Skip to content

Instantly share code, notes, and snippets.

@hisashiyamaguchi
Created October 26, 2023 22:53
Show Gist options
  • Save hisashiyamaguchi/70e0315778ba3aca38deaa15f8497aeb to your computer and use it in GitHub Desktop.
Save hisashiyamaguchi/70e0315778ba3aca38deaa15f8497aeb to your computer and use it in GitHub Desktop.
{
"AWSTemplateFormatVersion": "2010-09-09",
"Outputs": {
"OrcaRoleArn": {
"Value": {
"Fn::GetAtt": [
"OrcaSecurityRole",
"Arn"
]
}
}
},
"Parameters": {
"ExternalId": {
"Type": "String"
},
"SecretManagerAccess": {
"Type": "String",
"Default": "true",
"AllowedValues": [
"true",
"false"
]
},
"DeployRdsScanner": {
"Type": "String",
"Default": "true",
"AllowedValues": [
"true",
"false"
]
}
},
"Conditions": {
"SecretManagerAccessAllowed": {
"Fn::Equals": [
{
"Ref": "SecretManagerAccess"
},
"true"
]
},
"DeployRdsScanner": {
"Fn::Equals": [
{
"Ref": "DeployRdsScanner"
},
"true"
]
}
},
"Resources": {
"OrcaSecurityPolicy": {
"Type": "AWS::IAM::ManagedPolicy",
"Properties": {
"Description": "Orca Security Account Policy",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*::snapshot/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:TagKeys": [
"Orca"
]
},
"StringEquals": {
"ec2:CreateAction": [
"CreateSnapshot",
"CreateSnapshots",
"CopySnapshot"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteSnapshot"
],
"Resource": "*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/Orca": "*"
},
"StringNotLikeIfExists": {
"ec2:ResourceTag/OrcaOptOut": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshots",
"ec2:CreateSnapshot",
"ec2:CopySnapshot",
"ec2:ModifySnapshotAttribute"
],
"Resource": "*",
"Condition": {
"StringNotLikeIfExists": {
"ec2:ResourceTag/OrcaOptOut": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
"kms:ReEncryptFrom",
"kms:ReEncryptTo",
"kms:Encrypt",
"kms:Decrypt",
"kms:GenerateDataKeyWithoutPlaintext",
"kms:CreateGrant"
],
"Resource": "*",
"Condition": {
"StringNotLikeIfExists": {
"aws:ResourceTag/OrcaOptOut": "*"
},
"StringLike": {
"kms:ViaService": "ec2.*.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"kms:PutKeyPolicy"
],
"Resource": "*",
"Condition": {
"StringNotLikeIfExists": {
"aws:ResourceTag/OrcaOptOut": "*"
}
}
}
]
}
}
},
"OrcaSecuritySecretsManagerPolicy": {
"Type": "AWS::IAM::ManagedPolicy",
"Condition": "SecretManagerAccessAllowed",
"Properties": {
"Description": "Orca Security Secrets Manager Policy",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:*",
"Condition": {
"StringLike": {
"secretsmanager:ResourceTag/Orca": "SecretAccess"
}
}
},
{
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:ResourceTag/Orca": "SecretAccess",
"kms:ViaService": [
"secretsmanager.*.amazonaws.com"
]
}
}
}
]
}
}
},
"OrcaSecurityViewOnlyExtrasPolicy": {
"Type": "AWS::IAM::ManagedPolicy",
"Properties": {
"Description": "Orca Security Extras For View Only Policy",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"access-analyzer:ListAnalyzers",
"acm:DescribeCertificate",
"acm:GetCertificate",
"apigateway:GET",
"application-autoscaling:Describe*",
"appsync:Get*",
"appsync:List*",
"autoscaling-plans:Describe*",
"backup:Get*",
"backup:List*",
"cassandra:Select",
"cloudfront:Get*",
"cloudhsm:DescribeClusters",
"cloudtrail:Describe*",
"cloudtrail:Get*",
"cloudtrail:List*",
"cloudwatch:Describe*",
"codebuild:BatchGet*",
"codebuild:List*",
