: "Trusted Identity (Sysdig use only)"
2825
BucketARN:
2926
default: "Bucket ARN"
30-
CreateTopic:
31-
default: "Create SNS Topic"
32-
TopicARN:
33-
default: "SNS Topic ARN"
34-
Endpoint:
35-
default: "Sysdig Secure endpoint"
3627

3728
Parameters:
3829
CloudLogsRoleName:
3930
Type: String
40-
Description: The name of the IAM Role that will enable access to the CloudTrail logs.
41-
31+
Description: The name of the IAM Role that will enable access to the Cloudtrail logs.
4232
ExternalID:
4333
Type: String
4434
Description: Random string generated unique to a customer.
45-
4635
TrustedIdentity:
4736
Type: String
48-
Description: The name of Sysdig's trusted identity.
49-
37+
Description: The name of Sysdig trusted identity.
5038
BucketARN:
5139
Type: String
52-
Description: The ARN of your S3 bucket associated with your CloudTrail trail.
53-
54-
CreateTopic:
55-
Type: String
56-
AllowedValues:
57-
- "true"
58-
- "false"
59-
Default: "false"
60-
Description: "Whether to create a new SNS Topic for CloudTrail notifications."
61-
62-
TopicARN:
63-
Type: String
64-
Default: ""
65-
Description: "The ARN of an existing SNS Topic. If CreateTopic is true, this will be used as the name of the new topic."
66-
67-
Endpoint:
68-
Type: String
69-
Default: ""
70-
Description: "Sysdig Secure endpoint to receive CloudTrail notifications."
40+
Description: The ARN of your s3 bucket associated with your Cloudtrail trail.
7141

7242
Resources:
73-
# IAM Role
7443
CloudLogsRole:
7544
Type: "AWS::IAM::Role"
7645
Properties:
@@ -86,8 +55,6 @@ Resources:
8655
Condition:
8756
StringEquals:
8857
"sts:ExternalId": !Ref ExternalID
89-
90-
# IAM Policy
9158
CloudLogsRolePolicies:
9259
Type: "AWS::IAM::Policy"
9360
Properties:
@@ -110,45 +77,4 @@ Resources:
11077
- !Sub '${BucketARN}'
11178
- !Sub '${BucketARN}/*'
11279
Roles:
113-
- !Ref CloudLogsRole
114-
115-
CloudTrailNotificationsTopic:
116-
Condition: CreateSNSTopic
117-
Type: "AWS::SNS::Topic"
118-
Properties:
119-
TopicName: !Select [ 5, !Split [ ":", !Ref TopicARN ] ]
120-
121-
CloudTrailNotificationsSubscription:
122-
Type: "AWS::SNS::Subscription"
123-
Properties:
124-
TopicArn: !If [ CreateSNSTopic, !Ref CloudTrailNotificationsTopic, !Ref TopicARN ]
125-
Protocol: "https"
126-
Endpoint: !Ref Endpoint
127-
128-
CloudTrailNotificationsPolicy:
129-
Condition: CreateSNSTopic
130-
Type: "AWS::SNS::TopicPolicy"
131-
Properties:
132-
Topics:
133-
- !Ref CloudTrailNotificationsTopic
134-
PolicyDocument:
135-
Version: "2012-10-17"
136-
Statement:
137-
- Sid: "AllowCloudTrailPublish"
138-
Effect: "Allow"
139-
Principal:
140-
Service: "cloudtrail.amazonaws.com"
141-
Action: "SNS:Publish"
142-
Resource: !Ref CloudTrailNotificationsTopic
143-
144-
Conditions:
145-
CreateSNSTopic: !Equals [!Ref CreateTopic, "true"]
146-
147-
Outputs:
148-
RoleARN:
149-
Description: "The ARN of the IAM Role created for CloudTrail logs."
150-
Value: !GetAtt CloudLogsRole.Arn
151-
152-
TopicARN:
153-
Description: "The ARN of the SNS Topic created for CloudTrail notifications."
154-
Value: !If [CreateSNSTopic, !Ref CloudTrailNotificationsTopic, !Ref TopicARN]
80+
- Ref: "CloudLogsRole"

‎templates_cloudlogs/OrgCloudLogs.yaml

+7-72
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
AWSTemplateFormatVersion: "2010-09-09"
22
Description: >
33
CloudFormation organizational template for provisioning
4-
the necessary resources for the `cloud-logs` component and the read-only role required to interact with the target organizational environment.
4+
the necessary resources for the `cloud-logs`
5+
component and the read-only role required to itneract with
6+
the target organizational environment.
57
68
Metadata:
79
AWS::CloudFormation::Interface:
@@ -14,9 +16,6 @@ Metadata:
1416
- ExternalID
1517
- TrustedIdentity
1618
- BucketARN
17-
- CreateTopic
18-
- TopicARN
19-
- Endpoint
2019

2120
ParameterLabels:
2221
CSPMRoleName:
@@ -29,44 +28,23 @@ Metadata:
2928
default: "Trusted Identity (Sysdig use only)"
3029
BucketARN:
3130
default: "Bucket ARN"
32-
CreateTopic:
33-
default: "Create SNS Topic"
34-
TopicARN:
35-
default: "SNS Topic ARN"
36-
Endpoint:
37-
default: "Sysdig Secure endpoint"
3831

3932
Parameters:
4033
CSPMRoleName:
4134
Type: String
4235
Description: The name of the read-only IAM Role that Sysdig will use to interact with the target environment
4336
CloudLogsRoleName:
4437
Type: String
45-
Description: The name of the IAM Role that will enable access to the CloudTrail logs.
38+
Description: The name of the IAM Role that will enable access to the Cloudtrail logs.
4639
ExternalID:
4740
Type: String
4841
Description: Random string generated unique to a customer.
4942
TrustedIdentity:
5043
Type: String
51-
Description: The name of Sysdig's trusted identity.
44+
Description: The name of Sysdig trusted identity.
5245
BucketARN:
5346
Type: String
54-
Description: The ARN of your S3 bucket associated with your CloudTrail trail.
55-
CreateTopic:
56-
Type: String
57-
AllowedValues:
58-
- "true"
59-
- "false"
60-
Default: "false"
61-
Description: "Whether to create a new SNS Topic for CloudTrail notifications."
62-
TopicARN:
63-
Type: String
64-
Default: ""
65-
Description: "The ARN of an existing SNS Topic. If CreateTopic is true, this will be used as the name of the new topic."
66-
Endpoint:
67-
Type: String
68-
Default: ""
69-
Description: "Sysdig Secure endpoint to receive CloudTrail notifications."
47+
Description: The ARN of your s3 bucket associated with your Cloudtrail trail.
7048

7149
Resources:
7250
CloudLogsRole:
@@ -84,7 +62,6 @@ Resources:
8462
Condition:
8563
StringEquals:
8664
"sts:ExternalId": !Ref ExternalID
87-
8865
CloudLogsRolePolicies:
8966
Type: "AWS::IAM::Policy"
9067
Properties:
@@ -107,8 +84,7 @@ Resources:
10784
- !Sub '${BucketARN}'
10885
- !Sub '${BucketARN}/*'
10986
Roles:
110-
- !Ref CloudLogsRole
111-
87+
- Ref: "CloudLogsRole"
11288
CloudAgentlessRole:
11389
Type: "AWS::IAM::Role"
11490
Properties:
@@ -125,44 +101,3 @@ Resources:
125101
sts:ExternalId: !Ref ExternalID
126102
ManagedPolicyArns:
127103
- arn:aws:iam::aws:policy/SecurityAudit
128-
129-
CloudTrailNotificationsTopic:
130-
Condition: CreateSNSTopic
131-
Type: "AWS::SNS::Topic"
132-
Properties:
133-
TopicName: !Select [ 5, !Split [ ":", !Ref TopicARN ] ]
134-
135-
CloudTrailNotificationsSubscription:
136-
Type: "AWS::SNS::Subscription"
137-
Properties:
138-
TopicArn: !If [ CreateSNSTopic, !Ref CloudTrailNotificationsTopic, !Ref TopicARN ]
139-
Protocol: "https"
140-
Endpoint: !Ref Endpoint
141-
142-
CloudTrailNotificationsPolicy:
143-
Condition: CreateSNSTopic
144-
Type: "AWS::SNS::TopicPolicy"
145-
Properties:
146-
Topics:
147-
- !Ref CloudTrailNotificationsTopic
148-
PolicyDocument:
149-
Version: "2012-10-17"
150-
Statement:
151-
- Sid: "AllowCloudTrailPublish"
152-
Effect: "Allow"
153-
Principal:
154-
Service: "cloudtrail.amazonaws.com"
155-
Action: "SNS:Publish"
156-
Resource: !Ref CloudTrailNotificationsTopic
157-
158-
Conditions:
159-
CreateSNSTopic: !Equals [!Ref CreateTopic, "true"]
160-
161-
Outputs:
162-
RoleARN:
163-
Description: "The ARN of the IAM Role created for CloudTrail logs."
164-
Value: !GetAtt CloudLogsRole.Arn
165-
166-
TopicARN:
167-
Description: "The ARN of the SNS Topic created for CloudTrail notifications."
168-
Value: !If [CreateSNSTopic, !Ref CloudTrailNotificationsTopic, !Ref TopicARN]

‎templates_cspm_cloudlogs/FullInstall.yaml

+2-76
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@ Metadata:
1212
- ExternalID
1313
- TrustedIdentity
1414
- BucketARN
15-
- CreateTopic
16-
- TopicARN
17-
- Endpoint
1815

1916
ParameterLabels:
2017
CSPMRoleName:
@@ -27,51 +24,23 @@ Metadata:
2724
default: "Trusted Identity (Sysdig use only)"
2825
BucketARN:
2926
default: "Bucket ARN"
30-
CreateTopic:
31-
default: "Create SNS Topic"
32-
TopicARN:
33-
default: "SNS Topic ARN"
34-
Endpoint:
35-
default: "Sysdig Secure endpoint"
3627

3728
Parameters:
3829
CSPMRoleName:
3930
Type: String
4031
Description: The read-only IAM Role that Sysdig will create
41-
4232
CloudLogsRoleName:
4333
Type: String
4434
Description: The name of the IAM Role that will enable access to the Cloudtrail logs.
45-
4635
ExternalID:
4736
Type: String
4837
Description: Sysdig ExternalID required for the policy creation
49-
5038
TrustedIdentity:
5139
Type: String
5240
Description: The name of Sysdig trusted identity.
53-
5441
BucketARN:
5542
Type: String
56-
Description: The ARN of your S3 bucket associated with your CloudTrail trail.
57-
58-
CreateTopic:
59-
Type: String
60-
AllowedValues:
61-
- "true"
62-
- "false"
63-
Default: "false"
64-
Description: "Whether to create a new SNS Topic for CloudTrail notifications."
65-
66-
TopicARN:
67-
Type: String
68-
Default: ""
69-
Description: "The ARN of an existing SNS Topic. If CreateTopic is true, this will be used as the name of the new topic."
70-
71-
Endpoint:
72-
Type: String
73-
Default: ""
74-
Description: "Sysdig Secure endpoint to receive CloudTrail notifications."
43+
Description: The ARN of your s3 bucket associated with your Cloudtrail trail.
7544

7645
Resources:
7746
CloudAgentlessRole:
@@ -132,8 +101,6 @@ Resources:
132101
Condition:
133102
StringEquals:
134103
"sts:ExternalId": !Ref ExternalID
135-
136-
# IAM Policy
137104
CloudLogsRolePolicies:
138105
Type: "AWS::IAM::Policy"
139106
Properties:
@@ -156,45 +123,4 @@ Resources:
156123
- !Sub '${BucketARN}'
157124
- !Sub '${BucketARN}/*'
158125
Roles:
159-
- !Ref CloudLogsRole
160-
161-
CloudTrailNotificationsTopic:
162-
Condition: CreateSNSTopic
163-
Type: "AWS::SNS::Topic"
164-
Properties:
165-
TopicName: !Select [ 5, !Split [ ":", !Ref TopicARN ] ]
166-
167-
CloudTrailNotificationsSubscription:
168-
Type: "AWS::SNS::Subscription"
169-
Properties:
170-
TopicArn: !If [ CreateSNSTopic, !Ref CloudTrailNotificationsTopic, !Ref TopicARN ]
171-
Protocol: "https"
172-
Endpoint: !Ref Endpoint
173-
174-
CloudTrailNotificationsPolicy:
175-
Condition: CreateSNSTopic
176-
Type: "AWS::SNS::TopicPolicy"
177-
Properties:
178-
Topics:
179-
- !Ref CloudTrailNotificationsTopic
180-
PolicyDocument:
181-
Version: "2012-10-17"
182-
Statement:
183-
- Sid: "AllowCloudTrailPublish"
184-
Effect: "Allow"
185-
Principal:
186-
Service: "cloudtrail.amazonaws.com"
187-
Action: "SNS:Publish"
188-
Resource: !Ref CloudTrailNotificationsTopic
189-
190-
Conditions:
191-
CreateSNSTopic: !Equals [ !Ref CreateTopic, "true" ]
192-
193-
Outputs:
194-
RoleARN:
195-
Description: "The ARN of the IAM Role created for CloudTrail logs."
196-
Value: !GetAtt CloudLogsRole.Arn
197-
198-
TopicARN:
199-
Description: "The ARN of the SNS Topic created for CloudTrail notifications."
200-
Value: !If [ CreateSNSTopic, !Ref CloudTrailNotificationsTopic, !Ref TopicARN ]
126+
- Ref: "CloudLogsRole"

0 commit comments

Comments
 (0)