"codecommit:GetRepository",
"codepipeline:GetPipeline",
"config:Get*",
"dlm:Get*",
"dms:Describe*",
"dynamodb:Describe*",
"dynamodb:List*",
"ec2:Describe*",
"ec2:GetEbsEncryptionByDefault",
"ec2:List*",
"ec2:SearchTransitGatewayRoutes",
"ecr:BatchGetImage",
"ecr:Describe*",
"ecr:Get*",
"ecr:List*",
"eks:Describe*",
"eks:List*",
"elasticache:Describe*",
"elasticfilesystem:Describe*",
"elasticfilesystem:List*",
"elasticloadbalancing:Describe*",
"elasticmapreduce:DescribeSecurityConfiguration",
"elasticmapreduce:DescribeCluster",
"es:Describe*",
"es:List*",
"events:List*",
"glacier:Describe*",
"glacier:Get*",
"globalaccelerator:List*",
"glue:GetDataCatalogEncryptionSettings",
"glue:GetDatabases",
"glue:GetDevEndpoints",
"glue:GetResourcePolicy",
"glue:GetSecurityConfigurations",
"guardduty:Get*",
"guardduty:List*",
"iam:Generate*",
"iam:Get*",
"iam:Simulate*",
"kafka:Describe*",
"kafka:List*",
"kinesis:DescribeStream",
"kms:Describe*",
"kms:Get*",
"kms:List*",
"lakeformation:GetDataLakeSettings",
"lakeformation:GetEffectivePermissionsForPath",
"lakeformation:ListResources",
"lambda:Get*",
"logs:FilterLogEvents",
"logs:Get*",
"logs:ListTagsLogGroup",
"logs:StartQuery",
"logs:TestMetricFilter",
"memorydb:Describe*",
"memorydb:List*",
"mq:Describe*",
"mq:List*",
"network-firewall:List*",
"network-firewall:Describe*",
"organizations:Describe*",
"qldb:DescribeLedger",
"qldb:ListLedgers",
"rds:List*",
"redshift:Describe*",
"resource-groups:Get*",
"resource-groups:List*",
"resource-groups:Search*",
"route53:Test*",
"route53domains:Check*",
"route53domains:Get*",
"route53domains:View*",
"s3:Get*",
"s3:List*",
"secretsmanager:Describe*",
"secretsmanager:GetResourcePolicy",
"secretsmanager:List*",
"serverlessrepo:Get*",
"serverlessrepo:List*",
"ses:GetIdentityDkimAttributes",
"ses:GetIdentityPolicies",
"ses:GetIdentityVerificationAttributes",
"sns:Get*",
"sqs:GetQueueAttributes",
"sqs:ListQueueTags",
"ssm:Describe*",
"ssm:GetParameter*",
"ssm:GetParametersByPath",
"ssm:List*",
"sso:DescribePermissionSet",
"sso:GetInlinePolicyForPermissionSet",
"sso:ListAccountAssignments",
"sso:ListInstances",
"sso:ListManagedPoliciesInPermissionSet",
"sso:ListPermissionSets",
"states:DescribeStateMachine",
"timestream:ListDatabases",
"identitystore:DescribeGroup",
"identitystore:DescribeUser",
"identitystore:ListGroups",
"identitystore:ListUsers",
"identitystore:ListGroupMemberships",
"tag:Get*",
"waf-regional:Get*",
"waf:Get*"
],
"Resource": "*"
}
]
}
}
},
"OrcaRdsSnapshotCreatePolicy": {
"Type": "AWS::IAM::ManagedPolicy",
"Condition": "DeployRdsScanner",
"Properties": {
"Description": "Orca Security RDS Snapshot Creation Policy",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"rds:AddTagsToResource",
"rds:DeleteDBSnapshot",
"rds:DeleteDBClusterSnapshot"
],
"Resource": [
"arn:aws:rds:*:*:snapshot:*",
"arn:aws:rds:*:*:cluster-snapshot:*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/Orca": "*"
},
"StringNotLikeIfExists": {
"aws:ResourceTag/OrcaOptOut": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
"rds:CreateDBSnapshot",
"rds:CreateDBClusterSnapshot",
"rds:CopyDBSnapshot",
"rds:CopyDBClusterSnapshot"
],
"Resource": [
"arn:aws:rds:*:*:db:*",
"arn:aws:rds:*:*:cluster:*",
"arn:aws:rds:*:*:snapshot:*",
"arn:aws:rds:*:*:cluster-snapshot:*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:TagKeys": "Orca"
},
"StringNotLikeIfExists": {
"aws:ResourceTag/OrcaOptOut": "*"
}
}
}
]
}
}
},
"OrcaRdsSnapshotReencryptPolicy": {
"Type": "AWS::IAM::ManagedPolicy",
"Condition": "DeployRdsScanner",
"Properties": {
"Description": "Orca Security RDS Snapshot Re-Encryption Policy",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CreateGrantForDbSnapshotReencryption",
"Effect": "Allow",
"Action": "kms:CreateGrant",
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"ForAllValues:StringLike": {
"kms:GrantOperations": [
"DescribeKey",
"Decrypt",
"Encrypt",
"GenerateDataKeyWithoutPlaintext",
"CreateGrant",
"RetireGrant"
]
},
"Bool": {
"kms:GrantIsForAWSResource": true
},
"StringLike": {
"aws:ResourceAccount": "${aws:PrincipalTag/OrcaScannerAccountId, '*'}"
},
"ForAnyValue:StringLike": {
"kms:ViaService": "rds.*.amazonaws.com"
}
}
},
{
"Sid": "DescribeKeyForDbSnapshotReencryption",
"Effect": "Allow",
"Action": "kms:DescribeKey",
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringLike": {
"aws:ResourceAccount": "${aws:PrincipalTag/OrcaScannerAccountId, '*'}"
},
"ForAnyValue:StringLike": {
"kms:ViaService": "rds.*.amazonaws.com"
}
}
},
{
"Sid": "Tag",
"Effect": "Allow",
"Action": "rds:AddTagsToResource",
"Resource": [
"arn:aws:rds:*:*:snapshot:*",
"arn:aws:rds:*:*:cluster-snapshot:*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/Orca": "*"
},
"StringNotLikeIfExists": {
"aws:ResourceTag/OrcaOptOut": "*"
}
}
},
{
"Sid": "CopyDbSnapshots",
"Effect": "Allow",
"Action": [
"rds:CopyDBSnapshot",
"rds:CopyDBClusterSnapshot"
],
"Resource": [
"arn:aws:rds:*:*:snapshot:*",
"arn:aws:rds:*:*:cluster-snapshot:*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:TagKeys": "Orca"
},
"StringNotLikeIfExists": {
"aws:ResourceTag/OrcaOptOut": "*"
}
}
}
]
}
}
},
"OrcaRdsSnapshotSharePolicy": {
"Type": "AWS::IAM::ManagedPolicy",
"Condition": "DeployRdsScanner",
"Properties": {
"Description": "Orca Security RDS Snapshot Sharing Policy",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ModifyDbSnapshots",
"Effect": "Allow",
"Action": [
"rds:ModifyDBSnapshotAttribute",
"rds:ModifyDBClusterSnapshotAttribute"
],
"Resource": [
"arn:aws:rds:*:*:snapshot:*",
"arn:aws:rds:*:*:cluster-snapshot:*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/Orca": "*"
},
"StringNotLikeIfExists": {
"aws:ResourceTag/OrcaOptOut": "*"
}
}
}
]
}
}
},
"OrcaSecurityRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::976280145156:root"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": {
"Ref": "ExternalId"
}
}
}
}
]
},
"ManagedPolicyArns": {
"Fn::Split": [
",",
{
"Fn::Join": [
"",
[
{
"Fn::Join": [
",",
[
"arn:aws:iam::aws:policy/job-function/ViewOnlyAccess",
{
"Ref": "OrcaSecurityPolicy"
},
{
"Ref": "OrcaSecurityViewOnlyExtrasPolicy"
}
]
]
},
{
"Fn::If": [
"SecretManagerAccessAllowed",
{
"Fn::Sub": [
",${SecretsManagerPolicyArn}",
{
"SecretsManagerPolicyArn": {
"Ref": "OrcaSecuritySecretsManagerPolicy"
}
}
]
},
""
]
},
{
"Fn::If": [
"DeployRdsScanner",
{
"Fn::Sub": [
",${RdsCreateSnapshotPolicyArn},${RdsReencryptSnapshotPolicyArn},${RdsShareSnapshotPolicyArn}",
{
"RdsCreateSnapshotPolicyArn": {
"Ref": "OrcaRdsSnapshotCreatePolicy"
},
"RdsReencryptSnapshotPolicyArn": {
"Ref": "OrcaRdsSnapshotReencryptPolicy"
},
"RdsShareSnapshotPolicyArn": {
"Ref": "OrcaRdsSnapshotSharePolicy"
}
}
]
},
""
]
}
]
]
}
]
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment